Our news and updates

In Zabbix Server versions 6.0.0 up to 6.0.38, 7.0.0 up to 7.0.9, 7.2.0 up to 7.2.3 a medium severity vulnerability CVE-2024-45700 was detected. This vulnerability allows attackers to send specially crafted requests that cause excessive memory allocation and CPU-intensive decompression, ultimately leading to a service crash. To address this issue, users should upgrade Zabbix Server to versions 6.0.39rc1, 7.0.10rc1, 7.2.4rc1 or 7.4.0alpha1. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2024-45700.

In Django versions 5.1 before 5.1.8 and 5.0 before 5.0.14 a medium severity vulnerability CVE-2025-27556 was detected. This vulnerability allows attackers to perform a potential denial-of-service attack by submitting inputs with a large number of Unicode characters, exploiting slow NFKC normalization on Windows. To address this issue, users should upgrade Django to versions 5.1.8 or 5.0.14. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-27556.

In Jenkins versions 2.503 and prior, LTS 2.492.2 and prior a medium severity vulnerability CVE-2025-31721 was detected. This vulnerability allows attackers with Computer/Create permission but without Computer/Configure permission to copy an agent and gain access to encrypted secrets in its configuration. To address this issue, users should upgrade Jenkins to versions 2.504 or later, or LTS versions 2.492.3 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-31721.

In Jenkins versions 2.503 and earlier, LTS 2.492.2 and earlier a medium severity vulnerability CVE-2025-31720 was detected. This vulnerability allows attackers with Computer/Create permission but without Computer/Extended Read permission to copy an agent, gaining access to its configuration. To address this issue, users should upgrade Jenkins to versions 2.504 or later, or LTS versions 2.492.3 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-31720.

In OpenVPN versions 2.6.1 through 2.6.13 a high severity vulnerability CVE-2025-2704 was detected. This vulnerability allows remote attackers to trigger a denial of service by corrupting and replaying network packets during the early TLS-crypt-v2 handshake phase when OpenVPN is operating in server mode. To address this issue, users should upgrade OpenVPN to versions 2.6.14 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-2704.

In MongoDB Server versions prior to 5.0.31, 6.0.20, 7.0.14 and 7.3.4 a low severity vulnerability CVE-2025-3082 was detected. This vulnerability allows an authorized user to alter the intended collation of a view, potentially enabling access to unintended underlying data. Currently, there is no fix version for this issue. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-3082.

In Rancher versions up to 2.8.13, 2.9.7 and 2.10.3 a high severity vulnerability CVE-2025-23391 was detected. This vulnerability allows Restricted Administrators to change the passwords of Administrators without the necessary permissions, potentially leading to unauthorized access and account takeover. To address this issue, users should upgrade Rancher to versions 2.8.14, 2.9.8, 2.10.4 or 2.11.0. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-21391.

In Apache Camel versions up to 4.10.2 and 4.8.5 a medium severity vulnerability CVE-2025-30177 was detected. This vulnerability allows attackers to inject Camel-specific headers into incoming requests due to a flaw in the custom header filter strategy, potentially altering the behavior of components such as camel-bean or camel-exec. To address this issue, users should upgrade to Apache Camel versions 4.10.3 or 4.8.6. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-30177.

In PHP versions up to 8.1.31, 8.2.27, 8.3.18 and 8.4.4 a medium severity vulnerability CVE-2025-1219 was detected. This vulnerability allows incorrect parsing of documents or bypassing of validations due to the wrong content-type header being used to determine the charset during HTTP redirects. To address this issue, users should upgrade PHP to versions 8.1.32, 8.2.28, 8.3.19, 8.4.5 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-1219.