Digest · Monday

Security digest: June 9, 2025

2 known exploited (cisa kev) additions and 3 critical advisories.

Take stock

Do you run any of these? Erlang Erlang/OTP, Roundcube Webmail. They are being exploited in the wild (CISA KEV). Patch or mitigate if you do; CISA’s federal deadline is 2025-06-30.
PyPI: 1 critical advisory (backend.ai). Check with pip-audit (or: pip show <package>).
Go: 1 critical advisory (github.com/knadh/listmonk). Check with govulncheck ./....
Maven: 1 critical advisory (org.geotools:gt-xsd-core, org.geotools:gt-wfs-ng). Check with mvn dependency:tree -Dincludes=<groupId>:<artifactId>.
None of it touches your stack? Then there is nothing to do today. That is a result, not a failure to read carefully.

Added to CISA’s catalog on this day: confirmed exploitation in the wild. Due date = CISA’s deadline for US federal agencies.

CVE	Product and flaw	CISA due
CVE-2025-32433	Erlang Erlang/OTP Erlang Erlang/OTP SSH Server Missing Authentication for Critical Function Vulnerability	2025-06-30
CVE-2024-42009	Roundcube Webmail RoundCube Webmail Cross-Site Scripting Vulnerability	2025-06-30

GitHub-reviewed advisories rated critical, published this day (Pacific time).

Check: govulncheck ./...

listmonk's Sprig template Injection vulnerability leads to reading of Environment Variable for low privilege user CVE-2025-49136 CVSS 9.0 Critical
github.com/knadh/listmonk >= 4.0.0, < 5.0.2 → fixed in 5.0.2

Check: mvn dependency:tree -Dincludes=<groupId>:<artifactId>

GeoTools has XML External Entity (XXE) Processing Vulnerability in XSD schema handling GHSA-826p-4gcg-35vw CVSS 9.9 Critical
org.geotools:gt-xsd-core = 33.0 → fixed in 33.1; org.geotools:gt-xsd-core >= 32.0, < 32.3 → fixed in 32.3; org.geotools:gt-xsd-core >= 29.0, <= 31.6 → fixed in 31.7; +5 more packages

Check: pip-audit (or: pip show <package>)

BackendAI Missing Authentication for Critical Function CVE-2025-49652 CVSS 9.8 Critical
backend.ai < 25.15.6 → fixed in 25.15.6; backend.ai >= 25.16.0rc1, < 25.19.0rc1 → fixed in 25.19.0rc1