Our news and updates

In PHP versions 8.0.* before 8.0.27, 8.1.* before 8.1.15, and 8.2.* before 8.2.2 a critical severity vulnerability CVE-2022-31631 was detected. This vulnerability allows attackers to exploit improper quoting in the PDO::quote() function for SQLite, potentially leading to SQL injection when processing overly long strings. Currently, there is no fix version for that issue. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2022-31631.

In PostgreSQL versions before 17.3, 16.7, 15.11, 14.16 and 13.19 a high severity vulnerability CVE-2025-1094 was detected. This vulnerability allows attackers to exploit improper quoting in libpq functions and PostgreSQL command-line utilities, potentially leading to SQL injection in specific usage scenarios. To address this issue, users should upgrade to PostgreSQL 17.3, 16.7, 15.11, 14.16 or 13.19. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-1094.

In LibreNMS versions prior to 24.10.1 a medium severity vulnerability CVE-2025-23201 was detected. This vulnerability allows remote attackers to execute malicious scripts via the `/addhost` parameter `community`, leading to unauthorized actions or data exposure. To address this issue, users should upgrade LibreNMS to version 24.11.0 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-23201.

In Zulip versions 10.0-dev after commit 50256f48314250978f521ef439cafa704e056539 a medium severity vulnerability CVE-2025-25195 was detected. This vulnerability allows attackers to view the names of private channels through improperly scoped inactivity notifications sent to all users in the organization. To address this issue, users should upgrade Zulip to 10.0-dev at commit 75be449d456d29fef27e9d1828bafa30174284b4. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-25195.

In GitLab CE/EE versions starting from 15.7 prior to 17.5.5, starting from 17.6 prior to 17.6.3, and starting from 17.7 prior to 17.7.1 a medium severity vulnerability CVE-2024-6324 was detected. This vulnerability allows an attacker to trigger a Denial of Service (DoS) by creating cyclic references between epics. To address this issue, users should upgrade GitLab CE/EE to versions 17.5.5, 17.6.3 or 17.7.1. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2024-6324.

In Mattermost versions 10.x up to and including 10.2 a low severity vulnerability CVE-2025-22445 was detected. This vulnerability allows confusion for administrators regarding a Calls security-sensitive configuration due to inaccurate UI reporting of missing settings. To address this issue, users should upgrade Mattermost to version 10.3 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-22445.

In Mattermost Mobile Apps versions 2.22.0 and prior a medium severity vulnerability CVE-2025-0476 was detected. This vulnerability allows an attacker to crash the mobile app for any user who opens a channel containing a specially crafted attachment. Currently, there is no fix version for this issue. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-0476.

In SuiteCRM version 7.12.7 a high severity vulnerability CVE-2022-45186 was detected. This vulnerability allows authenticated users to recover arbitrary fields from the database. Currently, there is no fix version for this issue. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2022-45186.

In Mattermost versions 9.11.x up to and including 9.11.5 a low severity vulnerability CVE-2025-22449 was detected. This vulnerability allows team admins without permission to invite users to their team to bypass restrictions by updating the “allow_open_invite” field, making their team public and inviting users. To address this issue, users should upgrade Mattermost to version 9.11.6 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-22449.