Our news and updates

In Liferay Portal versions 7.4.0 through 7.4.3.124 and Liferay DXP versions 2024.Q2.0 through 2024.Q2.6, 2024.Q1.1 through 2024.Q1.12, and 7.4 GA through update 92 a high severity vulnerability CVE-2025-43790 was detected. This vulnerability allows remote authenticated users from one virtual instance to access, create, edit, and relate data/object entries or definitions to an object in a different virtual instance. To address this issue, users should upgrade Liferay Portal to version 7.4.3.125 or later, and Liferay DXP to version 2024.Q2.7, 2024.Q1.13, or 7.4 update 93. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-43790.

In Mattermost versions 10.10.x prior to 10.10.2, 10.5.x prior to 10.5.10, and 10.9.x prior to 10.9.5 a medium severity vulnerability CVE-2025-9072 was detected. This vulnerability allows attackers to take over Mattermost accounts by crafting a malicious link that abuses the RelayState SAML parameter, enabling user cookies to be sent to an attacker-controlled URL after authentication. To address this issue, users should upgrade Mattermost to versions 10.10.2, 10.5.10, or 10.9.5. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-9072.

In Mattermost versions 10.8.x prior to 10.8.4, 10.5.x prior to 10.5.9, 9.11.x prior to 9.11.18, 10.10.x prior to 10.10.2, and 10.9.x prior to 10.9.4 a medium severity vulnerability CVE-2025-9078 was detected. This vulnerability allows authenticated users to access unauthorized posts and poison link previews by exploiting weak cache key validation through hash collision attacks on FNV-1 hashing. To address this issue, users should upgrade Mattermost to versions 10.8.4, 10.5.9, 9.11.18, 10.10.2, or 10.9.4. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-9078.

In Mattermost versions 10.5.x prior to 10.5.10 a medium severity vulnerability CVE-2025-9084 was detected. This vulnerability allows attackers to redirect users to malicious sites via crafted OAuth login URLs due to improper validation of redirect URLs. To address this issue, users should upgrade Mattermost to version 10.5.10 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-9084.

In Zabbix version 5.0 a medium severity vulnerability CVE-2025-27234 was detected. This vulnerability allows attackers to inject unexpected arguments into the smartctl command. In Zabbix 5.0 this can result in remote code execution. To address this issue, users should upgrade Zabbix to version 5.0.47 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-27234.

In Zabbix versions 6.0.0 through 6.0.39, 7.0.0 through 7.0.10, and 7.2.0 through 7.2.4 a medium severity vulnerability CVE-2025-27233 was detected. This vulnerability allows attackers to inject unexpected arguments into the smartctl command via the smart.disk.get parameters, which can be exploited to leak the NTLMv2 hash from a Windows system. To address this issue, users should upgrade Zabbix Agent 2 to versions 6.0.40, 7.0.11, 7.2.5 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-27233.

In Zabbix versions 7.0.0 through 7.0.13 and 7.2.0 through 7.2.7 a medium severity vulnerability CVE-2025-27238 was detected. This vulnerability allows users without any assigned user groups to retrieve information on all host prototypes via the hostprototype.get API method. To address this issue, users should upgrade Zabbix to versions 7.0.14 or 7.2.8 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-27238.

In Zabbix Server versions 6.0.0 through 6.0.33, 6.4.0 through 6.4.18, and 7.0.0 through 7.0.3 a medium severity vulnerability CVE-2025-27240 was detected. This vulnerability allows a Zabbix administrator to inject arbitrary SQL during the autoremoval of hosts by inserting malicious SQL in the ‘Visible name’ field. To address this issue, users should upgrade Zabbix to versions 6.0.34, 6.4.19, 7.0.4 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-27240.

In Mattermost Server versions 10.10.x up to and including 10.10.1 a medium severity vulnerability CVE-2025-9076 was detected. This vulnerability allows malicious or compromised remote clusters to access sensitive user information via unsanitized user objects during shared channel membership synchronization. To address this issue, users should upgrade Mattermost Server to version 10.10.2 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-9076.