Our news and updates

In MariaDB Server versions 10.10 through 10.11 and 11.0 through 11.4 a medium severity vulnerability CVE-2023-52971 was detected. This vulnerability allows attackers to crash the MariaDB server, potentially disrupting database operations and causing downtime. This vulnerability remains unresolved at this time. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2023-52971.

In GitLab EE versions 17.7 prior to 17.7.6, 17.8 prior to 17.8.4, 17.9 prior to 17.9.1 a medium severity vulnerability CVE-2025-2045 was detected. This vulnerability allows attackers with limited permissions to access potentially sensitive project analytics data in GitLab EE, which they should not have access to, due to improper authorization. To fix this issue, users should upgrade GitLab EE to versions 17.7.6, 17.8.4, or 17.9.1. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-2045.

In MariaDB Server versions 10.4 through 10.5, 10.6 through 10.6, 10.7 through 10.11, 11.0 through 11.0, and 11.1 through 11.4 a medium severity vulnerability CVE-2023-52970 was detected. This vulnerability allows attackers to force MariaDB to crash, making the database unavailable. This vulnerability remains unresolved at this time. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2023-52970.

In MariaDB Server versions 10.4 through 10.5, 10.6 through 10.6, 10.7 through 10.11, 11.0 through 11.0 a medium severity vulnerability CVE-2023-52969 was detected. This vulnerability allows attackers to cause MariaDB to crash intermittently, potentially disrupting the database service without providing useful diagnostic information due to an empty backtrace log. This vulnerability remains unresolved at this time. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2023-52969.

In MariaDB Server versions 10.4 before 10.4.33, 10.5 before 10.5.24, 10.6 before 10.6.17, 10.7 through 10.11before 10.11.7, 11.0 before 11.0.5, 11.1 before 11.1.4 a medium severity vulnerability CVE-2023-52968 was detected. This vulnerability allows attackers to cause MariaDB Server to crash by triggering an issue where derived tables are not properly prepared before certain operations are performed, potentially leading to service disruptions. This vulnerability remains unresolved at this time. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2023-52968.

In NGINX Unit versions prior to 1.34.2 with the Java Language Module in use a medium severity vulnerability CVE-2025-1695 was detected. This vulnerability allows attackers to cause an infinite loop and increase CPU resource utilization, potentially leading to a limited denial-of-service (DoS). To address this issue, users should upgrade NGINX Unit to version 1.34.2 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-1695.

In Django versions 5.1 prior to 5.1.7, 5.0 prior to 5.0.13 and 4.2 prior to 4.2.20 a medium severity vulnerability CVE-2025-26699 was detected. This vulnerability allows attackers to exploit the django.utils.text.wrap() method and wordwrap template filter, making them susceptible to a potential denial-of-service attack when used with very long strings. To address this issue, users should upgrade Django to versions 4.2.20, 5.0.13 or 5.1.7. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-26699.

In NocoDB versions 0.257.9 and prior a medium severity vulnerability CVE-2025-27506 was detected. This vulnerability allows attackers to exploit a reflected Cross-Site Scripting (XSS) flaw in the /api/v1/db/auth/password/reset/:tokenId API endpoint due to the use of the insecure function “<%-" in the client-side template engine ejs, which is rendered by the function renderPasswordReset. To address this issue, users should upgrade NocoDB to versions 0.258.0 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-27506.

In GitLab CE/EE for Self-Managed and Dedicated instances versions 17.5 prior to 17.6.5, 17.7 prior to 17.7.4 and 17.8 prior to 17.8.2 a low severity vulnerability CVE-2025-1540 was detected. This vulnerability allows an external user to read and clone internal projects under certain circumstances. To address this issue, users should upgrade GitLab CE/EE to versions 17.8.2, 17.7.4 or 17.6.5. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-1540.