Our news and updates

In Gitea versions before 1.25.2 a medium severity vulnerability CVE-2025-68938 was detected. This vulnerability allows attackers to delete releases without proper authorization due to insufficient permission checks during the release deletion process. To address this issue, users should upgrade Gitea to version 1.25.2 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-68938.

In Kimai version 1.30.10 a critical severity vulnerability CVE-2023-53957 was detected. This vulnerability allows attackers to exploit improper SameSite cookie handling to steal user session cookies, potentially leading to session hijacking. An attacker can trick a victim into executing a crafted PHP script that captures and writes session cookie data, enabling unauthorized access to the user’s account. Currently, there is no fix version for this issue. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2023-53957.

In Gitea versions before 1.21.2 a medium severity vulnerability CVE-2025-68945 was detected. This vulnerability allows unauthenticated users to access private projects due to improper access control enforcement. To address this issue, users should upgrade Gitea to version 1.21.2 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-68945.

In Gitea versions before 1.22.2 a medium severity vulnerability CVE-2025-68944 was detected. This vulnerability allows attackers to gain unauthorized access by exploiting improper propagation of token scopes within the package registry, potentially leading to access beyond intended permissions. To address this issue, users should upgrade Gitea to version 1.22.2 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-68944.

In Gitea versions before 1.21.8 a medium severity vulnerability CVE-2025-68943 was detected. This vulnerability allows attackers to discover users’ login times via the Explore/Users sorting functionality. To address this issue, users should upgrade Gitea to version 1.21.8 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-68943.

In Gitea versions before 1.22.2 a medium severity vulnerability CVE-2025-68942 was detected. This vulnerability allows attackers to perform cross-site scripting (XSS) via the tag and branch search input box due to improper rendering of input as v-html instead of v-text. To address this issue, users should upgrade Gitea to version 1.22.2 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-68942.

In Gitea versions before 1.22.3 a medium severity vulnerability CVE-2025-68941 was detected. This vulnerability allows attackers to bypass API token scope restrictions and access private resources when a token is limited to public resources. To address this issue, users should upgrade Gitea to version 1.22.3 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-68941.

In MariaDB versions affected by CVE-2025-13699 a medium severity vulnerability was detected. This vulnerability allows remote attackers to execute arbitrary code via the mariadb-dump utility due to improper validation of user-supplied paths in view names, enabling directory traversal and code execution in the context of the current user. Currently, there is no fix version for this issue. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-13699.

In Elasticsearch versions 7.0.0-alpha1 and prior, prior to 8.19.8, 9.0.0-beta1 and prior, prior to 9.1.8, 9.2.0 and prior, 9.2.1 and prior a medium severity vulnerability CVE-2025-68390 was detected. This vulnerability is caused by allocation of resources without limits or throttling (CWE-770), allowing an authenticated user with snapshot restore privileges to trigger excessive memory allocation through a crafted HTTP request, resulting in a denial of service (DoS). To address this issue, users should upgrade Elasticsearch to versions 8.19.8, 9.1.8 and 9.2.2. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-68390.