Our news and updates

In Harbor versions 2.11.2 and below and 2.12.0-rc1 and 2.13.0-rc1 a medium severity vulnerability CVE-2025-32019 was detected. This vulnerability allows attackers to inject cross-site scripting (XSS) code via the markdown field in the info tab page. To address this issue, users should update Harbor to versions 2.12.4 or 2.13.1. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-32019.

In Redis versions up to and including 8.0.3 a medium severity vulnerability CVE-2025-46686 was detected. This vulnerability allows authenticated attackers to cause excessive memory consumption by sending a multi-bulk command with many bulks, even if the command is skipped due to insufficient permissions. Currently, there is no fix version for this issue. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-46686.

In authentik versions 2025.4.4 and earlier and 2025.6.0-rc1 through 2025.6.3 a high severity vulnerability CVE-2025-53942 was identified. This vulnerability allows deactivated OAuth/SAML users to remain in a half-authenticated state, where they can’t access the API but can still authorize applications if they know the URL. To address this issue, users should upgrade Authentik to versions 2025.4.4 or 2025.6.4. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-53942.

In GitLab CE/EE versions from 15.0 before 18.0.5, 18.1 before 18.1.3 and 18.2 before 18.2.1 a medium severity vulnerability CVE-2025-7001 was discovered. This vulnerability could allow privileged users to access certain resource_group information via the API that should have been restricted. To address this issue, users should upgrade GitLab CE/EE to versions 18.0.5, 18.1.3 and 18.2.1. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-7001.

In GitLab EE versions from 17.0 before 18.0.5, 18.1 before 18.1.3 and 18.2 before 18.2.1 a medium severity vulnerability CVE-2025-4976 was discovered. This vulnerability, under certain circumstances, could allow an attacker to access internal notes included in GitLab Duo responses. To address this issue, users should upgrade GitLab EE to versions 18.0.5, 18.1.3 and 18.2.1. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-4976.

In GitLab CE/EE versions from 15.10 before 18.0.5, 18.1 before 18.1.3 and 18.2 before 18.2.1 a high severity vulnerability CVE-2025-4700 was discovered. This vulnerability, under specific circumstances, could have potentially allowed a successful attacker to trigger unintended content rendering, leading to Cross-Site Scripting (XSS). To address this issue, users should upgrade GitLab CE/EE to versions 18.0.5, 18.1.3 and 18.2.1. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-4700.

In GitLab CE/EE versions from 15.10 before 18.0.5, 18.1 before 18.1.3 and 18.2 before 18.2.1 a high severity vulnerability CVE-2025-4439 was discovered. This vulnerability could have allowed an authenticated user to perform cross-site scripting (XSS) attacks when the GitLab instance is served through certain content delivery networks (CDNs). To address this issue, users should upgrade GitLab CE/EE to versions 18.0.5, 18.1.3 and 18.2.1. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-4439.

In WordPress versions 3.5 through 6.8.2 a low severity vulnerability CVE-2025-54352 was identified. This vulnerability allows remote attackers to guess the titles of private and draft posts via pingback.ping XML-RPC requests, which can potentially lead to information disclosure. The WordPress supplier has chosen not to change this behavior. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-54352.

In LibreNMS versions up to and including 25.6.0 a high severity vulnerability CVE-2025-54138 was discovered in the ajax_form.php endpoint. This vulnerability allows remote file inclusion based on user-controlled POST input, as the application directly uses the type parameter to dynamically include .inc.php files from the trusted includes/html/forms/ path without proper validation or allowlisting, introducing a Remote Code Execution (RCE) risk if an attacker can stage a file in that path—such as via symlinks, misconfigurations, or chained exploits. To address this issue, users should upgrade LibreNMS to versions 25.7.0 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-54138.