Our news and updates

In WooCommerce Wishlist versions before 1.8.8 a high severity vulnerability CVE-2024-13694 was detected. This vulnerability allows unauthenticated attackers to extract data from wishlists they should not have access to, due to missing validation on a user-controlled key in the download_pdf_file() function. To address this issue, users should upgrade to version 1.8.8 or later. For more details, visit https://avd.aquasec.com/nvd/2024/cve-2024-13694.

In Authentik versions before 2024.10.4 a medium severity vulnerability CVE-2024-11623 was detected. This vulnerability allows authenticated admin users to upload crafted SVG files, which can lead to stored XSS attacks through the application icons. To address this issue, users should upgrade Authentik to version 2024.10.4 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2024-11623.

In MySQL Server versions up to 9.1.0 a medium severity vulnerability CVE-2025-21567 was detected. This vulnerability allows a low-privileged attacker with network access via multiple protocols to compromise MySQL Server. To address this issue, users should upgrade to a version 9.2.0 or higher. For more details, visit https://avd.aquasec.com/nvd/2025/cve-2025-21567.

In Discourse versions prior to 3.3.2 on the `stable` branch and 3.4.0.beta3 on the `tests-passed` branch a high severity vulnerability CVE-2025-23023 was detected. This vulnerability allows attackers to poison the anonymous cache by crafting a request with specific headers, potentially leading to missing preloaded data in the cache. This issue affects only anonymous visitors to the site. To address this issue, users should upgrade to the latest version of Discourse. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-23023.

In Discourse versions 3.3.3 and prior on the `stable` branch and 3.4.0.beta3 and prior on the `beta` and `tests-passed` branches a medium severity vulnerability CVE-2025-22602 was detected. This vulnerability allows attackers to execute arbitrary JavaScript on users’ browsers by posting a malicious video placeholder HTML element. To address this issue, users should upgrade Discourse to version 3.3.4 on the `stable` branch or version 3.4.0.beta4 on the `beta` and `tests-passed` branches. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-22602.

In Wazuh versions up to and including 4.9.0 a medium severity vulnerability CVE-2024-47770 was detected. This vulnerability allows attackers to see the Wazuh agent list without permission, which could expose important system information. To fix this issue, users should upgrade Wazuh to version 4.9.1. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2024-47770.

In Wazuh versions prior to 4.9.0 a high severity vulnerability CVE-2024-35177 was detected. This vulnerability allows attackers to gain full system access by placing malicious files in the Wazuh agent folder when installed in a non-default location. To fix this issue, users should upgrade Wazuh to version 4.9.0. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2024-35177.

In Sensei LMS WordPress plugin versions 4.24.3 and prior a medium severity vulnerability CVE-2025-0466 was detected. This vulnerability allows attackers to leak `sensei_email` and `sensei_message` information due to improper protection of some REST API routes. To address this issue, users should upgrade Sensei LMS plugin to version 4.24.4. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-0466.

In ShopSite plugin for WordPress versions 1.5.10 and prior a high severity vulnerability CVE-2024-13510 was detected. This vulnerability allows attackers to update settings and inject malicious web scripts via a forged request, provided they can trick a site administrator into performing an action such as clicking on a link. To address this issue, users should upgrade ShopSite plugin to version 1.5.11. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2024-13510.