In GitLab CE/EE versions before 18.2.7, 18.3 before 18.3.3 and 18.4 before 18.4.1 a high severity vulnerability CVE-2025-10858 was detected. This vulnerability allows unauthenticated users to cause a Denial of Service (DoS) condition by uploading specially crafted large JSON files. To address this issue, users should upgrade GitLab CE/EE to versions 18.2.7, 18.3.3, 18.4.1 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-10858.
Read more Developer Tools
In Liferay Portal versions 7.4.0 through 7.4.3.112, and Liferay DXP versions 2023.Q4.0 through 2023.Q4.8, 2023.Q3.1 through 2023.Q3.10, and 7.4 GA through update 92 a medium severity vulnerability CVE-2025-43807 was detected. This vulnerability allows a remote attacker to inject arbitrary web script or HTML via a crafted payload injected into a publication’s “Name” text field in the notifications widget. To address this issue, users should upgrade Liferay Portal to version 7.4.3.113 and Liferay DXP to versions 2024.Q2.0, 2024.Q1.1 or 2023.Q4.9. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-43807.
Read more Data Analytics
In Ashlar-Vellum Graphite version 13_SE_13048 a high severity vulnerability CVE-2025-7981 was detected. This vulnerability allows remote attackers to execute arbitrary code on affected installations by exploiting uninitialized memory during VC6 file parsing when a user opens a malicious file. Currently, there is no fix version for this issue. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-7981.
Read more Data Analytics
In Ashlar-Vellum Graphite version 13_SE_13048 a high severity vulnerability CVE-2025-7980 was detected. This vulnerability allows remote attackers to execute arbitrary code on affected installations by exploiting improper validation of user-supplied data in a VC6 file, which can result in an out-of-bounds write when a user opens a malicious file. Currently, there is no fix version for this issue. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-7980.
Read more Data Analytics
In Ashlar-Vellum Graphite version 13_SE_13048 a high severity vulnerability CVE-2025-7979 was detected. This vulnerability allows remote attackers to execute arbitrary code on affected installations by exploiting improper validation of the length of user-supplied data during VC6 file parsing, which can result in a stack-based buffer overflow when a user opens a malicious file. Currently, there is no fix version for this issue. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-7979.
Read more Data Analytics
In Liferay Portal versions 7.4.0 through 7.4.3.112, and Liferay DXP versions 2023.Q4.0 through 2023.Q4.7, 2023.Q3.1 through 2023.Q3.10, and 7.4 GA through update 92 a medium severity vulnerability CVE-2025-43806 was detected. This vulnerability allows an authenticated attacker to access exported data via the REST APIs due to a permission check flaw. To address this issue, users should upgrade Liferay Portal to version 7.4.3.113 and Liferay DXP to versions 2024.Q2.0, 2024.Q1.1 or 2023.Q4.8. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-43806.
Read more Data Analytics
In Liferay Portal versions 7.4.0 through 7.4.3.111, and older unsupported versions, and Liferay DXP 2023.Q4.0 through 2023.Q4.7, 2023.Q3.1 through 2023.Q3.9, 7.4 GA through update 92, and older unsupported versions a medium severity vulnerability CVE-2025-43809 was detected. This vulnerability allows remote attackers to register a server license via the ‘orderUuid’ parameter. To fix this issue, users should upgrade to Liferay Portal 7.4.3.112, Liferay DXP 2024.Q1.1, 2023.Q4.8, or 2023.Q3.9. For more information, visit https://nvd.nist.gov/vuln/detail/CVE-2025-43809.
Read more CMS
In Mattermost versions 9.11.x ≤ 9.11.17, 10.5.x ≤ 10.5.8, 10.8.x ≤ 10.8.3, 10.9.x ≤ 10.9.3, and 10.10.x ≤ 10.10.1 a critical severity vulnerability CVE-2025-9079 was detected. This vulnerability allows admin users to execute arbitrary code by uploading a malicious plugin to the prepackaged plugins directory due to improper validation of the import directory path configuration. To fix this issue, users should upgrade Mattermost to version 9.11.18, 10.5.9, 10.8.4, 10.9.4, 10.10.2, or 10.11.0. For more information, visit https://nvd.nist.gov/vuln/detail/CVE-2025-9079.
Read more Communication
In Liferay Portal versions 7.3.0 through 7.4.3.112, and Liferay DXP 2023.Q4.0 through 2023.Q4.8, 2023.Q3.1 through 2023.Q3.10, 7.4 GA through update 92, and 7.3 service pack 3 through update 35 a medium severity vulnerability CVE-2025-43808 was detected. The Commerce component saves virtual products uploaded to Documents and Media with guest view permission, which allows remote attackers to access and download virtual products for free via a crafted URL. To fix this issue, users should upgrade to Liferay Portal 7.4.3.120, Liferay DXP 2024.Q2.0, 2024.Q1.1, or 2023.Q4.7. For more information, visit https://nvd.nist.gov/vuln/detail/CVE-2025-43808.
Read more CMS