How severe is CVE-2025-65109?

CVE-2025-65109 has a CVSS 4.0 base score of 8.5, rated high severity.

Is CVE-2025-65109 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (15th percentile), an estimate of the probability of exploitation in the next 30 days.

How do I fix CVE-2025-65109?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its high severity, prioritise patching exposed systems.

Does CVE-2025-65109 have an EU (EUVD) identifier?

Yes. CVE-2025-65109 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2025-198530.

When was CVE-2025-65109 published?

CVE-2025-65109 was published on 2025-11-21 and last updated on 2026-06-17.

CVE-2025-65109

CVE-2025-65109 is a high-severity vulnerability with a CVSS 4.0 base score of 8.5. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-830.

Key facts

Severity: High (CVSS 4.0 base score 8.5)
EPSS exploit prediction: 0% (15th percentile)
Actively exploited: Not listed in CISA KEV
EU (EUVD) id: EUVD-2025-198530
Weakness: CWE-830
Published: 2025-11-21
Last modified: 2026-06-17

Description

Minder is an open source software supply chain security platform. In Minder Helm version 0.20241106.3386+ref.2507dbf and Minder Go versions from 0.0.72 to 0.0.83, Minder users may fetch content in the context of the Minder server, which may include URLs which the user would not normally have access to. This issue has been patched in Minder Helm version 0.20250203.3849+ref.fdc94f0 and Minder Go version 0.0.84.

Frequently asked questions

What is CVE-2025-65109?: Minder is an open source software supply chain security platform. In Minder Helm version 0.20241106.3386+ref.2507dbf and Minder Go versions from 0.0.72 to 0.0.83, Minder users may fetch content in the context of the Minder server, which may include URLs which the user would not normally have access to. This issue has been patched in Minder Helm version 0.20250203.3849+ref.fdc94f0 and Minder Go version 0.0.84.
How severe is CVE-2025-65109?: CVE-2025-65109 has a CVSS 4.0 base score of 8.5, rated high severity.
Is CVE-2025-65109 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (15th percentile), an estimate of the probability of exploitation in the next 30 days.
How do I fix CVE-2025-65109?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its high severity, prioritise patching exposed systems.
Does CVE-2025-65109 have an EU (EUVD) identifier?: Yes. CVE-2025-65109 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2025-198530.
When was CVE-2025-65109 published?: CVE-2025-65109 was published on 2025-11-21 and last updated on 2026-06-17.

References

Other CWE-830 vulnerabilities

CVE-2023-2588 — High (CVSS 8.8): Teltonika’s Remote Management System versions prior to 4.10.0 have a feature allowing users to access managed…
CVE-2024-29944 — High (CVSS 8.4): An attacker was able to inject an event handler into a privileged object that would allow arbitrary JavaScript…
CVE-2024-42381 — High (CVSS 8.3): os/linux/elf.rb in Homebrew brew before 4.2.20 uses ldd to load ELF files obtained from untrusted sources, which allows…
CVE-2025-46652 — Medium (CVSS 6.1): In IZArc through 4.5, there is a Mark-of-the-Web Bypass Vulnerability. When a user performs an extraction from an…
CVE-2025-43703 — Medium (CVSS 6.1): An issue was discovered in Ankitects Anki through 25.02. A crafted shared deck can result in attacker-controlled access…
CVE-2025-33028 — Medium (CVSS 6.1): In WinZip through 29.0, there is a Mark-of-the-Web Bypass Vulnerability because of an incomplete fix for CVE-2024-8811.…

Browse all CWE-830 vulnerabilities →