Data Management and Analytics

In Ashlar-Vellum Graphite version 13_SE_13048 a high severity vulnerability CVE-2025-7979 was detected. This vulnerability allows remote attackers to execute arbitrary code on affected installations by exploiting improper validation of the length of user-supplied data during VC6 file parsing, which can result in a stack-based buffer overflow when a user opens a malicious file. Currently, there is no fix version for this issue. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-7979.

In Liferay Portal versions 7.4.0 through 7.4.3.112, and Liferay DXP versions 2023.Q4.0 through 2023.Q4.7, 2023.Q3.1 through 2023.Q3.10, and 7.4 GA through update 92 a medium severity vulnerability CVE-2025-43806 was detected. This vulnerability allows an authenticated attacker to access exported data via the REST APIs due to a permission check flaw. To address this issue, users should upgrade Liferay Portal to version 7.4.3.113 and Liferay DXP to versions 2024.Q2.0, 2024.Q1.1 or 2023.Q4.8. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-43806.

In Liferay Portal versions 7.4.0 through 7.4.3.112, and Liferay DXP versions 2023.Q4.0 through 2023.Q4.8, 2023.Q3.1 through 2023.Q3.10, and 7.4 GA through update 92 a medium severity vulnerability CVE-2025-43807 was detected. This vulnerability allows a remote attacker to inject arbitrary web script or HTML via a crafted payload injected into a publication’s “Name” text field in the notifications widget. To address this issue, users should upgrade Liferay Portal to version 7.4.3.113 and Liferay DXP to versions 2024.Q2.0, 2024.Q1.1 or 2023.Q4.9. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-43807.

In Kibana versions 9.0.0 up to and including 9.0.5 and versions 9.1.0 up to and including 9.1.2 a medium severity vulnerability CVE-2025-25010 was detected. This vulnerability allows an attacker to escalate privileges via the reporting_user role, which can access all Kibana Spaces. To address this issue, users should upgrade Kibana to versions 9.0.6 or 9.1.3. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-25010.

In PostgreSQL versions 13 through 17 a high severity vulnerability CVE-2025-8714 was detected. This vulnerability allows attackers to inject arbitrary code for restore-time execution as the client operating system account running psql via psql meta-commands. To address this issue, users should upgrade PostgreSQL to versions 13.22, 14.19, 15.14, 16.10 or 17.6. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-8714.

In PostgreSQL versions 13 through 17 a high severity vulnerability CVE-2025-8715 was detected. This vulnerability allows attackers to inject arbitrary code or achieve SQL injection via a purpose-crafted object name during the restore process. To address this issue, users should upgrade PostgreSQL to versions 13.22, 14.19, 15.14, 16.10 or 17.6. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-8715.

In PostgreSQL versions 13 through 17 a low severity vulnerability CVE-2025-8713 was detected. This vulnerability allows attackers to read sampled data from views or tables that are protected by access control lists (ACLs) or row security policies. To address this issue, users should upgrade PostgreSQL to versions 13.22, 14.19, 15.14, 16.10 or 17.6. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-8713.

In SQLite versions from 3.39.2 to before 3.41.2 a medium severity vulnerability CVE-2025-7458 was detected. This vulnerability allows attackers to crash the system or read sensitive data from memory by running a specially crafted SELECT query with many items in the ORDER BY part. To address this issue, users should upgrade SQLite to versions 3.41.2 or later. For more details, visit https://avd.aquasec.com/nvd/2025/cve-2025-7458.

In Redis versions up to and including 8.0.3 a medium severity vulnerability CVE-2025-46686 was detected. This vulnerability allows authenticated attackers to cause excessive memory consumption by sending a multi-bulk command with many bulks, even if the command is skipped due to insufficient permissions. Currently, there is no fix version for this issue. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-46686.