Developer Tools

In Jenkins versions 2.540 and earlier, including LTS 2.528.2 and earlier a medium severity vulnerability CVE-2025-67637 was detected. This vulnerability allows users with Item/Extended Read permissions or access to the Jenkins controller file system to view unencrypted build authorization tokens stored in job `config.xml` files, exposing sensitive information. To address this issue, users should upgrade Jenkins to versions 2.541 or 2.528.3. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-67637.

In Jenkins versions 2.540 and earlier, including LTS 2.528.2 and earlier a medium severity vulnerability CVE-2025-67636 was detected. This vulnerability allows attackers with View/Read permissions to view encrypted password values due to a missing permission check. To address this issue, users should upgrade Jenkins to versions 2.541 or 2.528.3. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-67636.

In GitLab CE/EE versions 15.11 through 18.4.5, 18.5 through 18.5.3, and 18.6 through 18.6.1 a high severity vulnerability CVE-2025-12029 was detected. This vulnerability allows unauthenticated attackers to perform unauthorized actions on behalf of other users by injecting malicious external scripts into the Swagger UI. To address this issue, users should upgrade GitLab CE/EE versions 18.4.6, 18.5.4 or 18.6.2. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-12029.

In GitLab CE/EE versions 13.1 through 18.4.5, 18.5 through 18.5.3, and 18.6 through 18.6.1 a medium severity vulnerability CVE-2025-11984 was detected. This vulnerability allows authenticated attackers to bypass WebAuthn two-factor authentication by manipulating the session state under specific conditions. To address this issue, users should upgrade GitLab CE/EE to versions 18.4.6, 18.5.4 or 18.6.2. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-11984.

In GitLab EE versions 13.2 through 18.4.5, 18.5 through 18.5.3, and 18.6 through 18.6.1 a medium severity vulnerability CVE-2025-11247 was detected. This vulnerability allows authenticated users to disclose sensitive information from private projects by executing specifically crafted GraphQL queries. To address this issue, users should upgrade GitLab EE to versions 18.4.6, 18.5.4 or 18.6.2. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-11247.

In GitLab CE/EE versions 17.1 through 18.4.5, 18.5 through 18.5.3, and 18.6 through 18.6.1 a high severity vulnerability CVE-2025-8405 was detected. This vulnerability allows authenticated users to perform unauthorized actions on behalf of other users by injecting malicious HTML into vulnerability code flow displays. To address this issue, users should upgrade GitLab CE/EE to versions 18.4.6, 18.5.4 or 18.6.2. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-8405.

In GitLab CE/EE versions 11.10 through 18.4.5, 18.5 through 18.5.3, and 18.6 through 18.6.1 a high severity vulnerability CVE-2025-4097 was detected. This vulnerability allows authenticated users to trigger a denial-of-service condition by uploading specially crafted images. To address this issue, users should upgrade GitLab CE/EE to versions 18.4.6, 18.5.4 or 8.6.2. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-4097.

In GitLab CE/EE versions 18.4 prior to 18.4.5, 18.5 prior to 18.5.3 and 18.6 prior to 18.6.1 a high severity vulnerability CVE-2024-9183 was detected. This vulnerability allows authenticated attackers, under specific conditions, to exploit a time-of-check time-of-use (TOCTOU) race condition to obtain credentials from higher-privileged users and perform unauthorized actions in their context. To address this issue, users should upgrade GitLab CE/EE to versions 18.4.5, 18.5.3 or 18.6.1. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2024-9183.

In Nexus Repository versions 3.83.0 through 3.83.x a medium severity vulnerability CVE-2025-13488 was detected. Due to a regression introduced in version 3.83.0, a security header is no longer applied to certain user-uploaded content served from repositories. This vulnerability allows an authenticated attacker with repository upload privileges to exploit a stored cross-site scripting (XSS) vulnerability in the context of the user. To address this issue, users should upgrade Nexus Repository to version 3.84.0 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-13488.