Our news and updates

In the WoodMart theme for WordPress versions up to and including 8.2.6 a medium severity vulnerability CVE-2025-8097 was detected. This vulnerability allows unauthenticated attackers to manipulate cart quantities using fractional values via the qty parameter in the woodmart_update_cart_item function, where insufficient input validation enables setting extremely small quantities (e.g., 0.00001) that round the cart total to $0.00, resulting in unauthorized acquisition of virtual or downloadable products. To address this issue, users should update the WoodMart theme to versions 8.2.7 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-8097.

In GitLab Language Server versions from 7.6.0 up to but not including 7.30.0 a high severity vulnerability CVE-2025-8279 was detected. This vulnerability allows unauthorized attackers to execute arbitrary GraphQL queries due to missing authentication for a critical function and insufficient input validation. To address this issue, users should upgrade GitLab Language Server to version 7.30.0. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-8279.

In the Get Youtube Subs plugin for WordPress versions up to and including 3.5 a medium severity vulnerability CVE-2025-7966 was detected. This vulnerability allows authenticated attackers with Contributor-level access and above to inject arbitrary web scripts via the ‘channel’, ‘layout’, and ‘subs_count’ parameters due to insufficient input sanitization and output escaping. Currently, there is no fix version for this issue. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-7966.

In Apache HTTP Server version 2.4.64 a medium severity vulnerability CVE-2025-54090 was discovered. This vulnerability causes all RewriteCond expr … conditions to be incorrectly evaluated as true, potentially disrupting expected functionality and allowing unintended access due to misinterpreted conditions. To address this issue, users should update Apache HTTP Server to version 2.4.65. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-54090.

In Apache Tomcat versions 11.0.0-M1 through 11.0.8, 10.1.0-M1 through 10.1.42 and 9.0.0.M1 through 9.0.106 a low severity vulnerability CVE-2025-52520 was identified. This Integer Overflow vulnerability, triggered under specific and unlikely multipart upload configurations, could allow an attacker to bypass configured size limits and cause a Denial of Service (DoS). To address this issue, users should upgrade to versions 11.0.9, 10.1.43 or 9.0.107. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-52520.

In Mine CloudVod plugin for WordPress versions up to and including 2.1.10 a medium severity vulnerability CVE-2025-8071 was detected. This vulnerability allows authenticated attackers with Contributor-level access and above to inject web scripts via the ‘audio’ parameter, which execute when a user accesses the affected page due to insufficient sanitization and escaping. Currently, there is no fix version for this issue. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-8071.

In GitLab CE/EE versions starting from 15.4 before 18.0.5, 18.1 before 18.1.3 and 18.2 before 18.2.1 a medium severity vulnerability CVE-2025-1299 was detected. This vulnerability could allow unauthorized users to read deployment job logs by sending a crafted request. To address this issue, users should upgrade GitLab CE/EE to versions 18.0.5, 18.1.3 or 18.2.1. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-1299.

In GitLab CE/EE versions from 17.9 before 18.0.5, 18.1 before 18.1.3 and 18.2 before 18.2.1 a medium severity vulnerability CVE-2025-0765 was detected. This vulnerability could allow unauthorized users to access custom service desk email addresses. To address this issue, users should upgrade GitLab CE/EE to versions 18.0.5, 18.1.3 or 18.2.1. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-0765.

In Harbor versions 2.11.2 and below and 2.12.0-rc1 and 2.13.0-rc1 a medium severity vulnerability CVE-2025-32019 was detected. This vulnerability allows attackers to inject cross-site scripting (XSS) code via the markdown field in the info tab page. To address this issue, users should update Harbor to versions 2.12.4 or 2.13.1. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-32019.