Digest · Tuesday
Security digest: April 22, 2025
3 critical advisories.
All digests · RSS · Markdown
Take stock
- Go: 1 critical advisory (
github.com/wazuh/wazuh). Check withgovulncheck ./.... - PyPI: 1 critical advisory (
vllm). Check withpip-audit (or: pip show <package>). - npm: 1 critical advisory (
xrpl). Check withnpm audit (or: npm ls <package>). - None of it touches your stack? Then there is nothing to do today. That is a result, not a failure to read carefully.
Known exploited (CISA KEV) 0
Added to CISA’s catalog on this day: confirmed exploitation in the wild. Due date = CISA’s deadline for US federal agencies.
None.
Critical advisories by ecosystem 3
GitHub-reviewed advisories rated critical, published this day (Pacific time).
Go 1
Check: govulncheck ./...
- Wazuh server vulnerable to remote code execution CVE-2025-24016 CVSS 9.9 Critical
github.com/wazuh/wazuh>= 4.4.0, < 4.9.1 → fixed in 4.9.1
npm 1
Check: npm audit (or: npm ls <package>)
- Compromised xrpl.js versions 4.2.1, 4.2.2, 4.2.3, 4.2.4, and 2.14.2 CVE-2025-32965 CVSS 9.3 Critical
xrpl>= 4.2.1, < 4.2.5 → fixed in 4.2.5;xrpl= 2.14.2 → fixed in 2.14.3
PyPI 1
Check: pip-audit (or: pip show <package>)
- CVE-2025-24357 Malicious model remote code execution fix bypass with PyTorch < 2.6.0 GHSA-ggpf-24jw-3fcw CVSS 9.8 Critical
vllm< 0.8.0 → fixed in 0.8.0