Complete feed
Action required
Critical/high still unreviewed, or CISA KEV listed
Android app · Google Play
Take your CVE monitoring with you.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 32 official vendor sources and 160+ reviewed platform categories.
High [CVE-2025-61726] Golang Vulnerability in NetApp Products
Multiple NetApp products incorporate Golang. Golang versions prior to 1.24.12 and 1.25.0 prior to 1.25.6 are susceptible to a vulnerability which when successfully exploited could lead to Denial of Service (DoS). Successful exploitation of this vulnerability could lead to Denial of Service (DoS). Affected products: Astra Control Center, NetApp Console Agent, ONTAP tools for VMware vSphere 10, Trident Protect. NetApp reports that one or more additional products remain under investigation; review the canonical advisory for current status. NetApp states there is no workaround available at this time.
High [CVE-2026-22610] Angular Vulnerability in NetApp Products
Multiple NetApp products incorporate Angular. Angular versions prior to 19.2.18, 20.3.16, 21.0.7, and 21.1.0-rc.0 are susceptible to a vulnerability which when successfully exploited could lead to disclosure of sensitive information, addition or modification of data, or Denial of Service (DoS). Affected products: Active IQ Unified Manager for Linux, Active IQ Unified Manager for Microsoft Windows, Active IQ Unified Manager for VMware vSphere. NetApp reports that one or more additional products remain under investigation; review the canonical advisory for current status. NetApp states there is no workaround available at this time.
High [CVE-2026-26007] pyca/cryptography Vulnerability in NetApp Products
Multiple NetApp products incorporate pyca/cryptography. Cryptography versions prior to 46.0.5 are susceptible to a vulnerability which when successfully exploited could lead to disclosure of sensitive information. Successful exploitation of this vulnerability could lead to disclosure of sensitive information. NetApp reports that one or more additional products remain under investigation; review the canonical advisory for current status. NetApp states there is no workaround available at this time.
High [CVE-2026-23001] Linux Kernel Vulnerability in NetApp Products
Multiple NetApp products incorporate Linux kernel. Certain versions of Linux kernel are susceptible to a vulnerability which when successfully exploited could lead to disclosure of sensitive information, addition or modification of data, or Denial of Service (DoS). NetApp reports that one or more additional products remain under investigation; review the canonical advisory for current status. NetApp states there is no workaround available at this time.
High [CVE-2022-40735] Diffie-Hellman Key Exchange Protocol Vulnerability in NetApp Products
The Diffie-Hellman Key Exchange Protocol is susceptible to a vulnerability which when successfully exploited could lead to Denial of Service (DoS). Successful exploitation of this vulnerability could lead to Denial of Service (DoS). E-Series SANtricity OS Controller Software: Affected only when SSH is enabled - it is disabled by default. NetApp reports that one or more additional products remain under investigation; review the canonical advisory for current status. Affected products named by the advisory: Astra Control Center; FAS/AFF Baseboard Management Controller (BMC) - A250/500f/C250; NetApp Manageability SDK; NetApp Shift Toolkit; and 2 more. Affected products named by the advisory: ONTAP Select Deploy administration utility; ONTAP tools for VMware vSphere 10.
High [CVE-2025-69420] OpenSSL Vulnerability in NetApp Products
Multiple NetApp products incorporate OpenSSL. OpenSSL versions 3.6, 3.5, 3.4, 3.3, 3.0 and 1.1.1 are susceptible to a vulnerability which when successfully exploited could lead to Denial of Service (DoS). Successful exploitation of this vulnerability could lead to Denial of Service (DoS). NetApp Manageability SDK: OpenSSL was removed in 9.8P8. Affected products: Brocade SAN Navigator (SANnav), Management Services for Element Software and NetApp HCI, NetApp Console Agent Container (cbs-backend), ONTAP 9, ONTAP Select Deploy administration utility. NetApp reports that one or more additional products remain under investigation; review the canonical advisory for current status. NetApp states there is no workaround available at this time.
High [CVE-2025-61729] Golang Vulnerability in NetApp Products
Multiple NetApp products incorporate Golang. Golang versions prior to 1.24.11 and 1.25.0 prior to 1.25.5 are susceptible to a vulnerability which when successfully exploited could lead to Denial of Service (DoS). Successful exploitation of this vulnerability could lead to Denial of Service (DoS). Affected products: Astra Control Center, Data Infrastructure Insights Telegraf Agent, NetApp Console Agent, ONTAP tools for VMware vSphere 10, Trident. NetApp reports that one or more additional products remain under investigation; review the canonical advisory for current status. NetApp states there is no workaround available at this time.
High [CVE-2026-21441] Urllib3 Vulnerability in NetApp Products
Multiple NetApp products incorporate Urllib3. Urllib3 versions 1.22 prior to 2.6.3 are susceptible to a vulnerability which when successfully exploited could lead to Denial of Service (DoS). Successful exploitation of this vulnerability could lead to Denial of Service (DoS). Affected products: Management Services for Element Software and NetApp HCI, NetApp Data Classification. NetApp reports that one or more additional products remain under investigation; review the canonical advisory for current status. NetApp states there is no workaround available at this time.
High [CVE-2026-21925 +3] January 2026 Java Platform Standard Edition Vulnerabilities in NetApp Products
Multiple NetApp products incorporate the Oracle Java Platform, Standard Edition (Java SE). Java SE versions 8u471, 8u471-b50, 8u471-perf, 11.0.29, 17.0.17, 21.0.9, and 25.0.1 are susceptible to vulnerabilities that could allow an unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE. Refer to “Oracle Critical Patch Update Advisory - January 2026” for additional details. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Java SE accessible data as well as unauthorized read access to a subset of Oracle Java SE accessible data, unauthorized creation, deletion or modification access to critical data or all Oracle Java SE accessible data, and unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Java SE. OnCommand Insight: Affected by only CVE-2026-21925 and CVE-2026-21933. Data Infrastructure Insights Storage Workload Security Agent: NetApp reports that one or more additional products remain under investigation; review the canonical advisory for current status. Affected products named by the advisory: Active IQ Unified Manager for VMware vSphere; Data Infrastructure Insights and Data Secure Storage Workload Security Agent; NetApp Console Agent.
High [CVE-2025-9230 +6] January 2026 MySQL Server Vulnerabilities in NetApp Products
Multiple NetApp products incorporate MySQL. MySQL versions 8.0.0 through 8.0.44, 8.4.0 through 8.4.7, and 9.0.0 through 9.5.0 are susceptible to a vulnerability that could allow unauthenticated, high and low privileged attackers with network access via multiple protocols to compromise MySQL Server. Refer to “Oracle Critical Patch Update Advisory - January 2026” for additional details. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. Affected products: Active IQ Unified Manager for Microsoft Windows, Active IQ Unified Manager for VMware vSphere, OnCommand Insight, SnapCenter.
High [CVE-2025-38732] Linux Kernel Vulnerability in NetApp Products
Multiple NetApp products incorporate Linux kernel. Certain versions of Linux kernel are susceptible to a vulnerability which when successfully exploited could lead to Denial of Service (DoS). Successful exploitation of this vulnerability could lead to Denial of Service (DoS). Affected products: Active IQ Unified Manager for VMware vSphere, E-Series SANtricity OS Controller Software, ONTAP Select Deploy administration utility. NetApp reports that one or more additional products remain under investigation; review the canonical advisory for current status. NetApp states there is no workaround available at this time.
High [CVE-2025-43368 +5] January 2026 Java Platform Standard Edition 8u471-b50 Vulnerabilities in NetApp Products
Multiple NetApp products incorporate the Oracle Java Platform, Standard Edition (Java SE). Java SE version 8u471-b50 is susceptible to vulnerabilities that allow an unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE. Refer to “Oracle Critical Patch Update Advisory - January 2026” for additional details. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Java SE accessible data, unauthorized read access to a subset of Oracle Java SE accessible data, unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Java SE, unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Java SE or a takeover of Oracle Java SE. NetApp reports that one or more additional products remain under investigation; review the canonical advisory for current status.
High [CVE-2025-7425] Libxslt Vulnerability in NetApp Products
Multiple NetApp products incorporate libxslt. Libxslt versions through 1.1.43 are susceptible to a vulnerability which when successfully exploited could lead to addition or modification of data or Denial of Service (DoS). Affected products: ONTAP tools for VMware vSphere 10. NetApp reports that one or more additional products remain under investigation; review the canonical advisory for current status. NetApp states there is no workaround available at this time.
High [CVE-2025-5222] ICU Vulnerability in NetApp Products
Multiple NetApp products International Components for Unicode (ICU). ICU versions prior to 78.1 are susceptible to a vulnerability which when successfully exploited could lead to disclosure of sensitive information, addition or modification of data, or Denial of Service (DoS). Affected products: Management Services for Element Software and NetApp HCI. NetApp reports that one or more additional products remain under investigation; review the canonical advisory for current status. NetApp states there is no workaround available at this time.
High [CVE-2024-25062] Libxml2 Vulnerability in NetApp Products
Multiple NetApp products incorporate libxml2. libxml2 versions prior to 2.11.7 and 2.12.0 prior to 2.12.5 are susceptible to a vulnerability which when successfully exploited could lead to Denial of Service (DoS). Successful exploitation of this vulnerability could lead to Denial of Service (DoS). Affected products: Active IQ Unified Manager for VMware vSphere, ONTAP 9. NetApp reports that one or more additional products remain under investigation; review the canonical advisory for current status. NetApp states there is no workaround available at this time.
High [CVE-2025-60753] Libarchive Vulnerability in NetApp Products
Multiple NetApp products incorporate Libarchive. Libarchive versions 2.6.0 prior to 3.8.1 are susceptible to a vulnerability which when successfully exploited could lead to Denial of Service (DoS). Successful exploitation of this vulnerability could lead to Denial of Service (DoS). NetApp states there is no workaround available at this time.
High [CVE-2025-52881] Runc Vulnerability in NetApp Products
Multiple NetApp products incorporate runc. Runc versions prior to 1.2.8, prior to 1.3.3, and prior to 1.4.0-rc.3 are susceptible to a vulnerability which when successfully exploited could lead to disclosure of sensitive information, addition or modification of data, or Denial of Service (DoS). Affected products: Astra Control Center, NetApp Console Agent, ONTAP tools for VMware vSphere 10. NetApp reports that one or more additional products remain under investigation; review the canonical advisory for current status. NetApp states there is no workaround available at this time.
High [CVE-2025-31133] Runc Vulnerability in NetApp Products
Multiple NetApp products incorporate runc. Runc versions prior to 1.2.8, prior to 1.3.3, and prior to 1.4.0-rc.3 are susceptible to a vulnerability which when successfully exploited could lead to disclosure of sensitive information, addition or modification of data, or Denial of Service (DoS). Affected products: Astra Control Center, ONTAP tools for VMware vSphere 10. NetApp reports that one or more additional products remain under investigation; review the canonical advisory for current status. NetApp states there is no workaround available at this time.
High [CVE-2025-53057 +1] October 2025 Java Platform Standard Edition Vulnerabilities in NetApp Products
Multiple NetApp products incorporate Oracle Java Platform, Standard Edition (Java SE). Java SE versions 8u461, 8u461-perf, 11.0.28, 17.0.16, 21.0.8, and 25 are susceptible to vulnerabilities that when successfully exploited could allow unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE. Refer to “Oracle Critical Patch Update Advisory - October 2025” for additional details. Successful attacks of these vulnerabilities can result in unauthorized creation, deletion, modification, or access to critical data or complete access to all Oracle Java SE accessible data. Affected products: Active IQ Unified Manager for VMware vSphere, Brocade SAN Navigator (SANnav), E-Series SANtricity Unified Manager and Web Services Proxy, OnCommand Insight, SANtricity Storage Plugin for vCenter. NetApp reports that one or more additional products remain under investigation; review the canonical advisory for current status. NetApp states there is no workaround available at this time.
High [CVE-2024-6345] Pypi/Setuptools Vulnerability in NetApp Products
Multiple NetApp products incorporate Pypi/Setuptools. Pypi/Setuptools versions through 69.1.1 are susceptible to a vulnerability which when successfully exploited could lead to disclosure of sensitive information, addition or modification of data, or Denial of Service (DoS). Affected products: Active IQ Unified Manager for Linux, Active IQ Unified Manager for Microsoft Windows, Active IQ Unified Manager for VMware vSphere. NetApp reports that one or more additional products remain under investigation; review the canonical advisory for current status. NetApp states there is no workaround available at this time.