Digest · Thursday
Security digest: October 2, 2025
5 known exploited (cisa kev) additions.
All digests · RSS · Markdown
Take stock
- Do you run any of these? Smartbedded Meteobridge, Samsung Mobile Devices, Jenkins Jenkins, Juniper ScreenOS, GNU GNU Bash. They are being exploited in the wild (CISA KEV). Patch or mitigate if you do; CISA’s federal deadline is 2025-10-23.
- None of it touches your stack? Then there is nothing to do today. That is a result, not a failure to read carefully.
Known exploited (CISA KEV) 5
Added to CISA’s catalog on this day: confirmed exploitation in the wild. Due date = CISA’s deadline for US federal agencies.
| CVE | Product and flaw | CISA due |
|---|---|---|
| CVE-2025-4008 | Smartbedded Meteobridge Smartbedded Meteobridge Command Injection Vulnerability | 2025-10-23 |
| CVE-2025-21043 | Samsung Mobile Devices Samsung Mobile Devices Out-of-Bounds Write Vulnerability | 2025-10-23 |
| CVE-2017-1000353 | Jenkins Jenkins Jenkins Remote Code Execution Vulnerability | 2025-10-23 |
| CVE-2015-7755 | Juniper ScreenOS Juniper ScreenOS Improper Authentication Vulnerability | 2025-10-23 |
| CVE-2014-6278 | GNU GNU Bash GNU Bash OS Command Injection Vulnerability | 2025-10-23 |
Critical advisories by ecosystem 0
GitHub-reviewed advisories rated critical, published this day (Pacific time).
None.