--- title: "Security digest: March 13, 2025" url: https://erroneo.us/security/2025-03-13/ description: "March 13, 2025 vulnerability digest: 2 CISA KEV additions (Apple, Juniper); 2 critical advisories (npm, Go). What to patch and who can relax." type: security-digest-day section: "Security Digest" date_published: 2025-03-13 date_modified: 2025-03-13 publisher: erroneo.us author: erroneo.us Security Desk license: All rights reserved. Quote with attribution and a link. --- # Security digest: March 13, 2025 2 known exploited (cisa kev) additions and 2 critical advisories. ## Take stock - Do you run any of these? Apple Multiple Products, Juniper Junos OS. They are being exploited in the wild (CISA KEV). Patch or mitigate if you do; CISA’s federal deadline is 2025-04-03. - npm: 1 critical advisory ( flowise ). Check with npm audit (or: npm ls ) . - Go: 1 critical advisory ( github.com/cheqd/cheqd-node ). Check with govulncheck ./... . - None of it touches your stack? Then there is nothing to do today. That is a result, not a failure to read carefully. ## Known exploited (CISA KEV) - [CVE-2025-24201](https://erroneo.us/security/cve/CVE-2025-24201/index.md) Apple Multiple Products: Apple Multiple Products WebKit Out-of-Bounds Write Vulnerability (CISA due 2025-04-03) - [CVE-2025-21590](https://erroneo.us/security/cve/CVE-2025-21590/index.md) Juniper Junos OS: Juniper Junos OS Improper Isolation or Compartmentalization Vulnerability (CISA due 2025-04-03) ## Critical advisories - [GHSA-h42x-xx2q-6v6g](https://erroneo.us/security/ghsa/GHSA-h42x-xx2q-6v6g/index.md) Flowise Pre-auth Arbitrary File Upload — npm flowise <= 2.2.7 → no fix - [GHSA-h2rp-8vpx-q9r4](https://erroneo.us/security/ghsa/GHSA-h2rp-8vpx-q9r4/index.md) cheqd-node Security patch for upstream vulnerabilities in IBC-Go (ISA-2025-001) and Cosmos SDK (ISA-2025-002) — Go github.com/cheqd/cheqd-node < 3.1.8 → 3.1.8 --- Source page: https://erroneo.us/security/2025-03-13/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt