---
title: "Security digest: June 10, 2025"
url: https://erroneo.us/security/2025-06-10/
description: "June 10, 2025 vulnerability digest: 2 CISA KEV additions (Microsoft, Wazuh); 3 critical advisories (npm, Maven, Composer (PHP)). What to patch and who can…"
type: security-digest-day
section: "Security Digest"
date_published: 2025-06-10
date_modified: 2025-06-10
publisher: erroneo.us
author: erroneo.us Security Desk
license: All rights reserved. Quote with attribution and a link.
---

# Security digest: June 10, 2025

2 known exploited (cisa kev) additions and 3 critical advisories.

## Take stock

- Do you run any of these? Microsoft Windows, Wazuh Wazuh Server. They are being exploited in the wild (CISA KEV). Patch or mitigate if you do; CISA’s federal deadline is 2025-07-01.
- npm: 1 critical advisory ( @nx/azure-cache ). Check with npm audit (or: npm ls <package>) .
- Maven: 1 critical advisory ( org.geoserver.web:gs-web-app , org.geoserver.main:gs-main ). Check with mvn dependency:tree -Dincludes=<groupId>:<artifactId> .
- Composer (PHP): 1 critical advisory ( magento/community-edition ). Check with composer audit .
- None of it touches your stack? Then there is nothing to do today. That is a result, not a failure to read carefully.

## Known exploited (CISA KEV)

- [CVE-2025-33053](https://erroneo.us/security/cve/CVE-2025-33053/index.md) Microsoft Windows:  Microsoft Windows External Control of File Name or Path Vulnerability (CISA due 2025-07-01)
- [CVE-2025-24016](https://erroneo.us/security/cve/CVE-2025-24016/index.md) Wazuh Wazuh Server: Wazuh Server Deserialization of Untrusted Data Vulnerability (CISA due 2025-07-01)

## Critical advisories

- [CVE-2025-36852](https://erroneo.us/security/cve/CVE-2025-36852/index.md) @nx/azure-cache Vulnerable to Build Cache Poisoning via Untrusted Pull Requests — npm @nx/azure-cache <= 4.0.0 → no fix
- [CVE-2024-34711](https://erroneo.us/security/cve/CVE-2024-34711/index.md) GeoServer has improper ENTITY_RESOLUTION_ALLOWLIST URI validation in XML Processing (SSRF) — Maven org.geoserver.web:gs-web-app < 2.25.0 → 2.25.0; Maven org.geoserver.main:gs-main < 2.25.0 → 2.25.0
- [CVE-2025-47110](https://erroneo.us/security/cve/CVE-2025-47110/index.md) Magneto contains stored XSS vulnerability — Composer (PHP) magento/community-edition >= 2.4.8-beta1, < 2.4.8-p1 → 2.4.8-p1; Composer (PHP) magento/community-edition >= 2.4.7-beta1, < 2.4.7-p6 → 2.4.7-p6; Composer (PHP) magento/community-edition < 2.4.5-p13 → 2.4.5-p13

---
Source page: https://erroneo.us/security/2025-06-10/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt