Our news and updates

In MongoDB Server versions 7.0 prior to 7.0.26, 8.0 prior to 8.0.13, and 8.1 prior to 8.1.2 a high severity vulnerability CVE-2025-13644 was detected. The issue allows a batched delete operation to trigger an invariant failure and crash the server when MongoDB incorrectly assumes multiple documents are present in a batch solely because a document exceeds BSONObjMaxSize. To address this issue, users should update to MongoDB Server 7.0.26, 8.0.13, or 8.1.2 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-13644.

In MongoDB Server versions 7.0 prior to 7.0.26 and 8.0 prior to 8.0.14 a medium severity vulnerability CVE-2025-13643 was detected. This vulnerability allows a user with limited cluster privileges to terminate queries executed by other users, potentially causing denial of service by preventing some queries from completing successfully. To address this issue, users should upgrade MongoDB Server to versions 7.0.26, 8.0.14, or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-13643.

In MongoDB Server versions 7.0 prior to 7.0.26, 8.0 prior to 8.0.16, and 8.2 prior to 8.2.2 a medium severity vulnerability CVE-2025-12893 was detected. This vulnerability allows MongoDB servers running on Windows or Apple platforms to successfully complete TLS handshakes with client or server certificates that do not meet the documented Extended Key Usage (EKU) requirements. Specifically, certificates missing the clientAuth EKU may still authenticate as clients, and on Apple servers, certificates missing the serverAuth EKU may still authenticate as servers during egress TLS connections. To address this issue, users should upgrade MongoDB Server to versions 7.0.26, 8.0.16, or 8.2.2 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-12893.

In WordPress eCommerce Plugin versions up to and including 2.9.0 a high severity vulnerability CVE-2024-14015 was detected. This vulnerability allows attackers to perform reflected cross-site scripting (XSS) by exploiting unsanitized and unescaped parameters output back on the page, which could be used against high privilege users such as administrators. To address this issue, users should upgrade the plugin to a version later than 2.9.0. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2024-14015.

In Wazuh versions 3.7.0 through 4.11.x a medium severity vulnerability CVE-2025-64169 was detected. This vulnerability allows a compromised agent to crash the `analysisd` process on the Wazuh manager due to a NULL pointer dereference in the `fim_alert()` function when `oldsum->md5` is not properly checked. To address this issue, users should upgrade Wazuh to versions 4.12.0 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-64169.

In Terraform Enterprise versions prior to 1.1.1 and 1.0.3 a medium severity vulnerability CVE-2025-13432 was detected. This vulnerability allows users with specific but insufficient permissions to create Terraform state versions in a workspace, potentially enabling infrastructure alteration if a subsequent plan operation is approved or auto-applied. To address this issue, users should upgrade Terraform Enterprise to versions 1.1.1, 1.0.3 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-13432.

In Wazuh versions 4.3.0 through 4.12.x a low severity vulnerability CVE-2025-54866 was detected. This vulnerability allows all authenticated users on a Windows machine to access the `authd.pass` file due to missing access control lists (ACLs) on `C:\Program Files (x86)\ossec-agent\authd.pass`, exposing sensitive passwords. To address this issue, users should upgrade Wazuh to version 4.13.0 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-54866.

In Wazuh Agent versions prior to 4.13.0 a high severity vulnerability CVE-2025-30201 was detected. This vulnerability allows authenticated attackers to force NTLM authentication via malicious UNC paths in agent configuration settings, potentially enabling NTLM relay attacks that could lead to privilege escalation and remote code execution. To address this issue, users should upgrade Wazuh to version 4.13.0 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-30201.

In LimeSurvey versions up to and including 6.13.0 a medium severity vulnerability CVE-2025-41074 was detected. This issue allows unauthenticated attackers to trigger an infinite redirect loop by directly accessing the /optout endpoint, potentially leading to a denial‑of‑service condition through excessive server or client resource consumption. To address this issue, users should upgrade LimeSurvey to version 6.15.0 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-41074.