Infrastructure and Network

In the WP Duplicate Page plugin for WordPress versions up to and including 1.8 a medium severity vulnerability CVE-2025-14001 was detected. This vulnerability allows authenticated attackers with Contributor-level access and above to duplicate arbitrary posts, pages, and WooCommerce HPOS orders due to missing capability checks in the duplicateBulkHandle and duplicateBulkHandleHPOS functions, even when their role is explicitly excluded in the plugin’s Allowed User Roles settings. To address this issue, users should upgrade the WP Duplicate Page plugin to version 1.8.1 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-14001.

In OpenVPN versions 2.5.0 through 2.7_rc2 a low severity vulnerability CVE-2025-13751 was identified. This vulnerability allows a local authenticated user on Windows to connect to the Interactive Service Agent and trigger an error causing a local denial of service. To address this issue, users should upgrade OpenVPN to versions 2.6.17, 2.7_rc3, or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-13751.

In OpenVPN versions 2.6.0 through 2.7_rc1 a medium severity vulnerability CVE-2025-13086 was identified. This vulnerability stems from improper validation of source IP addresses, allowing an attacker to initiate a session from an IP address different from the one that originally established the connection. This vulnerability can result in session hijacking and denial of service for the legitimate originating client. To address this issue, users should upgrade OpenVPN to versions 2.6.16, 2.7_rc2 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-13086.

In OpenVPN versions 2.7_alpha1 through 2.7_rc1 a critical severity vulnerability CVE-2025-12106 was identified. This vulnerability is caused by insufficient argument validation when parsing IP addresses, allowing an attacker to trigger a heap buffer over-read during processing. Successful exploitation could lead to application crashes or undefined behavior under specific conditions. To address this issue, users should upgrade OpenVPN to version 2.7.0 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-12106.

In Wazuh versions 3.7.0 through 4.11.x a medium severity vulnerability CVE-2025-64169 was detected. This vulnerability allows a compromised agent to crash the `analysisd` process on the Wazuh manager due to a NULL pointer dereference in the `fim_alert()` function when `oldsum->md5` is not properly checked. To address this issue, users should upgrade Wazuh to versions 4.12.0 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-64169.

In Wazuh versions 4.3.0 through 4.12.x a low severity vulnerability CVE-2025-54866 was detected. This vulnerability allows all authenticated users on a Windows machine to access the `authd.pass` file due to missing access control lists (ACLs) on `C:\Program Files (x86)\ossec-agent\authd.pass`, exposing sensitive passwords. To address this issue, users should upgrade Wazuh to version 4.13.0 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-54866.

In Wazuh Agent versions prior to 4.13.0 a high severity vulnerability CVE-2025-30201 was detected. This vulnerability allows authenticated attackers to force NTLM authentication via malicious UNC paths in agent configuration settings, potentially enabling NTLM relay attacks that could lead to privilege escalation and remote code execution. To address this issue, users should upgrade Wazuh to version 4.13.0 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-30201.

In authentik versions prior to 2025.8.5 and 2025.10.2 a medium severity vulnerability CVE-2025-64708 was detected. This vulnerability allows expired invitations to remain valid because invitation validation relied solely on background cleanup tasks, which normally run every five minutes but may be delayed when a large backlog of tasks exists. As a result, expired invitations could still be used until the cleanup occurred. To address this issue, users should upgrade authentik to versions 2025.8.5, 2025.10.2, or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-64708.

In authentik versions prior to 2025.8.5 and 2025.10.2 a medium severity vulnerability CVE-2025-64521 was detected. This vulnerability allows authentication to succeed for service accounts created for OAuth providers even when those accounts are deactivated, while other permission checks and assigned policies continue to function correctly. To address this issue, users should upgrade authentik to versions 2025.8.5, 2025.10.2, or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-64521.