In Mattermost versions 10.8.x through 10.8.3, 10.5.x through 10.5.8, 9.11.x through 9.11.17, and 10.9.x through 10.9.2 a medium severity vulnerability CVE-2025-8023 was detected. This vulnerability allows a System Admin to perform path traversal attacks by using malicious path components, which could lead to malicious file placement outside of intended directories. To address this issue, users should upgrade Mattermost to versions 10.8.4, 10.5.9, 9.11.18 or 10.9.3. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-8023.
Read more Communication
In Mattermost versions 10.5.x <= 10.5.8 and 9.11.x <= 9.11.17 a low severity vulnerability CVE-2025-53971 was detected. This vulnerability allows a Team Admin to demote a Team Member to a Guest via the PUT /api/v4/teams/team-id/members/user-id/schemeRoles API endpoint. To address this issue, users should upgrade Mattermost to versions 10.10.0, 10.5.9, 9.11.18 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-53971.
Read more Communication
In Mattermost versions 10.5.x <= 10.5.8 a low severity vulnerability CVE-2025-49810 was detected. This vulnerability allows a user to read a thread via AI posts. To address this issue, users should upgrade Mattermost to versions 10.10.0, 10.5.9 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-49810.
Read more Communication
In Mattermost versions 10.8.x <= 10.8.3, 10.5.x <= 10.5.8, 9.11.x <= 9.11.17 and 10.9.x <= 10.9.2 a medium severity vulnerability CVE-2025-47870 was detected. This vulnerability allows a Team Admin with no member invite privileges to get the team's invite ID. To address this issue, users should upgrade Mattermost to versions 10.10.0, 10.8.4, 10.5.9, 9.11.18, 10.9.3 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-47870.
Read more Communication
In Mattermost Server versions 10.5.x through 10.5.9 utilizing the Agents plugin a low severity vulnerability CVE-2025-47700 was detected. This vulnerability allows an attacker to trick users into clicking malicious links via post actions. To address this issue, users should upgrade Mattermost plugins to versions 10.10.0, 10.5.9 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-47700.
Read more Communication
In Liferay Portal versions 7.4.0 through 7.4.3.132, and Liferay DXP versions 2025.Q1.0 through 2025.Q1.3, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.14 and 7.4 GA through update 92 a medium severity vulnerability CVE-2025-43742 was detected. This vulnerability allows attackers to inject JavaScript into web content for friendly URLs. To address this issue, users should upgrade Liferay Portal to master branch and Liferay DXP to versions 2024.Q1.15, 2025.Q1.4 or 2025.Q2.0. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-43742.
Read more E-commerce
In Liferay Portal versions 7.4.3.120 through 7.4.3.132, and Liferay DXP versions 2025.Q2.0 through 2025.Q2.8, 2025.Q1.0 through 2025.Q1.15, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.1 through 2024.Q2.13 and 2024.Q1.9 through 2024.Q1.19 a medium severity vulnerability CVE-2025-43740 was detected. This vulnerability allows an authenticated attacker to inject JavaScript through the message boards feature available via the web interface. To address this issue, users should upgrade Liferay Portal to master branch and Liferay DXP to versions 2025.Q1.6 or 2025.Q2.9. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-43740.
Read more E-commerce
In Liferay Portal versions 7.4.0 through 7.4.3.132, and Liferay DXP versions 2025.Q1.0 through 2025.Q1.6, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.16 and 7.4 GA through update 92 a medium severity vulnerability CVE-2025-43739 was detected. This vulnerability allows an authenticated attacker to modify the content of emails sent through the calendar portlet, which enables them to send phishing emails to other users in the same organization. To address this issue, users should upgrade Liferay Portal to master branch and Liferay DXP to versions 2025.Q2.0 or 2025.Q1.7. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-43739.
Read more E-commerce
In Liferay Portal versions 7.4.0 through 7.4.3.132, and Liferay DXP versions 2025.Q2.0 through 2025.Q2.8, 2025.Q1.0 through 2025.Q1.15, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.1 through 2024.Q2.13 and 2024.Q1.1 through 2024.Q1.19 a medium severity vulnerability CVE-2025-43738 was detected. This vulnerability allows an authenticated attacker to inject JavaScript code via the _com_liferay_expando_web_portlet_ExpandoPortlet_displayType parameter. To address this issue, users should upgrade Liferay Portal to master branch and Liferay DXP to versions 2025.Q1.6 or 2025.Q2.9. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-43738.
Read more E-commerce