So, we have summarized the vulnerabilities that need to be addressed as we continued last month.
For those involved in SOC/security operations, we will identify the most recent vulnerabilities to watchCybersecurity
and the Known Exploited Vulnerbilities Catalog published by the Infrastructure Security Agency (CISA) and the Common Vulnerabilities and Exposures (CVEs) published by The MITRE Corporation Based on Records, we have written explanations + how to deal with it. Please take advantage of this to reduce the operational burden while visualizing and prioritizing risks.

 

What is Known Exploited Vulnerabilities Catalog?

The Known Exploited Vulnerabilities (KEV) Catalog is a list of "Vulnerabilities Confirmed to Have Actually Exploited" published by CISA. Therefore, it can be used as a criterion for quickly responding to vulnerabilities that are actually used in cyberattacks.

 

What is Common Vulnerabilities and Exposures?

Common Vulnerabilities and Exposures (CVEs) are identifiers assigned to vulnerabilities in individual products published by The MITRE Corporation. An organization of security professionals, such as security vendors, product development vendors, and researchers, evaluates reported vulnerabilities and assigns identifiers.

 

Overview of each vulnerability and how to address it

CVE-2025-55182

Product/Scope of Influence

React Server Components for the React server functionality of the JavaScript library is affected by this vulnerability.
The following React Server Components are affected packages:

• react-server-dom-webpack 19.0
• react-server-dom-webpack 19.1.0
• react-server-dom-webpack 19.1.1
• react-server-dom-webpack 19.2.0
• react-server-dom-parcel 19.0
• react-server-dom-parcel 19.1.0
• react-server-dom-parcel 19.1.1
• react-server-dom-parcel 19.2.0
• react-server-dom-turbopack 19.0
• react-server-dom-turbopack 19.1.0
• react-server-dom-turbopack 19.1.1
• react-server-dom-turbopack 19.2.0

CVSS Score 10.0

Overview/Key Points

React Server Components is a package for React's server functionality. React Server Components is adopted as standard in Next.js and is widely used on websites and SaaS services that are open to the Internet. In addition, since it is a package that is widely used in other frameworks, it is thought to have a wide range of influences.

Exploitation of this vulnerability would enable remote code execution without authentication. If a server using this package receives a malformed HTTP payload that is intentionally configured by an attacker, the data will not be validated properly, and it may affect the execution logic on the server side.

Points to Deal with

First, update each package to the latest version.

• react-server-dom-webpack 19.0.1
• react-server-dom-webpack 19.1.2
• react-server-dom-webpack 19.2.1
• react-server-dom-parcel 19.0.1
• react-server-dom-parcel 19.1.2
• react-server-dom-parcel 19.2.1
• react-server-dom-turbopack 19.0.1
• react-server-dom-turbopack 19.1.2
• react-server-dom-turbopack 19.2.1

Please refer to this repository for updates.

• 19.01
• 19.1.2
• 19.2.1

---

CVE-2025-68613

Product/Scope of Influence

It is no-code or low-code, and is an OSS tool for automating business processes, n8n.

• n8n@0.211 ~ 1.120.4
• n8n@1.121

CVSS Score 10.0

Overview/Key Points

A vulnerability in the workflow assessment system could allow remote code execution. When the workflow is configured, the validation is performed without the authenticated user's configuration being isolated from the running runtime. An authenticated attacker could exploit this behavior and execute arbitrary code with the privileges of the n8n process. This allows the affected instance to be compromised, leading to unauthorized access to sensitive data, workflow changes, and more.

Points to Deal with

The latest version of this vulnerability has already been released as a patch.

Depending on the actual environment you are using, update to the latest version from n8n - ReleaseNote .

CVE-2025-14847

Product/Scope of Influence

The product that is affected by this vulnerability is MongoDB, which is widely used as a NoSQL database.
The product versions that are affected by this vulnerability are as follows:

• MongoDB 8.2.0 through 8.2.3
• MongoDB 8.0.0 through 8.0.16
• MongoDB 7.0.0 through 7.0.26
• MongoDB 6.0.0 through 6.0.26
• MongoDB 5.0.0 through 5.0.31
• MongoDB 4.4.0 through 4.4.29
• All MongoDB Server v4.2 versions
• All MongoDB Server v4.0 versions
• All MongoDB Server v3.6 versions

CVSS Score 8.7

Overview/Key Points

This product is widely used as a non-relational database management system for OSS. This database vulnerability can be exploited by improper protocol header settings for client-side zlibs, which could lead to heap memory reads by unauthenticated clients.

Points to Deal with

Security patches for each major version have already been distributed, so let's update them.

• 4.4.30
• 5.0.32
• 6.0.27
• 7.0.28
• 8.0.17
• 8.2.3

 

What Colorkrew can help Colorkrew can help ColorkrewSecurity provides SOC services that support attack detection and CSIRT response to vulnerabilities such as the above.

If you have any requests such as "I want to reduce the operational burden" or "I want to quickly detect cyber attacks", please feel free to contact us. Let's strengthen your company's security operations together.