--- title: "Security digest: December 2, 2025" url: https://erroneo.us/security/2025-12-02/ description: "December 2, 2025 vulnerability digest: 2 CISA KEV additions (Android); 2 critical advisories (PyPI, Composer (PHP)). What to patch and who can relax." type: security-digest-day section: "Security Digest" date_published: 2025-12-02 date_modified: 2025-12-02 publisher: erroneo.us author: erroneo.us Security Desk license: All rights reserved. Quote with attribution and a link. --- # Security digest: December 2, 2025 2 known exploited (cisa kev) additions and 2 critical advisories. ## Take stock - Do you run any of these? Android Framework. They are being exploited in the wild (CISA KEV). Patch or mitigate if you do; CISA’s federal deadline is 2025-12-23. - PyPI: 1 critical advisory ( asyncmy ). Check with pip-audit (or: pip show ) . - Composer (PHP): 1 critical advisory ( mautic/core ). Check with composer audit . - None of it touches your stack? Then there is nothing to do today. That is a result, not a failure to read carefully. ## Known exploited (CISA KEV) - [CVE-2025-48633](https://erroneo.us/security/cve/CVE-2025-48633/index.md) Android Framework: Android Framework Information Disclosure Vulnerability (CISA due 2025-12-23) - [CVE-2025-48572](https://erroneo.us/security/cve/CVE-2025-48572/index.md) Android Framework: Android Framework Privilege Escalation Vulnerability (CISA due 2025-12-23) ## Critical advisories - [CVE-2025-65896](https://erroneo.us/security/cve/CVE-2025-65896/index.md) asyncmy is vulnerable to SQL injection via crafted dict keys — PyPI asyncmy <= 0.2.11 → no fix - [CVE-2025-13828](https://erroneo.us/security/cve/CVE-2025-13828/index.md) Mautic user without privileged access to the Marketplace can install and uninstall composer packages — Composer (PHP) mautic/core >= 4.0.0, < 4.4.18 → 4.4.18; Composer (PHP) mautic/core >= 5.0.0, < 5.2.9 → 5.2.9; Composer (PHP) mautic/core >= 6.0.0, < 6.0.7 → 6.0.7 --- Source page: https://erroneo.us/security/2025-12-02/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt