--- title: "Security digest: November 18, 2025" url: https://erroneo.us/security/2025-11-18/ description: "November 18, 2025 vulnerability digest: 1 CISA KEV addition (Fortinet); 3 critical advisories (PyPI, Maven). What to patch and who can relax." type: security-digest-day section: "Security Digest" date_published: 2025-11-18 date_modified: 2025-11-18 publisher: erroneo.us author: erroneo.us Security Desk license: All rights reserved. Quote with attribution and a link. --- # Security digest: November 18, 2025 1 known exploited (cisa kev) addition and 3 critical advisories. ## Take stock - Do you run any of these? Fortinet FortiWeb. They are being exploited in the wild (CISA KEV). Patch or mitigate if you do; CISA’s federal deadline is 2025-11-25. - PyPI: 2 critical advisories ( joserfc , modular ). Check with pip-audit (or: pip show ) . - Maven: 1 critical advisory ( org.glassfish.jersey.core:jersey-client ). Check with mvn dependency:tree -Dincludes=: . - None of it touches your stack? Then there is nothing to do today. That is a result, not a failure to read carefully. ## Known exploited (CISA KEV) - [CVE-2025-58034](https://erroneo.us/security/cve/CVE-2025-58034/index.md) Fortinet FortiWeb: Fortinet FortiWeb OS Command Injection Vulnerability (CISA due 2025-11-25) ## Critical advisories - [CVE-2025-65015](https://erroneo.us/security/cve/CVE-2025-65015/index.md) joserfc has Possible Uncontrolled Resource Consumption Vulnerability Triggered by Logging Arbitrarily Large JWT Token Payloads — PyPI joserfc >= 1.3.3, < 1.3.5 → 1.3.5; PyPI joserfc >= 1.4.0, < 1.4.2 → 1.4.2 - [CVE-2025-60455](https://erroneo.us/security/cve/CVE-2025-60455/index.md) Modular Max Serve has Unsafe Deserialization vulnerability — PyPI modular < 25.6.0 → 25.6.0 - [CVE-2025-12383](https://erroneo.us/security/cve/CVE-2025-12383/index.md) Eclipse Jersey has a Race Condition — Maven org.glassfish.jersey.core:jersey-client = 2.45 → 2.46; Maven org.glassfish.jersey.core:jersey-client = 3.0.16 → 3.0.17; Maven org.glassfish.jersey.core:jersey-client = 3.1.9 → 3.1.10 --- Source page: https://erroneo.us/security/2025-11-18/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt