Jul 22, 2025

Started

• Closed✓Patched

  CrushFTP: CrushFTP Unprotected Alternate Channel Vulnerability

  CrushFTP contains an unprotected alternate channel vulnerability. When the DMZ proxy feature is not used, mishandles AS2 validation and consequently allows remote attackers to obtain admin access via HTTPS. Added to CISA KEV on 2025-07-22.

  CrushFTP·Closed Jul 22, 2025·updated Jul 22, 2025

• Closed✓Patched

  SysAid On-Prem: 2 exploited vulnerabilities (CVE-2025-2775, CVE-2025-2776)

  CVE-2025-2775: SysAid On-Prem contains an improper restriction of XML external entity reference vulnerability in the Checkin processing functionality, allowing for administrator account takeover and file read primitives. CVE-2025-2776: SysAid On-Prem contains an improper restriction of XML external entity reference vulnerability in the Server URL processing functionality, allowing for administrator account takeover and file read primitives. Added to CISA KEV on 2025-07-22.

  SysAid On-Prem·Closed Jul 22, 2025·updated Jul 22, 2025

• Closed✓Patched

  Google Chromium: Chromium ANGLE and GPU Improper Input Validation Vulnerability

  Google Chromium contains an improper input validation vulnerability in ANGLE and GPU. This vulnerability could allow a remote attacker to potentially perform a sandbox escape via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera. Added to CISA KEV on 2025-07-22.

  Google Chromium·Closed Jul 22, 2025·updated Jul 22, 2025

Updated

• Closed✓Patched

  ToolShell: mass exploitation of on-prem SharePoint (CVE-2025-53770, CVE-2025-49704, CVE-2025-49706)

  Unauthenticated RCE chain against on-premises SharePoint Server, mass-exploited from July 18, 2025. Microsoft observed Linen Typhoon, Violet Typhoon and Storm-2603 exploiting it; Storm-2603 deployed Warlock ransomware. Patching alone is not enough: rotate ASP.NET machine keys and restart IIS. SharePoint Online was not affected.

  Microsoft SharePoint Server (on-premises)·Closed Jul 22, 2025·updated Jul 22, 2025

• Closed✓Patched

  eslint-config-prettier and friends hijacked via npnjs.com phishing (CVE-2025-54313)

  A maintainer was phished through the typosquat domain npnjs.com. The attacker published malicious eslint-config-prettier versions whose install script ran node-gyp.dll on Windows, dropping the Scavenger infostealer. eslint-plugin-prettier, synckit, @pkgr/core, napi-postinstall and later the 'is' package were also hit.

  npm: eslint-config-prettier, eslint-plugin-prettier, synckit, @pkgr/core, napi-postinstall, is·Closed Jul 22, 2025·updated Jul 22, 2025