Our news and updates

In GitLab CE/EE versions 14.2 through 17.11.x before 18.0.6, 18.1 before 18.1.4, and 18.2 before 18.2.2 a high severity vulnerability CVE-2025-7734 was detected. This vulnerability allows attackers, under certain conditions, to inject malicious content that could execute actions on behalf of users due to improper neutralization of input during web page generation (Cross-Site Scripting). To address this issue, users should upgrade GitLab CE/EE to versions 18.0.6, 18.1.4 or 18.2.2. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-7734.

In GitLab CE/EE versions from 18.1 before 18.1.4 and 18.2 before 18.2.2 a high severity vulnerability CVE-2025-6186 was detected. This vulnerability allows authenticated attackers to perform account takeover by injecting malicious HTML into work item names, due to improper neutralization of input during web page generation. To address this issue, users should upgrade GitLab CE/EE to versions 18.1.4 or 18.2.2. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-6186.

In Helm, all versions before 3.18.5 a high severity vulnerability CVE-2025-55199 was detected. This vulnerability allows attackers to craft a JSON Schema file in a way that can cause Helm to consume all available memory, leading to an Out of Memory termination. To fix this issue, users should upgrade Helm to version 3.18.5. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-55199.

In NGINX Open Source and NGINX Plus versions prior to 1.6.1 and built with ngx_mail_smtp_module and configured with smtp_auth method “none,” a medium severity vulnerability CVE-2025-53859 was detected. This vulnerability allows attackers to over-read the NGINX SMTP authentication process memory, potentially leaking arbitrary bytes sent in a request to the authentication server. To fix this issue, users upgrade NGINX to version 1.6.1. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-53859.

In Umbraco CMS versions prior to 4.7.1 a critical severity vulnerability CVE-2012-10054 was detected. This vulnerability allows attackers to upload and run malicious files on the website without needing to log in. To fix this issue, users should upgrade Umbraco CMS to version 4.7.1. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2012-10054.

In Helm, all versions before 3.18.5 a medium severity vulnerability CVE-2025-55198 was detected. This vulnerability may cause Helm to panic due to incorrect YAML content in Chart.yaml and index.yaml files. To fix this issue, users should upgrade Helm to version 3.18.5. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-55198.

In Kanboard versions prior to 1.2.47 a critical severity vulnerability CVE-2025-55010 was detected. This vulnerability allows attackers with admin access to achieve remote code execution by exploiting unsafe deserialization in the ProjectEventActivityFormatter via the event[“data”] field in the project_activities table, potentially writing a web shell to the /plugins folder. To address this issue, users should upgrade Kanboard to version 1.2.47 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-55010.

In Liferay Portal verions 7.4.0 through 7.4.3.132, and Liferay DXP versions 2025.Q1.0 through 2025.Q1.10, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.1 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.16 and 7.4 GA through update 92 a medium severity vulnerability CVE-2025-43734 was detected. This vulnerability allows remote authenticated attackers to inject JavaScript code into the “first display label” field of a custom sort widget, which is then reflected and executed by the clay button taglib when the page is refreshed. To address this issue, users should upgrade Liferay Portal to master branch and Liferay DXP to versions 2025.Q2.0, 2025.Q1.11 or 2024.Q1.17. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-43734.

In SuiteCRM version 7.14.6 a low severity vulnerability CVE-2025-54787 was detected. This vulnerability allows unauthenticated attackers to download files from the upload directory if the file is named by a valid ID, potentially exposing sensitive internal files. To address this issue, users should upgrade SuiteCRM to versions 7.14.7 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-54787.