CVEs published in October 2025

CVE-2025-9086Medium

Libcurl Vulnerability in NetApp Products

CVE-2025-7545Medium

GNU Binutils Vulnerability in NetApp Products

CVE-2025-55754Medium

Apache Tomcat Vulnerability in NetApp Products

CVE-2025-53066High

CVE-2025-53057High

CVE-2025-40778High

ISC BIND Vulnerability in NetApp Products

CVE-2025-1182Low

GNU Binutils Vulnerability in NetApp Products

CVE-2023-5156High

Glibc Vulnerability in NetApp Products

CVE-2025-54941Unrated

Apache Airflow: Command injection in "example_dag_decorator"

CVE-2025-62402Unrated

Apache Airflow: Airflow 3 API: /api/v2/dagReports executes DAG Python in API

CVE-2025-1549Medium

CVE-2025-4106High

WatchGuard Firebox leftover debug code vulnerability

CVE-2025-27819High

Apache Kafka Vulnerability in NetApp Products

CVE-2025-27818High

Apache Kafka Vulnerability in NetApp Products

CVE-2025-10230Critical

Samba: command injection in wins server hook script

CVE-2025-22178Medium

Jira: Jira Align is vulnerable to an authorization issue.

CVE-2025-22177Medium

Jira: Jira Align is vulnerable to an authorization issue.

CVE-2025-22176Medium

Jira: Jira Align is vulnerable to an authorization issue.

CVE-2025-22175Medium

Jira: Jira Align is vulnerable to an authorization issue.

CVE-2025-22174Medium

Jira: Jira Align is vulnerable to an authorization issue.

CVE-2025-22173Medium

Jira: Jira Align is vulnerable to an authorization issue.

CVE-2025-22172Medium

Jira: Jira Align is vulnerable to an authorization issue.

CVE-2025-22171Medium

Jira: Jira Align is vulnerable to an authorization issue.

CVE-2025-22170Medium

Jira: Jira Align is vulnerable to an authorization issue.

CVE-2025-22169Medium

Jira: Jira Align is vulnerable to an authorization issue.

CVE-2025-22168Medium

Jira: Jira Align is vulnerable to an authorization issue.

CVE-2025-22167Medium

Jira Software: This High severity Path Traversal (Arbitrary Write) vulnerability was introduced in versions: 9.12.0, 10.3.0 and remain present…

CVE-2025-22166High

Confluence Data Center: This High severity DoS (Denial of Service) vulnerability was introduced in version 2.0 of Confluence Data Center.

CVE-2025-61985Low

CVE-2025-61984Low

CVE-2025-47273High

Pypi/Setuptools Vulnerability in NetApp Products

CVE-2024-6345High

Pypi/Setuptools Vulnerability in NetApp Products

CVE-2024-25178High

CVE-2024-25177High

CVE-2024-25176High

CVE-2025-61990High

When using a multi-bladed platform with more than one blade, undisclosed traffic

CVE-2025-61935High

When a BIG IP Advanced WAF or ASM security policy is configured on a virtual server, undisclosed requests

CVE-2025-61933Medium

reflected cross-site scripting (XSS) vulnerability exists in an undisclosed page of BIG-IP APM

CVE-2025-58071High

When IPsec is configured on the BIG-IP system, undisclosed traffic can cause the Traffic Management Microkernel (TMM) to terminate

CVE-2025-57780High

vulnerability exists in F5OS-A and F5OS-C system that may

CVE-2025-53860Medium

vulnerability exists in F5OS-A software

CVE-2025-61974High

When a client SSL profile is configured on a virtual server, undisclosed requests

CVE-2025-61960High

When a per-request policy is configured on a BIG-IP APM portal access virtual server, undisclosed traffic

CVE-2025-61958High

BIG-IP: vulnerability exists in the iHealth command that may

CVE-2025-61955High

vulnerability exists in F5OS-A and F5OS-C systems that may

CVE-2025-61951High

Undisclosed traffic can cause the Traffic Management Microkernel (TMM) to terminate.

CVE-2025-61938High

When a BIG-IP Advanced WAF or ASM security policy is configured with a URL greater than 1024 characters in length for the Data…

CVE-2025-60016High

When Diffie-Hellman (DH) group Elliptic Curve Cryptography (ECC) Brainpool curves are configured in an SSL profile's Cipher Rule…

CVE-2025-60015Medium

F5OS: out-of-bounds write vulnerability exists in F5OS-A and F5OS-C that could lead to memory corruption.

CVE-2025-60013Medium

When a highly-privileged, authenticated attacker attempts to initialize the rSeries FIPS module using a password with special…

CVE-2025-59781High

When DNS cache is configured on a BIG-IP or BIG-IP Next CNF virtual server, undisclosed DNS queries

CVE-2025-59778High

When the Allowed IP Addresses feature is configured on the F5OS-C partition control plane, undisclosed traffic

CVE-2025-59483Medium

validation vulnerability exists in an undisclosed URL in the Configuration utility.

CVE-2025-59481High

vulnerability exists in an undisclosed iControl REST and BIG-IP TMOS Shell (tmsh) command that may

CVE-2025-59478High

When a BIG-IP AFM denial-of-service (DoS) protection profile is configured on a virtual server, undisclosed requests

CVE-2025-59269Medium

stored cross-site scripting (XSS) vulnerability exists in an undisclosed page of the BIG-IP Configuration utility

CVE-2025-59268Medium

On the BIG-IP system, undisclosed endpoints that contain static non-sensitive information are accessible to an unauthenticated…

CVE-2025-58474Medium

When BIG-IP Advanced WAF is configured on a virtual server with Server-Side Request Forgery (SSRF) protection or

CVE-2025-58424Medium

On BIG-IP systems, undisclosed traffic can cause data corruption and unauthorized data modification in protocols

CVE-2025-58153Medium

Under undisclosed traffic conditions along with conditions beyond the attacker's control, hardware systems with a High-Speed…

CVE-2025-58120High

When HTTP/2 Ingress is configured, undisclosed traffic can cause the Traffic Management Microkernel (TMM) to terminate.

CVE-2025-58096High

When the database variable tm.tcpudptxchecksum is configured as non-default value Software-only on a BIG-IP system, undisclosed…

CVE-2025-55670Medium

On BIG-IP Next CNF, BIG-IP Next SPK, and BIG-IP Next for Kubernetes systems, repeated undisclosed API calls

CVE-2025-55669High

When the BIG-IP Advanced WAF and ASM security policy and a server-side HTTP/2 profile are configured on a virtual server…

CVE-2025-55036High

When BIG-IP SSL Orchestrator explicit forward proxy is configured on a virtual server and the proxy connect feature is enabled…

CVE-2025-54858High

When a BIG-IP Advanced WAF or BIG-IP ASM Security Policy is configured with a JSON content profile that has a malformed JSON…

CVE-2025-54854High

When a BIG-IP APM OAuth access profile (Resource Server or Resource Client) is configured on a virtual server, undisclosed traffic

CVE-2025-54805Medium

When an iRule is configured on a virtual server via the declarative API, upon re-instantiation, the cleanup process

CVE-2025-54755Medium

directory traversal vulnerability exists in TMUI that allows a highly privileged authenticated attacker to access files

CVE-2025-54479High

When a classification profile is configured on a virtual server without an HTTP or HTTP/2 profile, undisclosed requests

CVE-2025-53868High

When running in Appliance mode, a highly privileged authenticated attacker with access to SCP and SFTP

CVE-2025-53856High

BIG-IP: When a virtual server, network address translation (NAT) object, or secure network address translation (SNAT) object uses the…

CVE-2025-53521CriticalCISA KEV

F5 BIG-IP Stack-Based Buffer Overflow Vulnerability

CVE-2025-53474High

When an iRule using an ILX::call command is configured on a virtual server, undisclosed traffic

CVE-2025-48008High

When a TCP profile with Multipath TCP (MPTCP) enabled is configured on a virtual server, undisclosed traffic along with…

CVE-2025-47150Medium

When SNMP is configured on F5OS Appliance and Chassis systems, undisclosed requests

CVE-2025-47148Medium

When the BIG-IP system is configured as both a Security Assertion Markup Language (SAML) service provider (SP) and Identity…

CVE-2025-46706High

When an iRule containing the HTTP::respond command is configured on a virtual server, undisclosed requests

CVE-2025-41430High

When BIG-IP SSL Orchestrator is enabled, undisclosed traffic can cause the Traffic Management Microkernel (TMM) to terminate

CVE-2025-37148Medium

vulnerability in the parsing of ethernet frames in AOS-8 Instant and AOS 10 could

CVE-2025-37145Medium

Arbitrary file download vulnerabilities exist in a low-level interface library in AOS-10 GW and AOS-8 Controller/Mobility…

CVE-2025-37144Medium

Arbitrary file download vulnerabilities exist in a low-level interface library in AOS-10 GW and AOS-8 Controller/Mobility…

CVE-2025-37143Medium

arbitrary file download vulnerability exists in the web-based management interface of AOS-10 GW and AOS-8 Controller/Mobility…

CVE-2025-37142Medium

Arbitrary file download vulnerabilities exist in the CLI binary of AOS-10 GW and AOS-8 Controller/Mobility Conductor operating…

CVE-2025-37141Medium

Arbitrary file download vulnerabilities exist in the CLI binary of AOS-10 GW and AOS-8 Controller/Mobility Conductor operating…

CVE-2025-37140Medium

Arbitrary file download vulnerabilities exist in the CLI binary of AOS-10 GW and AOS-8 Controller/Mobility Conductor operating…

CVE-2025-37138Medium

authenticated command injection vulnerability exists in the command line interface binary of AOS-10 GW and AOS-8…

CVE-2025-37137Medium

Arbitrary file deletion vulnerabilities have been identified in the command-line interface of an AOS-8 Controller/Mobility…

CVE-2025-37136Medium

Arbitrary file deletion vulnerabilities have been identified in the command-line interface of an AOS-8 Controller/Mobility…

CVE-2025-37135Medium

Arbitrary file deletion vulnerabilities have been identified in the command-line interface of an AOS-8 Controller/Mobility…

CVE-2025-37134High

authenticated command injection vulnerability exists in the CLI binary of an AOS-8 Controller/Mobility Conductor operating…

CVE-2025-37133High

authenticated command injection vulnerability exists in the CLI binary of an AOS-8 Controller/Mobility Conductor operating…

CVE-2025-37132High

arbitrary file write vulnerability exists in the web-based management interface of both the AOS-10 GW and AOS-8…

CVE-2025-37146High

Unauthorized Filesystem Operations in System Firmware allow Authenticated Remote Code Execution

CVE-2025-31365Medium

Improper Control of Generation of Code ('Code Injection') vulnerability [CWE-94] in FortiClientMac 7.4.0 through 7.4.3, 7.2.1 through 7.2.8 may allow an unauthenticated attacker to execute arbitrary code on the victim's host via tricking the user into visiting a malicious website

CVE-2025-25252Medium

Insufficient Session Expiration vulnerability [CWE-613] in FortiOS SSL VPN 7.6.0 through 7.6.2, 7.4.0 through 7.4.6, 7.2.0 through 7.2.10, 7.0.0 through 7.0.16, 6.4 all versions may allow a remote attacker (e.g

CVE-2024-47569Medium

insertion of sensitive information into sent data vulnerability in Fortinet FortiMail 7.4.0 through 7.4.2, FortiMail 7.2.0 through 7.2.6, FortiMail 7.0 all versions, FortiManager 7.6.0 through 7.6.1, FortiManager 7.4.1 through 7.4.3, FortiManager Cloud 7.4.1 through 7.4.3, FortiNDR 7.6.0 through 7.6.1, FortiNDR 7.4.0 through 7.4.8, FortiNDR 7.2 all versions, FortiNDR 7.1 all versions, FortiNDR 7.0 all versions, FortiNDR 1.5 all versions, FortiOS 7.6.0, FortiOS 7.4.0 through 7.4.4, FortiOS 7.2.0 through 7.2.8, FortiOS 7.0.0 through 7.0.15, FortiOS 6.4.0 through 6.4.15, FortiOS 6.2 all versions, FortiOS 6.0 all versions, FortiPAM 1.3 all versions, FortiPAM 1.2 all versions, FortiPAM 1.1 all versions, FortiPAM 1.0 all versions, FortiProxy 7.4.0 through 7.4.4, FortiProxy 7.2.0 through 7.2.10, FortiProxy 7.0 all versions, FortiProxy 2.0 all versions, FortiProxy 01.02 all versions, FortiProxy 1.2 all versions, FortiProxy 01.01 all versions, FortiProxy 1.1 all versions, FortiProxy 01.00 all versions, FortiRecorder 7.2.0 through 7.2.1, FortiRecorder 7.0.0 through 7.0.4, FortiTester 7.4.0 through 7.4.2, FortiTester 7.3 all versions, FortiTester 7.2 all versions, FortiTester 7.1 all versions, FortiTester 7.0 all versions, FortiTester 4.2 all versions, FortiVoice 7.0.0 through 7.0.4, FortiVoice 6.4.0 through 6.4.9, FortiVoice 6.0.7 through 6.0.12, FortiWeb 7.6.0, FortiWeb 7.4.0 through 7.4.4, FortiWeb 7.2 all versions, FortiWeb 7.0 all versions, FortiWeb 6.4 all versions allows attacker to disclose sensitive information via specially crafted packets

CVE-2024-50571High

heap-based buffer overflow vulnerability in Fortinet FortiAnalyzer 7.6.0 through 7.6.2, FortiAnalyzer 7.4.0 through 7.4.5, FortiAnalyzer 7.2.0 through 7.2.9, FortiAnalyzer 7.0.0 through 7.0.13, FortiAnalyzer 6.4 all versions, FortiAnalyzer 6.2 all versions, FortiAnalyzer 6.0 all versions, FortiAnalyzer Cloud 7.4.1 through 7.4.5, FortiAnalyzer Cloud 7.2.1 through 7.2.9, FortiAnalyzer Cloud 7.0.1 through 7.0.13, FortiAnalyzer Cloud 6.4 all versions, FortiManager 7.6.0 through 7.6.1, FortiManager 7.4.0 through 7.4.5, FortiManager 7.2.0 through 7.2.9, FortiManager 7.0.0 through 7.0.13, FortiManager 6.4 all versions, FortiManager 6.2 all versions, FortiManager 6.0 all versions, FortiManager Cloud 7.6.2, FortiManager Cloud 7.4.1 through 7.4.5, FortiManager Cloud 7.2.1 through 7.2.9, FortiManager Cloud 7.0.1 through 7.0.13, FortiManager Cloud 6.4 all versions, FortiOS 7.6.0 through 7.6.2, FortiOS 7.4.0 through 7.4.6, FortiOS 7.2.0 through 7.2.10, FortiOS 7.0.0 through 7.0.16, FortiOS 6.4.0 through 6.4.15, FortiOS 6.2 all versions, FortiProxy 7.6.0 through 7.6.1, FortiProxy 7.4.0 through 7.4.7, FortiProxy 7.2.0 through 7.2.12, FortiProxy 7.0.0 through 7.0.19, FortiProxy 2.0 all versions, FortiProxy 01.02 all versions, FortiProxy 1.2 all versions, FortiProxy 01.01 all versions, FortiProxy 1.1 all versions, FortiProxy 01.00 all versions allows attacker to execute unauthorized code or commands via specifically crafted requests

CVE-2025-22258Medium

heap-based buffer overflow in Fortinet FortiSRA 1.5.0, 1.4.0 through 1.4.2, FortiPAM 1.5.0, 1.4.0 through 1.4.2, 1.3.0 through 1.3.1, 1.2.0, 1.1.0 through 1.1.2, 1.0.0 through 1.0.3, FortiProxy 7.6.0 through 7.6.1, 7.4.0 through 7.4.7, FortiOS 7.6.0 through 7.6.2, 7.4.0 through 7.4.6, 7.2.0 through 7.2.10, 7.0.2 through 7.0.16, FortiSwitchManager 7.2.1 through 7.2.5 allows attackers to escalate their privilege via specially crafted http requests

CVE-2025-25253High

FortiOS: Improper Validation of Certificate with Host Mismatch vulnerability [CWE-297] in FortiProxy version 7.6.1 and below, version…