---
title: "Security digest: June 9, 2025"
url: https://erroneo.us/security/2025-06-09/
description: "June 9, 2025 vulnerability digest: 2 CISA KEV additions (Erlang, Roundcube); 3 critical advisories (PyPI, Go, Maven). What to patch and who can relax."
type: security-digest-day
section: "Security Digest"
date_published: 2025-06-09
date_modified: 2025-06-09
publisher: erroneo.us
author: erroneo.us Security Desk
license: All rights reserved. Quote with attribution and a link.
---

# Security digest: June 9, 2025

2 known exploited (cisa kev) additions and 3 critical advisories.

## Take stock

- Do you run any of these? Erlang Erlang/OTP, Roundcube Webmail. They are being exploited in the wild (CISA KEV). Patch or mitigate if you do; CISA’s federal deadline is 2025-06-30.
- PyPI: 1 critical advisory ( backend.ai ). Check with pip-audit (or: pip show <package>) .
- Go: 1 critical advisory ( github.com/knadh/listmonk ). Check with govulncheck ./... .
- Maven: 1 critical advisory ( org.geotools:gt-xsd-core , org.geotools:gt-wfs-ng ). Check with mvn dependency:tree -Dincludes=<groupId>:<artifactId> .
- None of it touches your stack? Then there is nothing to do today. That is a result, not a failure to read carefully.

## Known exploited (CISA KEV)

- [CVE-2025-32433](https://erroneo.us/security/cve/CVE-2025-32433/index.md) Erlang Erlang/OTP: Erlang Erlang/OTP SSH Server Missing Authentication for Critical Function Vulnerability (CISA due 2025-06-30)
- [CVE-2024-42009](https://erroneo.us/security/cve/CVE-2024-42009/index.md) Roundcube Webmail: RoundCube Webmail Cross-Site Scripting Vulnerability (CISA due 2025-06-30)

## Critical advisories

- [CVE-2025-49652](https://erroneo.us/security/cve/CVE-2025-49652/index.md) BackendAI Missing Authentication for Critical Function — PyPI backend.ai < 25.15.6 → 25.15.6; PyPI backend.ai >= 25.16.0rc1, < 25.19.0rc1 → 25.19.0rc1
- [CVE-2025-49136](https://erroneo.us/security/cve/CVE-2025-49136/index.md) listmonk's Sprig template Injection vulnerability leads to reading of Environment Variable for low privilege user — Go github.com/knadh/listmonk >= 4.0.0, < 5.0.2 → 5.0.2
- [GHSA-826p-4gcg-35vw](https://erroneo.us/security/ghsa/GHSA-826p-4gcg-35vw/index.md) GeoTools has XML External Entity (XXE) Processing Vulnerability in XSD schema handling — Maven org.geotools:gt-xsd-core = 33.0 → 33.1; Maven org.geotools:gt-xsd-core >= 32.0, < 32.3 → 32.3; Maven org.geotools:gt-xsd-core >= 29.0, <= 31.6 → 31.7

---
Source page: https://erroneo.us/security/2025-06-09/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt