In Nagios XI versions prior to 2024R1.1 a medium severity vulnerability CVE-2024-13992 was detected. This vulnerability allows remote attackers to execute arbitrary JavaScript in a victim’s browser via a crafted link that targets the “missing page” (404) page, due to improper validation or escaping of user-supplied input in `page-missing.php`. To address this issue, users should upgrade Nagios XI to version 2024R1.1 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2024-13992.
Read more Monitoring
In Rancher Manager versions prior to 2.11.7 and 2.12.3 a medium severity vulnerability CVE-2023-32199 was detected. This issue allows users to retain administrative access to clusters even after a custom GlobalRole or its binding has been removed, provided the role included wildcard * permissions for resources or non-resource URLs. To fix this issue, users should upgrade to Rancher Manager versions 2.11.7 or 2.12.3 or later. For more details, visit https://avd.aquasec.com/nvd/2023/cve-2023-32199.
In Rancher Manager versions 2.9.0 through 2.12.2 a medium severity vulnerability CVE-2024-58269 was detected. This vulnerability allows sensitive information — including secret data, cluster import URLs, and registration tokens — to be exposed to any entity with access to Rancher audit logs. To fix this vulnerability, users should upgrade to version 2.12.3 or later. For more details, visit https://avd.aquasec.com/nvd/2024/cve-2024-58269.
Read more Developer Tools
In Liferay Portal versions 7.4.0 through 7.4.3.119 and Liferay DXP versions 2024.Q1.1 through 2024.Q1.5, 2023.Q4.0 through 2023.Q4.10, 2023.Q3.1 through 2023.Q3.10, 7.4 GA through update 92, and older unsupported versions a medium severity vulnerability CVE-2025-62257 was detected. This vulnerability allows remote attackers to determine a user’s password through brute force attacks, even when account lockout protection is enabled. To fix this vulnerability, users should upgrade to Liferay Portal 7.4.3.120, Liferay DXP 2024.Q4.0, 2024.Q3.0, 2024.Q2.0, or 2024.Q1.6. For more details, visit https://avd.aquasec.com/nvd/2025/cve-2025-62257.
Read more CMS
In Liferay Portal versions 7.4.0 through 7.4.3.119 and older unsupported versions, and Liferay DXP versions 2024.Q1.1 through 2024.Q1.5, 2023.Q4.0 through 2023.Q4.10, 2023.Q3.1 through 2023.Q3.10, 7.4 GA through update 92, and older unsupported versions a medium severity vulnerability CVE‑2025‑62266 was detected. This vulnerability allows remote attackers to redirect users to arbitrary external URLs due to DNS rebinding attacks. To fix this vulnerability, users should upgrade to Liferay Portal 7.4.3.120, Liferay DXP 2024.Q4.0, 2024.Q3.0, 2024.Q2.0, or 2024.Q1.6. For more details, visit https://avd.aquasec.com/nvd/2025/cve-2025-62266.
Read more CMS
In Liferay Portal versions 7.4.0 through 7.4.3.111 and older unsupported versions, and Liferay DXP versions 2023.Q4.0 through 2023.Q4.10, 2023.Q3.1 through 2023.Q3.8, 7.4 GA through update 92, and 7.3 GA through update 36 a medium severity vulnerability CVE‑2025‑62265 was detected. This vulnerability allows remote attackers to inject arbitrary web script or HTML via a crafted <iframe> tag in a blog entry’s “Content” text field, due to the Blogs widget not applying the sandbox attribute to <iframe> elements. To fix this vulnerability, users should upgrade to Liferay Portal 7.4.3.112 or Liferay DXP 2024.Q1.1 or 2023.Q3.9. For more details, visit https://avd.aquasec.com/nvd/2025/cve-2025-62265.
Read more CMS
In SuiteCRM version 7.14.1 a medium severity vulnerability CVE‑2025‑41384 was detected. This vulnerability allows an attacker to execute JavaScript code by modifying the HTTP Referer header to include an arbitrary domain with malicious JavaScript at the end; the server will attempt to block the arbitrary domain but still allow the JavaScript code to execute. To address this issue, users should upgrade SuiteCRM to version 7.14.7 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-41384.
Read more CRM
In Liferay Portal 7.4.0 through 7.4.3.99, and Liferay DXP 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92, 7.3 GA through update 35, and older unsupported versions a high severity vulnerability CVE-2025-62260 was detected. This vulnerability allows remote attackers to perform denial-of-service attacks by executing Headless API requests that return a large number of objects. To fix this issue, users should upgrade to Liferay Portal 7.4.3.100, Liferay DXP 2024.Q1.1, Liferay DXP 2023.Q4.0, Liferay DXP 2023.Q3.5, or Liferay DXP 7.3 U36. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-62260.
Read more CMS
In Liferay Portal 7.4.0 through 7.4.3.109, and older unsupported versions, and Liferay DXP 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92, 7.3 GA through update 35, and older unsupported versions a medium severity vulnerability CVE-2025-62259 was detected. This vulnerability allows remote users to access and edit content via the API before verifying their email address. To fix this issue, users should upgrade to Liferay Portal 7.4.3.110, Liferay DXP 2024.Q1.1, Liferay DXP 2023.Q4.0, Liferay DXP 2023.Q3.5, or Liferay DXP 7.3 Update 36. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-62259.
Read more CMS