Our news and updates

In Appsmith versions before 1.51 a medium severity vulnerability CVE-2024-55965 was detected. This vulnerability allows attackers with “App Viewer” access to view development information in a workspace, specifically a list of datasources in that workspace. To address this issue, users should upgrade Appsmith to versions 1.51 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2024-55965.

In GitLab Duo with Amazon Q versions 17.8 before 17.8.6, 17.9 before 17.9.3 and 17.10 before 17.10.1 a medium severity vulnerability CVE-2025-2867 was detected. This vulnerability allows attackers to manipulate AI-assisted development features, potentially exposing sensitive project data to unauthorized users. To address this issue, users should upgrade GitLab Duo to versions 17.8.6, 17.9.3 or 17.10.1. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-2867.

In Appsmith versions before 1.52 a critical severity vulnerability CVE-2024-55964 was detected. This vulnerability allows attackers to execute remote commands inside the Appsmith Docker container due to an incorrectly configured PostgreSQL instance, requiring the attacker to access Appsmith, log in, create a datasource, create a query, and execute that query. To address this issue, users should upgrade Appsmith to versions 1.52 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2024-55964.

In Appsmith versions before 1.51 a medium severity vulnerability CVE-2024-55963 was detected. This vulnerability allows users without admin permissions to trigger the restart API on Appsmith, causing a denial of service by repeatedly restarting the server due to incorrect access control checks that should verify superuser permissions before processing the request. To address this issue, users should upgrade Appsmith to versions 1.51 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2024-55963.

In GitLab versions 13.5.0 to 17.8.6, 17.9 to 17.9.3 and 17.10 to 17.10.1 a high severity vulnerability CVE-2025-2255 was detected. This vulnerability allows attackers to execute Cross-Site Scripting (XSS) attacks through certain error messages. To address this issue, users should upgrade GitLab to versions 17.8.6, 17.9.3 or 17.10.1. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-2255.

In GitLab versions 14.9 to 17.8.6, 17.9 to 17.9.3, and 17.10 to 17.10.1 a low severity input validation vulnerability CVE-2024-9773 was detected. This vulnerability could have allowed a maintainer to add malicious code to the CLI commands shown in the UI. To address this issue, users should upgrade GitLab to versions 17.8.6, 17.9.3 or 17.10.1. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2024-9773.

In GitLab CE/EE versions 17.7 before 17.8.6, 17.9 before 17.9.3, and 17.10 before 17.10.1 a high severity vulnerability CVE-2025-0811 was detected. This vulnerability allows attackers to execute cross-site scripting attacks due to improper rendering of certain file types. To address this issue, users should upgrade GitLab CE/EE to versions 17.8.6, 17.9.3 or 17.10.1. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-0811.

In GitLab versions 17.4 to 17.8.6, 17.9 to 17.9.3 and 17.10 to 17.10.1 a high severity vulnerability CVE-2025-2242 was detected. This vulnerability allows a user who was previously an instance admin but has since been downgraded to a regular user to maintain elevated privileges over groups and projects. To address this issue, users should upgrade GitLab to versions 17.8.6, 17.9.3 or 17.10.1. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-2242.

In Discourse versions prior to 3.3.4 on the stable branch and 3.4.0.beta5 on the beta branch a medium severity vulnerability CVE-2025-24972 was detected. In specific circumstances, users could be added to group direct messages despite having disabled direct messaging in their preferences. To address this issue, users should upgrade Discourse to versions 3.3.4 or later or 3.4.0.beta5 or later. For more details, visit https://avd.aquasec.com/nvd/2025/cve-2025-24972.