---
title: "Security digest: August 28, 2025"
url: https://erroneo.us/security/2025-08-28/
description: "August 28, 2025 vulnerability digest: 2 critical advisories (Maven, Go). What to patch and who can relax."
type: security-digest-day
section: "Security Digest"
date_published: 2025-08-28
date_modified: 2025-08-28
publisher: erroneo.us
author: erroneo.us Security Desk
license: All rights reserved. Quote with attribution and a link.
---

# Security digest: August 28, 2025

2 critical advisories.

## Take stock

- Maven: 1 critical advisory ( com.ritense.valtimo:core ). Check with mvn dependency:tree -Dincludes=<groupId>:<artifactId> .
- Go: 1 critical advisory ( github.com/neuvector/neuvector ). Check with govulncheck ./... .
- None of it touches your stack? Then there is nothing to do today. That is a result, not a failure to read carefully.

## Known exploited (CISA KEV)

None.

## Critical advisories

- [CVE-2025-58059](https://erroneo.us/security/cve/CVE-2025-58059/index.md) Valtimo scripting engine can be used to gain access to sensitive data or resources — Maven com.ritense.valtimo:core < 12.16.0.RELEASE → 12.16.0.RELEASE; Maven com.ritense.valtimo:core >= 13.0.0.RELEASE, < 13.1.2.RELEASE → 13.1.2.RELEASE
- [CVE-2025-8077](https://erroneo.us/security/cve/CVE-2025-8077/index.md) NeuVector admin account has insecure default password — Go github.com/neuvector/neuvector < 0.0.0-20250825191744-da1a462074c3 → 0.0.0-20250825191744-da1a462074c3

---
Source page: https://erroneo.us/security/2025-08-28/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt