Flaws added in May 2025
From Exploited flaws, HARD’s guide to the flaws being used in attacks
This article lists the flaws CISA added in May 2025. For the newest, see Exploited flaws.
In May 2025, CISA added 24 flaws to its list of vulnerabilities being used in attacks, 6 of them in things people have at home; 2 have been used by ransomware gangs. Most came from Microsoft (5), Ivanti (2) and GeoVision (2).[1]
Most let an attacker take over the product, running their own code or taking full control.
List of flaws
Every flaw CISA added in May 2025, newest first, in plain English, each with an article of its own.[2] marks the ones used in ransomware.
Show
1 added
| CVE | Flaw | Found |
|---|---|---|
CVE-2025-4632At work |
Samsung MagicINFO 9 Server. Attackers can reach parts of Samsung MagicINFO 9 Server that should be locked to them. | At work |
6 added
| CVE | Flaw | Found |
|---|---|---|
CVE-2025-4428At work |
Ivanti Endpoint Manager Mobile (EPMM). Someone who already has a way in can use Ivanti Endpoint Manager Mobile (EPMM) to run their own code. | At work |
CVE-2025-4427At work |
Ivanti Endpoint Manager Mobile (EPMM). Attackers can get into Ivanti Endpoint Manager Mobile (EPMM) without a valid password. | At work |
CVE-2025-27920At work |
Srimax Output Messenger. Attackers can read files on Srimax Output Messenger that should be out of reach. | At work |
CVE-2024-27443At work |
Synacor Zimbra Collaboration Suite (ZCS). Attackers can run code in the browser of someone using Synacor Zimbra Collaboration Suite (ZCS) and act as them. | At work |
CVE-2024-11182At work |
MDaemon Email Server. Attackers can run code in the browser of someone using MDaemon Email Server and act as them. | At work |
CVE-2023-38950At work |
ZKTeco BioTime. Attackers can read files on ZKTeco BioTime that should be out of reach from anywhere, without logging in. | At work |
2 added
| CVE | Flaw | Found |
|---|---|---|
CVE-2025-42999† Used in ransomwareAt work |
SAP NetWeaver. Attackers are using a flaw in SAP NetWeaver. | At work |
CVE-2024-12987At home |
DrayTek Vigor Routers. Attackers can run commands on DrayTek Vigor Routers. | At home |
1 added
| CVE | Flaw | Found |
|---|---|---|
CVE-2025-32756At work |
Fortinet products. Attackers can run their own code on Fortinet products from anywhere, without logging in. | At work |
5 added
| CVE | Flaw | Found |
|---|---|---|
CVE-2025-32709At home |
Microsoft Windows. Someone who already has a foothold can use Microsoft Windows to take full control of the machine. | At home |
CVE-2025-32706At home |
Microsoft Windows. Someone who already has a foothold can use Microsoft Windows to take full control of the machine. | At home |
CVE-2025-32701At home |
Microsoft Windows. Someone who already has a foothold can use Microsoft Windows to take full control of the machine. | At home |
CVE-2025-30400At home |
Microsoft Windows. Someone who already has a foothold can use Microsoft Windows to take full control of the machine. | At home |
CVE-2025-30397At home |
Microsoft Windows. Attackers can run their own code on Microsoft Windows. | At home |
1 added
| CVE | Flaw | Found |
|---|---|---|
CVE-2025-47729At work |
TeleMessage TM SGNL. Attackers can read information from TeleMessage TM SGNL that should be private. | At work |
2 added
| CVE | Flaw | Found |
|---|---|---|
CVE-2024-6047At work |
GeoVision Multiple Devices. Attackers can run commands on GeoVision Multiple Devices from anywhere, without logging in. | At work |
CVE-2024-11120At work |
GeoVision Multiple Devices. Attackers can run commands on GeoVision Multiple Devices from anywhere, without logging in. | At work |
1 added
| CVE | Flaw | Found |
|---|---|---|
CVE-2025-27363At work |
FreeType. Attackers can run their own code on FreeType. | At work |
1 added
| CVE | Flaw | Found |
|---|---|---|
CVE-2025-3248† Used in ransomwareAt work |
Langflow. Attackers can run their own code on Langflow from anywhere, without logging in. | At work |
2 added
| CVE | Flaw | Found |
|---|---|---|
CVE-2025-34028At work |
Commvault Command Center. Attackers can run their own code on Commvault Command Center from anywhere, without logging in. | At work |
CVE-2024-58136At work |
Yiiframework Yii. Attackers can run their own code on Yiiframework Yii. | At work |
2 added
| CVE | Flaw | Found |
|---|---|---|
CVE-2024-38475At work |
Apache HTTP Server. Attackers can run their own code on Apache HTTP Server. | At work |
CVE-2023-44221At work |
SonicWall SMA100 Appliances. Someone who already has a way in can use SonicWall SMA100 Appliances to run their own code. | At work |
Companies
The flaws were in 18 companies’ products; the most were in Microsoft’s (5).
| Company | Flaws | Ransomware |
|---|---|---|
| Microsoft | 5 | – |
| GeoVision | 2 | – |
| Ivanti | 2 | – |
| Apache | 1 | – |
| Commvault | 1 | – |
| DrayTek | 1 | – |
| Fortinet | 1 | – |
| FreeType | 1 | – |
| Langflow | 1 | 1 |
| MDaemon | 1 | – |
| Samsung | 1 | – |
| SAP | 1 | 1 |
| SonicWall | 1 | – |
| Srimax | 1 | – |
| Synacor | 1 | – |
| 3 others | 3 |
Other months
Every month since CISA started the list; May 2025 is outlined.
| Year | Jan | Feb | Mar | Apr | May | Jun | Jul | Aug | Sep | Oct | Nov | Dec | Total |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 2026 | 17 | 28 | 26 | 31 | 21 | 23 | 26 | 31 | 43 | 36 | 282 | ||
| 2025 | 14 | 27 | 32 | 15 | 24 | 20 | 20 | 15 | 16 | 31 | 11 | 20 | 245 |
| 2024 | 21 | 9 | 10 | 10 | 14 | 9 | 14 | 19 | 25 | 17 | 22 | 16 | 186 |
| 2023 | 5 | 14 | 18 | 17 | 19 | 24 | 16 | 8 | 19 | 18 | 18 | 11 | 187 |
| 2022 | 40 | 32 | 226 | 45 | 83 | 48 | 3 | 23 | 24 | 12 | 10 | 9 | 555 |
| 2021 | 291 | 20 | 311 |
References
- ^ Cybersecurity and Infrastructure Security Agency. “Known Exploited Vulnerabilities Catalog”. Version 2026.10.30, updated 30 Oct 2026. CISA adds a flaw when it has reliable evidence of it being used in attacks; the date is when it was added, not when the attacks began.
- ^ HARD. Plain-English summaries written from CISA’s and NVD’s text, on each flaw’s page.
See also Exploited flaws, Companies, and Search for any app or company.