Our news and updates

In MinIO versions starting in RELEASE.2024-06-06T09-36-42Z and prior to
RELEASE.2025-02-28T09-55-16Z a medium severity vulnerability CVE-2025-27414 was detected. This vulnerability allows attackers to bypass authentication and gain unauthorized data access by exploiting a bug in evaluating the trust of the SSH key used in an SFTP connection. To address this issue, users should upgrade MinIO to version RELEASE.2025-02-28T09-55-16Z. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-27414.

In Mattermost versions 10.4.x ≤ 10.4.1, 9.11.x ≤ 9.11.7, 10.3.x ≤ 10.3.2, and 10.2.x ≤ 10.2.2 a critical severity vulnerability CVE-2025-24490 was detected. This vulnerability allows attackers to retrieve sensitive data from the database via SQL injection due to the failure to use prepared statements when reordering specially crafted board categories. To address this issue, users should upgrade Mattermost to versions 9.0.5 or higher. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-24490.

In Mastodon versions prior to 4.1.23, 4.2.16 and 4.3.4 a medium severity vulnerability CVE-2025-27399 was detected. This vulnerability allows unapproved users to view domain block reasons when the visibility is set to “To logged-in users,” potentially exposing sensitive moderation details. To address this issue, users should upgrade Mastodon to versions 4.1.23, 4.2.16 or 4.3.4. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-27399.

In Combodo iTop versions prior to 2.7.12, 3.1.2 and 3.2.0 a medium severity vulnerability CVE-2025-27139 was detected. This vulnerability allows attackers to execute cross-site scripting (XSS) attacks when the preferences page is opened. To address this issue, users should upgrade iTop to versions 2.7.12, 3.1.2, 3.2.0 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-27139.

In Mautic versions before 5.2.3 two critical security vulnerabilities CVE-2024-47051 were detected. These vulnerabilities allow authenticated users to execute remote code via asset upload by bypassing file extension restrictions and to delete arbitrary files through a path traversal flaw. To address this issues, users should upgrade Mautic to versions 5.2.3 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2024-47051.

In Odoo Community version 17.0 and Odoo Enterprise version 17.0 a high severity vulnerability CVE-2024-36259 was detected. This vulnerability allows remote authenticated attackers to extract sensitive information via an oracle-based (yes/no response) crafted attack. Currently, there is no fix version for this issue. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2024-36259.

In Mattermost versions 9.11.x up to 9.11.6 and 10.4.x up to 10.4.1 a low severity vulnerability CVE-2025-1412 was detected. The issue allows users converted to bots to retain their previous permissions, potentially escalating privileges. To address this issue, users should upgrade Mattermost to version 9.11.7 or 10.4.2. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-1412.

In Moodle version 4.5.0 a low severity vulnerability CVE-2025-26532 was detected. This vulnerability arises from insufficient checks in the glossary restoration process, allowing teachers to bypass trusttext configurations when restoring glossary entries. To address this issue, users should upgrade Moodle to version 4.5.2 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-26532.

In Mattermost versions 10.4.x up to 10.4.1, 9.11.x up to 9.11.7, 10.3.x up to 10.3.2 and 10.2.x up to 10.2.2 a critical severity vulnerability CVE-2025-20051 was detected. This vulnerability allows attackers to read arbitrary files on the system by exploiting improper input validation when patching and duplicating a board, specifically through duplicating a specially crafted block in Boards. To address this issue, users should upgrade Mattermost to versions 10.4.2 or later, 10.3.3 or later, 10.2.3 or later and 9.11.8 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-20051.