Microsoft Issues Security Fixes for 56 Flaws, Including Active Exploit and Two Zero
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2025-54100 | Improper neutralization of special elements used in a command ('command injection') in Windows PowerShell allows an unauthorized attacker to execute code… | 7.8 | 2% | ||
| CVE-2025-54131 | Cursor: In versions below 1.3, an attacker can bypass the allow list in auto-run mode with a backtick (`) or $(cmd). If a user has… | 8.8 | <1% | ||
| CVE-2025-54377 | Roo Code: In versions 3.23.18 and below, RooCode does not validate line breaks (\n) in its command input, allowing potential bypass of the… | 7.8 | 1% | PoC | |
| CVE-2025-57771 | Roo Code: Roo-Code fails to properly handle process substitution and single ampersand characters in the command parsing logic for… | 8.1 | <1% | ||
| CVE-2025-59458 | In JetBrains Junie before 252.284.66, 251.284.66, 243.284.66, 252.284.61, 251.284.61, 243.284.61, 252.284.50, 252.284.54, 251.284.54, 251.284.50, 243.284.54… | 9.8 | <1% | ||
| CVE-2025-62221 | Use-After-Free Local Privilege Escalation in Windows Cloud Files Mini Filter Driver | 7.8 | 3% | KEV | KEV |
| CVE-2025-62223 | User interface (ui) misrepresentation of critical information in Microsoft Edge for iOS allows an unauthorized attacker to perform spoofing over a network | 4.3 | <1% | ||
| CVE-2025-64671 | Improper neutralization of special elements used in a command ('command injection') in Copilot allows an unauthorized attacker to execute code locally | 7.8 | <1% | ||
| CVE-2025-65946 | Roo Code: Due to an error in validation it was possible for Roo to automatically execute commands that did not match the allow list… | 8.1 | <1% |
From the original article
5 min read at thehackernews.com
Microsoft closed out 2025 with patches for 56 security flaws in various products across the Windows platform, including one vulnerability that has been actively exploited in the wild. Of the 56 flaws, three are rated Critical, and 53 are rated Important in severity. Two other defects are listed as publicly known at the time of the release.
By @TheHackersNews · thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.