Our news and updates

In Kafka-UI versions 0.6.0 through 0.7.2 a high severity vulnerability CVE-2025-60536 was detected. This vulnerability in the Configure New Cluster interface allows attackers to cause a denial of service (DoS) by uploading a crafted configuration file. To fix this vulnerability, users should upgrade to a version later than 0.7.2. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-60536.

In Django versions 5.1 before 5.1.14, 4.2 before 4.2.26, and 5.2 before 5.2.8 a critical severity vulnerability CVE-2025-64459 was identified. This vulnerability allows attackers to perform SQL injection by supplying a crafted dictionary as the _connector argument in QuerySet and Q objects. To fix this vulnerability, users should upgrade to Django 5.1.14, 4.2.26, 5.2.8 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-64459.

In Django versions 5.1 before 5.1.14, 4.2 before 4.2.26, and 5.2 before 5.2.8 a high severity vulnerability CVE-2025-64458 was identified. Due to slow NFKC normalization on Windows systems, HttpResponseRedirect, HttpResponsePermanentRedirect, and the redirect shortcut could be abused to trigger excessive processing time using inputs containing very large numbers of Unicode characters, potentially leading to a denial-of-service (DoS). To fix this vulnerability, users should upgrade to Django 5.1.14, 4.2.26, 5.2.8 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-64458.

In Kubernetes C# client versions prior to 17.0.14 a medium severity vulnerability CVE-2025-9708 was detected. This vulnerability allows the client to accept certificates from any Certificate Authority (CA) without properly validating the trust chain in custom CA mode, which may allow a malicious actor to present a forged certificate and perform man-in-the-middle attacks or API impersonation. To fix this vulnerability, users should upgrade to version 17.0.14 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-9708.

In Kafka-UI versions 0.6.0 through 0.7.2 a medium severity vulnerability CVE-2025-60537 was detected. This vulnerability in the /kafka/ui/serdes/CustomSerdeLoader.java component allows attackers to execute arbitrary code by supplying crafted data. To fix this vulnerability, users should upgrade to a version later than 0.7.2. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-60537.

In Genesis Framework theme for WordPress versions up to and including 3.6.0 a medium severity vulnerability CVE-2025-10737 was detected. This vulnerability allows authenticated attackers with contributor-level access and above to inject arbitrary web scripts via the theme’s shortcodes due to insufficient input sanitization and output escaping. To fix this vulnerability, users should upgrade to version 3.6.1 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-10737.

In WordPress User Feedback plugin versions up to and including 1.8.0 a medium severity vulnerability CVE-2025-10694 was detected. This vulnerability allows unauthenticated attackers to access the plugin’s onboarding wizard page due to a missing capability check, exposing configuration details including the administrator’s email address. To fix this vulnerability, users should upgrade to version 1.8.1 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-10694.

In the WordPress BackWPup plugin versions prior to and including 5.5.0 a medium severity vulnerability CVE-2025-10579 was detected. This vulnerability allows authenticated attackers with Subscriber-level access and above to retrieve a backup’s filename via the backwpup_working AJAX action due to a missing capability check. While the filename alone has limited value, it could aid targeted brute-force attempts to obtain backup contents in certain environments. To fix this vulnerability, users should upgrade to version 5.5.1 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-10579.

In the WordPress eRoom – Webinar & Meeting Plugin for Zoom, Google Meet, Microsoft Teams versions prior to and including 1.5.6 a high severity vulnerability CVE-2025-11760 was detected. This vulnerability exposes the Zoom SDK secret key in client-side JavaScript, making it possible for unauthenticated attackers to extract the key and generate valid JWT signatures. This could allow unauthorized access to private meetings or other Zoom resources. To fix this vulnerability, users should upgrade to version 1.5.7 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-11760.