Our news and updates

In Cal.com versions up to and including 1.0.0 a medium severity vulnerability CVE-2025-31604 was detected. This vulnerability allows attackers to execute stored cross-site scripting (XSS) attacks by improperly neutralizing script-related HTML tags in a web page. Currently, there is no fix version for this issue. For more details, visit https://avd.aquasec.com/nvd/2025/cve-2025-31604.

In Open Webui versions 0.3.32 a high severity vulnerability CVE-2024-12537 was detected. This vulnerability allows any unauthenticated attacker to access the api/v1/utils/code/format endpoint. If a malicious actor sends a POST request with excessive content, the server could become unresponsive or experience significant performance degradation, potentially causing service interruptions for legitimate users. Currently, there is no fix version for this issue. For more details, visit https://avd.aquasec.com/nvd/2024/cve-2024-12537.

In Open Webui versions 0.3.8 a critical severity vulnerability CVE-2024-7053 was detected. This vulnerability allows an attacker with a user-level account to hijack an administrator’s session by exploiting weak session cookie settings, enabling account takeover and potentially remote code execution (RCE) through a malicious image embedded in a chat that steals the admin’s session cookie. Currently, there is no fix version for this issue. For more details, visit https://avd.aquasec.com/nvd/2024/cve-2024-7053.

In Appsmith versions prior to 1.51 a medium severity vulnerability CVE-2024-55604 was detected. This vulnerability allows “App Viewer” users to access a workspace’s datasource list, potentially aiding in reconnaissance, though sensitive data remains secure. To address this issue, users should upgrade Appsmith to versions 1.51 or later For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2024-55604.

In Authentik versions prior to 2024.12.4 and 2025.2.3 a high severity vulnerability CVE-2025-29928 was detected. When configured to use database session storage, deleting sessions via the Web Interface or API did not revoke access, allowing session holders to remain authenticated. To address this issue, users should upgrade Authentik to versions 2024.12.4 or 2025.2.3. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-29928.

In Metabase versions prior to 0.52.16.4, 1.52.16.4, 0.53.8 and v1.53.8 a low severity vulnerability CVE-2025-30371 was detected. This vulnerability allows circumvention of local link access protection in the GeoJson endpoint, potentially impacting self-hosted instances colocated with unsecured resources. To address this issue, users should upgrade Metabase to versions 0.52.16.4, 1.52.16.4, 0.53.8 or 1.53.8. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-30371.

In PHP versions 8.1.* before 8.1.32, 8.2.* before 8.2.28, 8.3.* before 8.3.19 and 8.4.* before 8.4.5 a medium severity vulnerability CVE-2025-1217 was detected. This vulnerability causes incorrect parsing of folded HTTP headers in the HTTP request module, which may lead to misinterpreting the response and using incorrect headers, MIME types, etc. To address this issue, users should upgrade PHP to versions 8.1.32, 8.2.28, 8.3.19, 8.4.5 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-1217.

In GitLab CE/EE versions 16.0 before 17.8.6, 17.9 before 17.9.3 and 17.10 before 17.10.1 a medium severity vulnerability CVE-2024-12619 was detected. This vulnerability allows internal users to gain unauthorized access to internal projects. To address this issue, users should upgrade GitLab CE/EE to versions 17.10.1, 17.9.3, 17.8.6 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2024-12619.

In Discourse versions before 3.3.4 on the stable branch and 3.4.0.beta5 on the beta branch a medium severity vulnerability CVE-2025-24808 was detected. A user close to the group DM limit could bypass the limit by sending multiple requests at once. To address this issue, users should upgrade Discourse to versions 3.3.4 or later, or 3.4.0.beta5 or later. For more details, visit https://avd.aquasec.com/nvd/2025/cve-2025-24808.