Digest · Thursday

Security digest: September 4, 2025

3 known exploited (cisa kev) additions and 3 critical advisories.

Take stock

Do you run any of these? Sitecore Multiple Products, Android Runtime, Linux Kernel. They are being exploited in the wild (CISA KEV). Patch or mitigate if you do; CISA’s federal deadline is 2025-09-25.
PyPI: 2 critical advisories (TkEasyGUI, usd-core). Check with pip-audit (or: pip show <package>).
Go: 1 critical advisory (github.com/argoproj/argo-cd/v2, github.com/argoproj/argo-cd/v3). Check with govulncheck ./....
None of it touches your stack? Then there is nothing to do today. That is a result, not a failure to read carefully.

Added to CISA’s catalog on this day: confirmed exploitation in the wild. Due date = CISA’s deadline for US federal agencies.

CVE	Product and flaw	CISA due
CVE-2025-53690	Sitecore Multiple Products Sitecore Multiple Products Deserialization of Untrusted Data Vulnerability	2025-09-25
CVE-2025-48543	Android Runtime Android Runtime Use-After-Free Vulnerability	2025-09-25
CVE-2025-38352	Linux Kernel Linux Kernel Time-of-Check Time-of-Use (TOCTOU) Race Condition Vulnerability	2025-09-25

GitHub-reviewed advisories rated critical, published this day (Pacific time).

Check: pip-audit (or: pip show <package>)

TkEasyGUI Vulnerable to OS Command Injection CVE-2025-55037 CVSS 9.3 Critical
TkEasyGUI < 1.0.22 → fixed in 1.0.22
Pixar OpenUSD Sdf_PathNode Module Use-After-Free Vulnerability Leading to Potential Remote Code Execution GHSA-58p5-r2f6-g2cj CVSS 9.4 Critical
usd-core < 25.8 → fixed in 25.8

Check: govulncheck ./...

Argo CD's Project API Token Exposes Repository Credentials CVE-2025-55190 CVSS 9.9 Critical
github.com/argoproj/argo-cd/v2 >= 2.13.0, < 2.13.9 → fixed in 2.13.9; github.com/argoproj/argo-cd/v2 >= 2.14.0, < 2.14.16 → fixed in 2.14.16; github.com/argoproj/argo-cd/v3 < 3.0.14 → fixed in 3.0.14; +1 more packages