In GitLab CE/EE versions before 18.1.5, 18.2 before 18.2.5 and 18.3 before 18.3.1 a medium severity vulnerability CVE-2025-5101 was detected. This vulnerability allows an authenticated attacker to distribute malicious code that appears harmless in the web interface. To address this issue, users should upgrade GitLab CE/EE to versions 18.3.1, 18.2.5 or 18.1.5. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-5101.
Read more Developer Tools
In GitLab CE/EE versions 14.1 through 18.1.5, 18.2 through 18.2.5 and 18.3 through 18.3.1 a medium severity vulnerability CVE-2025-4225 was detected. This vulnerability allows an unauthenticated attacker to cause a denial-of-service condition by sending specially crafted GraphQL requests. To address this issue, users should upgrade GitLab CE/EE to versions 18.3.1, 18.2.5 or 18.1.5. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-4225.
Read more Developer Tools
In GitLab CE/EE versions 8.15 through 18.1.5, 18.2 through 18.2.5 and 18.3 through 18.3.1 a medium severity vulnerability CVE-2025-3601 was detected. This vulnerability allows an authenticated user to cause a Denial of Service (DoS) condition by submitting URLs that generate excessively large responses. To address this issue, users should upgrade GitLab CE/EE to versions 18.3.1, 18.2.5 or 18.1.5. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-3601.
Read more Developer Tools
In GitLab CE/EE versions before 18.1.5, 18.2 before 18.2.5 and 18.3 before 18.3.1 a medium severity vulnerability CVE-2025-2246 was detected. This vulnerability allows unauthenticated users to access sensitive manual CI/CD variables by querying the GraphQL API. To address this issue, users should upgrade GitLab CE/EE to versions 18.3.1, 18.2.5 or 18.1.5. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-2246.
Read more Developer Tools
In Kibana versions 9.0.0 up to and including 9.0.5 and versions 9.1.0 up to and including 9.1.2 a medium severity vulnerability CVE-2025-25010 was detected. This vulnerability allows an attacker to escalate privileges via the reporting_user role, which can access all Kibana Spaces. To address this issue, users should upgrade Kibana to versions 9.0.6 or 9.1.3. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-25010.
Read more Data Analytics
In Liferay Portal versions 7.4.0 through 7.4.3.132, and Liferay DXP versions 2025.Q1.0 through 2025.Q1.1, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.14 and 7.4 GA through update 92 a medium severity vulnerability CVE-2025-43749 was detected. This vulnerability allows an unauthenticated attacker to access files uploaded in the form and stored in the document_library. To address this issue, users should upgrade Liferay Portal to master branch and Liferay DXP to versions 2025.Q1.2, 2025.Q2.0 or 2024.Q1.15. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-43749.
Read more CMS
In Liferay Portal versions 7.0.0 through 7.4.3.119, and Liferay DXP versions 2024.Q1.1 through 2024.Q1.6, 2023.Q4.0 through 2023.Q4.9, 2023.Q3.1 through 2023.Q3.9, 7.4 GA through update 92, 7.3 GA through update 36, and older unsupported versions a high severity vulnerability CVE-2025-43748 was detected. This vulnerability allows an attacker to execute Cross-Site Request Forgery attacks against omni-administrator users. To address this issue, users should upgrade Liferay Portal to version 7.4.3.120 and Liferay DXP to versions 2025.Q1.7 or 2025.Q2.0. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-43748.
Read more CMS
In Discourse versions prior to 3.5.0.beta8 a low severity vulnerability CVE-2025-54411 was detected. This vulnerability allows an attacker to inject XSS into the welcome banner user name string for logged-in users. To address this issue, users should upgrade Discourse to version 3.5.0.beta8-dev or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-54411.
Read more Communication
In Liferay Portal versions 7.4.0 through 7.4.3.132, and Liferay DXP versions 2025.Q1.0 through 2025.Q1.4, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.15 and 7.4 GA through update 92 a medium severity vulnerability CVE-2025-43752 was detected. This vulnerability allows an attacker to upload an unlimited amount of files through the object entries attachment fields, which can lead to a potential Denial-of-Service (DoS). To address this issue, users should upgrade Liferay Portal to master branch and Liferay DXP to versions 2025.Q1.5, 2025.Q2.0 or 2024.Q1.16. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-43752.
Read more CMS