Digest · Monday
Security digest: June 2, 2025
5 known exploited (cisa kev) additions and 1 critical advisory.
All digests · RSS · Markdown
Take stock
- Do you run any of these? ConnectWise ScreenConnect, Craft CMS Craft CMS, ASUS RT-AX55 Routers, ASUS Routers. They are being exploited in the wild (CISA KEV). Patch or mitigate if you do; CISA’s federal deadline is 2025-06-23.
- PyPI: 1 critical advisory (
llama-index-vector-stores-duckdb). Check withpip-audit (or: pip show <package>). - None of it touches your stack? Then there is nothing to do today. That is a result, not a failure to read carefully.
Known exploited (CISA KEV) 5
Added to CISA’s catalog on this day: confirmed exploitation in the wild. Due date = CISA’s deadline for US federal agencies.
| CVE | Product and flaw | CISA due |
|---|---|---|
| CVE-2025-3935 | ConnectWise ScreenConnect ConnectWise ScreenConnect Improper Authentication Vulnerability | 2025-06-23 |
| CVE-2025-35939 | Craft CMS Craft CMS Craft CMS External Control of Assumed-Immutable Web Parameter Vulnerability | 2025-06-23 |
| CVE-2024-56145 | Craft CMS Craft CMS Craft CMS Code Injection Vulnerability | 2025-06-23 |
| CVE-2023-39780 | ASUS RT-AX55 Routers ASUS RT-AX55 Routers OS Command Injection Vulnerability | 2025-06-23 |
| CVE-2021-32030 | ASUS Routers ASUS Routers Improper Authentication Vulnerability | 2025-06-23 |
Critical advisories by ecosystem 1
GitHub-reviewed advisories rated critical, published this day (Pacific time).
PyPI 1
Check: pip-audit (or: pip show <package>)
- LlamaIndex DuckDBVectorStore vulnerable to SQL injection through ref_doc_id CVE-2025-1750 CVSS 9.8 Critical
llama-index-vector-stores-duckdb>= 0.12.19, < 0.12.21 → fixed in 0.12.21