---
title: "Security digest: August 7, 2025"
url: https://erroneo.us/security/2025-08-07/
description: "August 7, 2025 vulnerability digest: 6 critical advisories (Maven, PyPI, Swift, RubyGems). What to patch and who can relax."
type: security-digest-day
section: "Security Digest"
date_published: 2025-08-07
date_modified: 2025-08-07
publisher: erroneo.us
author: erroneo.us Security Desk
license: All rights reserved. Quote with attribution and a link.
---

# Security digest: August 7, 2025

6 critical advisories.

## Take stock

- Maven: 5 critical advisories ( org.pytorch:executorch-android ). Check with mvn dependency:tree -Dincludes=<groupId>:<artifactId> .
- PyPI: 5 critical advisories ( executorch ). Check with pip-audit (or: pip show <package>) .
- Swift: 5 critical advisories ( github.com/pytorch/executorch ). Check with swift package show-dependencies .
- RubyGems: 1 critical advisory ( jwe ). Check with bundle audit check --update .
- None of it touches your stack? Then there is nothing to do today. That is a result, not a failure to read carefully.

## Known exploited (CISA KEV)

None.

## Critical advisories

- [CVE-2025-54951](https://erroneo.us/security/cve/CVE-2025-54951/index.md) ExecuTorch vulnerable to Heap-based Buffer Overflow — PyPI executorch < 0.7.0 → 0.7.0; Maven org.pytorch:executorch-android < 0.7.0 → 0.7.0; Swift github.com/pytorch/executorch < 0.7.0 → 0.7.0
- [CVE-2025-30404](https://erroneo.us/security/cve/CVE-2025-30404/index.md) ExecuTorch integer overflow vulnerability — PyPI executorch < 0.7.0 → 0.7.0; Maven org.pytorch:executorch-android < 0.7.0 → 0.7.0; Swift github.com/pytorch/executorch < 0.7.0 → 0.7.0
- [CVE-2025-54950](https://erroneo.us/security/cve/CVE-2025-54950/index.md) ExecuTorch out-of-bounds access vulnerability — PyPI executorch < 0.7.0 → 0.7.0; Maven org.pytorch:executorch-android < 0.7.0 → 0.7.0; Swift github.com/pytorch/executorch < 0.7.0 → 0.7.0
- [CVE-2025-54887](https://erroneo.us/security/cve/CVE-2025-54887/index.md) JWE is missing AES-GCM authentication tag validation in encrypted JWE — RubyGems jwe <= 1.1.0 → 1.1.1
- [CVE-2025-54949](https://erroneo.us/security/cve/CVE-2025-54949/index.md) ExecuTorch heap buffer overflow vulnerability — PyPI executorch < 0.7.0 → 0.7.0; Maven org.pytorch:executorch-android < 0.7.0 → 0.7.0; Swift github.com/pytorch/executorch < 0.7.0 → 0.7.0
- [CVE-2025-30405](https://erroneo.us/security/cve/CVE-2025-30405/index.md) ExecuTorch integer overflow vulnerability — PyPI executorch < 0.7.0 → 0.7.0; Maven org.pytorch:executorch-android < 0.7.0 → 0.7.0; Swift github.com/pytorch/executorch < 0.7.0 → 0.7.0

---
Source page: https://erroneo.us/security/2025-08-07/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt