CVEs published in May 2025
40 tracked CVEs from 12 vendors had their first vendor advisory published in May 2025: 5 critical, 23 high, 2 in CISA KEV. Newest first.
14 more from this month are covered only by Red Hat's per-package records, listed on the Red Hat vendor page.
- Added
CVE-2025-3277Medium
SQLite Vulnerability in NetApp Products
NetApp · 1 advisory - Added
CVE-2025-31651Critical
Apache Tomcat Vulnerability in NetApp Products
NetApp · 1 advisory - Added
CVE-2025-31650High
Apache Tomcat Vulnerability in NetApp Products
NetApp · 1 advisory - Added
CVE-2025-31115High
XZ Utils Vulnerability in NetApp Products
NetApp · 1 advisory - Added
CVE-2025-22871Critical
Golang Vulnerability in NetApp Products
NetApp, Veeam · 2 advisories - Added
CVE-2024-54952High
RouterOS: MikroTik RouterOS 6.40.5, the SMB service contains a memory corruption vulnerability.
MikroTik · 1 advisory - Added
CVE-2025-48734Critical
Apache Commons Beanutils Vulnerability in NetApp Products
Apache, NetApp · 2 advisories - Added
CVE-2025-5278Medium
heap buffer under-read in gnu coreutils sort via key specification
NetApp, Red Hat · 2 advisories - Added
CVE-2025-5222High
stack buffer overflow in the srbroot::addtag function
NetApp, Red Hat · 2 advisories - Added
CVE-2025-40775High
ISC Bind Vulnerability in NetApp Products
NetApp · 1 advisory - Added
CVE-2025-20258Medium
vulnerability in the self-service portal of Cisco Duo could allow an unauthenticated, remote attacker to inject arbitrary commands into emails that are sent by the service
Cisco · 1 advisory - Added
CVE-2025-20114Medium
Cisco Unified Intelligence Center Insecure Direct Object Reference Vulnerability
Cisco · 1 advisory - Added
CVE-2025-22157High
Jira Service Management: This High severity PrivEsc (Privilege Escalation) vulnerability was introduced in versions: 9.12.0, 10.3.0, 10.4.0, and 10.5.0…
Atlassian · 1 advisory - Added
CVE-2025-4805Medium
WatchGuard Firebox Stored Cross-Site-Scripting (XSS) Vulnerability in Acces Portal Configuration
WatchGuard · 1 advisory - Added
CVE-2025-4804Medium
WatchGuard Firebox Stored Cross-Site-Scripting (XSS) Vulnerability in Hotpot Configuration
WatchGuard · 1 advisory - Added
CVE-2025-27820High
Apache HTTP Components Client Vulnerability in NetApp Products
NetApp · 1 advisory - Added
CVE-2024-57273Medium
Netgate pfSense CE (prior to 2.8.0 beta release) and corresponding Plus builds is vulnerable to Cross-site scripting (XSS) in…
pfSense · 1 advisory - Added
CVE-2024-54780High
Netgate pfSense CE (prior to 2.8.0 beta release) and corresponding Plus builds are vulnerable to command injection in the…
pfSense · 1 advisory - Added
CVE-2024-54779Medium
Netgate pfSense CE (prior to 2.8.0 beta release) and corresponding Plus builds is vulnerable to Cross Site Scripting (XSS) in…
pfSense · 1 advisory - Added
CVE-2025-22870Critical
Golang Vulnerability in NetApp Products
NetApp, Splunk · 2 advisories - Added
CVE-2025-46265High
On F5OS, an improper authorization vulnerability exists where remotely authenticated users (LDAP, RADIUS, TACACS+)
F5 · 1 advisory - Added
CVE-2025-43878Medium
F5OS: When running in Appliance mode, an authenticated attacker assigned the Administrator or Resource Administrator role
F5 · 1 advisory - Added
CVE-2025-41433High
When a Session Initiation Protocol (SIP) message routing framework (MRF) application layer gateway (ALG) profile is configured…
F5 · 1 advisory - Added
CVE-2025-41431High
BIG-IP: When connection mirroring is configured on a virtual server, undisclosed requests
F5 · 1 advisory - Added
CVE-2025-41414High
When HTTP/2 client and server profile is configured on a virtual server, undisclosed requests can cause TMM to terminate
F5 · 1 advisory - Added
CVE-2025-41399High
When a Stream Control Transmission Protocol (SCTP) profile is configured on a virtual server, undisclosed requests
F5 · 1 advisory - Added
CVE-2025-36557High
When an HTTP profile with the Enforce RFC Compliance option is configured on a virtual server, undisclosed requests
F5 · 1 advisory - Added
CVE-2025-36546High
On an F5OS system, if the root user had previously configured the system to allow login
F5 · 1 advisory - Added
CVE-2025-36525High
When a BIG-IP APM virtual server is configured to use a PingAccess profile, undisclosed requests can cause TMM to terminate
F5 · 1 advisory - Added
CVE-2025-36504High
When a BIG-IP HTTP/2 httprouter profile is configured on a virtual server, undisclosed responses
F5 · 1 advisory - Added
CVE-2025-35995High
When a BIG-IP PEM system is licensed with URL categorization, and the URL categorization policy or an iRule with the urlcat…
F5 · 1 advisory - Added
CVE-2025-31644High
When running in Appliance mode, a command injection vulnerability exists in an undisclosed iControl REST and BIG-IP TMOS Shell…
F5 · 1 advisory - Added
CVE-2025-20198Medium
vulnerability in the CLI of Cisco IOS XE Software could allow an authenticated, local attacker with privilege level 15 to elevate privileges to root on the underlying operating system of an affected device
Cisco · 1 advisory - Added
CVE-2025-20164High
vulnerability in the Cisco Industrial Ethernet Switch Device Manager (DM) of Cisco IOS Software could allow an authenticated, remote attacker to elevate privileges
Cisco · 1 advisory - Added
CVE-2025-20213Medium
Cisco Catalyst SDWAN Manager Arbitrary File Overwrite Vulnerability
Cisco · 1 advisory - Added
CVE-2025-34028CriticalCISA KEV
Commvault Command Center Path Traversal Vulnerability
Commvault · 1 advisory - Added
CVE-2025-4373Medium
buffer underflow on glib through glib/gstring.c via function g_string_insert_unichar
NetApp, Red Hat · 2 advisories - Added
CVE-2025-30698High
NetApp · 1 advisory - Added
CVE-2025-21587High
NetApp · 1 advisory - Added
CVE-2025-3928HighCISA KEV
Commvault Web Server Unspecified Vulnerability
Commvault · 1 advisory