Security Digest: November 10, 2025 - 3 Critical Vulnerabilities

Today, three critical vulnerabilities have been identified that require immediate attention. These vulnerabilities could lead to severe data breaches and system compromises if not addressed swiftly.

· 3 min read

Urgent Security Alert: Three Critical Vulnerabilities Discovered

Today, three critical vulnerabilities have been identified that require immediate attention. These vulnerabilities could lead to severe data breaches and system compromises if not addressed swiftly. Immediate actions are recommended for affected systems.

Critical Vulnerabilities

CVE-2025-64522: SSRF in Webhook URL Validation

  • Impact: Allows cloud metadata theft, internal network access, port scanning, data exfiltration, and internal API access.
  • Affected Systems: Go applications using github.com/charmbracelet/soft-serve
  • Immediate Action: Disable webhook creation and delivery until a patch is applied.
  • Mitigation: Monitor webhook logs for suspicious activity and apply patches as they become available.

CVE-2025-64519: SQL Injection in Moderator Control Panel

  • Impact: Facilitates data disclosure, modification, or deletion by exploiting SQL queries.
  • Affected Systems: TorrentPier applications using composer torrentpier/torrentpier
  • Immediate Action: Restrict moderator privileges and apply input validation to prevent SQL injection.
  • Mitigation: Update to patched versions when available and review database access logs for anomalies.

CVE-2025-64518: XXE in Cyclonedx-core-java Validator

  • Impact: Vulnerable to XML External Entity injection, potentially exposing sensitive data.
  • Affected Systems: Java applications using maven org.cyclonedx:cyclonedx-core-java
  • Immediate Action: Reject XML documents before validation and upgrade to version 11.0.1.
  • Mitigation: Configure XML parsers to be secure and monitor for unauthorized access attempts.

What to Do Now

  1. Immediately review and apply patches for affected systems.
  2. Restrict access and monitor logs for unusual activities in the vulnerable components.
  3. Verify system integrity through security scans and audits.

Related Resources

  • Visit the official GitHub advisories for the latest patches and updates.
  • Stay informed through internal security blog posts for detailed guidance.

Keep reading