Our news and updates

In Jenkins versions 2.499 and prior, and LTS 2.492.1 and prior a medium severity vulnerability CVE-2025-27625 was detected. This vulnerability allows attackers to perform phishing attacks by leveraging redirects that start with backslash (`\`) characters, causing users to be forwarded to unintended sites. To address this issue, users should upgrade Jenkins to versions 2.500 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-27625.

In Jenkins versions 2.499 and prior, and LTS 2.492.1 and prior a medium severity vulnerability CVE-2025-27624 was detected. This vulnerability allows attackers to exploit cross-site request forgery (CSRF) to manipulate the collapsed/expanded status of sidepanel widgets, such as Build Queue and Build Executor Status widgets. To address this issue, users should upgrade Jenkins to versions 2.500 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-27624.

In Jenkins versions 2.499 and prior, and LTS 2.492.1 and prior a medium severity vulnerability CVE-2025-27623 was detected. This vulnerability allows attackers with View/Read permission to access `config.xml` of views via REST API or CLI and retrieve encrypted values of secrets, as they are not properly redacted. To address this issue, users should upgrade Jenkins to versions 2.500 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-27623.

In Jenkins versions 2.499 and prior, and LTS 2.492.1 and prior a medium severity vulnerability CVE-2025-27622 was detected. This vulnerability allows attackers with Agent/Extended Read permission to access `config.xml` of agents via REST API or CLI and retrieve encrypted values of secrets, as they are not properly redacted. To address this issue, users should upgrade Jenkins to versions 2.500 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-27622.

In Kibana versions 8.15.0 up to, but not including, 8.17.1 a critical severity vulnerability CVE-2025-25015 was detected. This vulnerability allows users with the Viewer role to achieve arbitrary code execution via a crafted file upload and specifically crafted HTTP requests. To address this issue, users should upgrade Kibana to version 8.17.3. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-25015.

In Zitadel versions prior to 2.71.0 a critical severity vulnerability CVE-2025-27507 was detected. This vulnerability allows authenticated users, without specific IAM roles, to modify sensitive settings due to Insecure Direct Object Reference (IDOR) issues in the Admin API, with the most critical impact being the ability to manipulate LDAP configurations. However, customers who do not utilize LDAP for authentication are not at risk from the most severe aspects of this vulnerability. To address this issue, users should upgrade Zitadel to versions 2.71.0, 2.70.1, 2.69.4, 2.68.4, 2.67.8, 2.66.11, 2.65.6, 2.64.5 or 2.63.8. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-27507.

In Spreadsheet Integration plugin for WordPress versions 3.8.2 and prior a medium severity vulnerability CVE-2025-1463 was detected. This vulnerability allows attackers to publish arbitrary posts, including private ones, by exploiting improper nonce validation in the class-wpgsi-show.php script. To address this issue, users should upgrade Spreadsheet Integration plugin to versions 3.8.3 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-1463.

In DesignThemes Core Features plugin for WordPress versions 4.7 and prior a high severity vulnerability CVE-2024-13471 was detected. This vulnerability allows unauthenticated attackers to read arbitrary files on the underlying operating system due to a missing capability check on the `dt_process_imported_file` function. Currently, there is no fix version for this issue. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2024-13471.

In Homey Login Register plugin for WordPress versions 2.4.0 and prior a critical severity vulnerability CVE-2024-11951 was detected. This vulnerability allows unauthenticated attackers to escalate privileges by registering an account with an administrator role due to improper role assignment controls. Currently, there is no fix version for this issue. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2024-11951.