Our news and updates

In GitLab CE/EE versions 8.3 through 18.4.4, 18.5 through 18.5.2, and 18.6 before 18.6.1 a medium severity vulnerability CVE-2025-7449 was detected. This vulnerability allows authenticated users with specific permissions to cause a denial of service (DoS) condition through HTTP response processing. To address this issue, users should upgrade GitLab to versions 18.4.5, 18.5.3, 18.6.1 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-7449.

In GitLab CE/EE versions 17.10 through 18.4.4, 18.5 through 18.5.2, and 18.6 before 18.6.1 a high severity vulnerability CVE-2025-12571 was detected. This vulnerability allows unauthenticated users to cause a denial of service (DoS) by sending specially crafted requests containing malicious JSON payloads. To address this issue, users should upgrade GitLab to versions 18.4.5, 18.5.3, 18.6.1 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-12571.

In GitLab EE versions 13.7 through 18.4.4, 18.5 through 18.5.2, and 18.6 before 18.6.1 a medium severity vulnerability CVE-2025-6195 was detected. This vulnerability could allow authenticated users to view information from security reports under certain configuration conditions. To address this issue, users should upgrade GitLab to versions 18.4.5, 18.5.3, 18.6.1 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-6195.

In the Webform Multiple File Upload module for Drupal 7.x a high severity vulnerability CVE-2025-12848 was detected. This vulnerability allows unauthenticated attackers to execute arbitrary JavaScript in a victim’s browser by uploading a file with a malicious filename when file type validation is disabled on a Webform Multifile field. The issue originates from a third-party library used by the module. To address this issue, users should update the module to version 7.x-1.5 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-12848.

In OpenSearch versions prior to 3.2.0 a high severity vulnerability CVE-2025-9624 was detected. This vulnerability allows attackers to cause a denial of service (DoS) by submitting complex query_string inputs that trigger excessive resource consumption. To address this issue, users should upgrade OpenSearch to version 3.2.0 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-9624.

In YouTube Subscribe plugin versions up to and including 3.0.0 a medium severity vulnerability CVE-2025-12025 was detected. This vulnerability allows authenticated attackers with administrator-level permissions and above to inject arbitrary web scripts via admin settings, which execute when users access the affected pages. This issue affects only multi-site installations or sites where unfiltered_html has been disabled. To address this issue, users should upgrade the plugin to version 3.0.1 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-12025.

In Wishlist for WooCommerce plugin versions up to and including 1.0.9 a medium severity vulnerability CVE-2025-12040 was detected. This vulnerability allows unauthenticated attackers to modify other users’ wishlists due to missing validation on a user-controlled key in several functions within class-th-wishlist-frontend.php. To address this issue, users should upgrade the plugin to version 1.1.0 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-12040.

In Autochat Automatic Conversation plugin versions up to and including 1.1.9 a medium severity vulnerability CVE-2025-12043 was detected. This vulnerability allows unauthenticated attackers to connect and disconnect client IDs due to a missing capability check on the wp_ajax_nopriv_auycht_saveCid AJAX endpoint. To address this issue, users should upgrade the plugin to version 1.2.0 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-12043.

In MongoDB Server versions 7.0 prior to 7.0.26, 8.0 prior to 8.0.13, and 8.1 prior to 8.1.2 a high severity vulnerability CVE-2025-13644 was detected. The issue allows a batched delete operation to trigger an invariant failure and crash the server when MongoDB incorrectly assumes multiple documents are present in a batch solely because a document exceeds BSONObjMaxSize. To address this issue, users should update to MongoDB Server 7.0.26, 8.0.13, or 8.1.2 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-13644.