Developer Tools

In GitLab CE/EE versions from 16.11 before 18.1.6, 18.2 before 18.2.6, and 18.3 before 18.3.2 a medium severity vulnerability CVE-2025-6454 was detected. This vulnerability allows authenticated users to make unintended internal requests through proxy environments by injecting crafted sequences. To address this issue, users should upgrade GitLab CE/EE to versions 18.1.6, 18.2.6, or 18.3.2. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-6454.

In GitLab Community Edition and Enterprise Edition all versions prior to 18.1.5, 18.2 before 18.2.5, and 18.3 before 18.3.1 a medium severity vulnerability CVE-2025-5101 was detected. This vulnerability allows an authenticated attacker under certain conditions to distribute malicious code that appears harmless in the web interface by exploiting ambiguity between branches and tags during repository imports. To address this issue, users should upgrade GitLab to versions 18.1.5, 18.2.5, 18.3.1 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-5101.

In SonarQube Server and Cloud versions 4 through 5.3.0 a high severity vulnerability CVE-2025-58178 was detected. This vulnerability allows untrusted input arguments in the SonarQube Scan GitHub Action to be processed without proper sanitization, leading to command injection. To address this issue, users should upgrade SonarQube to version 5.3.1. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-58178.

In Argo CD versions 2.13.0 through 2.13.8, 2.14.0 through 2.14.15, 3.0.0 through 3.0.12 and 3.1.0-rc1 through 3.1.1 a critical severity vulnerability CVE-2025-55190 was detected. This vulnerability allows an attacker to retrieve sensitive repository credentials (usernames, passwords) through the project details API endpoint. To address this issue, users should upgrade Argo CD to versions 2.13.9, 2.14.16, 3.0.14 or 3.1.2. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-55190.

In Rancher versions 0.11.0 before 0.11.10, 0.12.0 before 0.12.6, and 0.13.0 before 0.13.1 a high severity vulnerability CVE-2024-52284 was detected. This vulnerability allows attackers with GET or LIST permissions to see Helm values that contain passwords or other secrets. To fix this issue, users should upgrade Rancher to versions 0.11.10, 0.12., or 0.13.1. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2024-52284.

In Rancher Manager versions 2.12.0 through 2.12.0, 2.11.0 through 2.11.4, 2.10.0 through 2.10.8, and 2.9.0 through 2.9.11 a high severity vulnerability CVE-2024-58259 was detected. This vulnerability allows an attacker to cause a Denial of Service (DoS) by sending excessively large payloads to unauthenticated and authenticated API endpoints. To address this issue, users should upgrade Rancher Manager to versions 2.12.1, 2.11.5, 2.10.9 or 2.9.12. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2024-58259.

In Kubernetes versions 1.31.11 and prior, 1.32.7 and prior and 1.33.3 and prior a medium severity vulnerability CVE-2025-5187 was detected. This vulnerability allows an attacker to delete their corresponding node object and then recreate it with modified taints or labels. To address this issue, users should upgrade kube-apiserver binary to versions 1.31.12, 1.32.8, 1.33.4 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-5187.

In GitLab CE/EE versions before 18.1.5, 18.2 before 18.2.5 and 18.3 before 18.3.1 a medium severity vulnerability CVE-2025-5101 was detected. This vulnerability allows an authenticated attacker to distribute malicious code that appears harmless in the web interface. To address this issue, users should upgrade GitLab CE/EE to versions 18.3.1, 18.2.5 or 18.1.5. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-5101.

In GitLab CE/EE versions 14.1 through 18.1.5, 18.2 through 18.2.5 and 18.3 through 18.3.1 a medium severity vulnerability CVE-2025-4225 was detected. This vulnerability allows an unauthenticated attacker to cause a denial-of-service condition by sending specially crafted GraphQL requests. To address this issue, users should upgrade GitLab CE/EE to versions 18.3.1, 18.2.5 or 18.1.5. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-4225.