Zero-day report: May 2025
CISA added 24 exploited vulnerabilities to its catalog in May 2025, 9 more than April (15). 10 were zero-days, listed within a week of going public. 2 are known to be used by ransomware. The most-hit vendor was Microsoft, with 5.
By technology
Most-hit vendors
Every flaw added in May 2025
- Samsung · MagicINFO 9 ServerSamsung MagicINFO 9 Server Path Traversal Vulnerability
- ZKTeco · BioTimeZKTeco BioTime Path Traversal Vulnerability
- MDaemon · Email ServerMDaemon Email Server Cross-Site Scripting (XSS) Vulnerability
- Synacor · Zimbra Collaboration Suite (ZCS)Synacor Zimbra Collaboration Suite (ZCS) Cross-Site Scripting (XSS) Vulnerability
- Srimax · Output MessengerSrimax Output Messenger Directory Traversal Vulnerability
- Ivanti · Endpoint Manager Mobile (EPMM)Ivanti Endpoint Manager Mobile (EPMM) Authentication Bypass Vulnerability
- Ivanti · Endpoint Manager Mobile (EPMM)Ivanti Endpoint Manager Mobile (EPMM) Code Injection Vulnerability
- DrayTek · Vigor RoutersDrayTek Vigor Routers OS Command Injection Vulnerability
- SAP · NetWeaverSAP NetWeaver Deserialization Vulnerability
- Fortinet · Multiple ProductsFortinet Multiple Products Stack-Based Buffer Overflow Vulnerability
- Microsoft · WindowsMicrosoft Windows Scripting Engine Type Confusion Vulnerability
- Microsoft · WindowsMicrosoft Windows DWM Core Library Use-After-Free Vulnerability
- Microsoft · WindowsMicrosoft Windows Common Log File System (CLFS) Driver Use-After-Free Vulnerability
- Microsoft · WindowsMicrosoft Windows Common Log File System (CLFS) Driver Heap-Based Buffer Overflow Vulnerability
- Microsoft · WindowsMicrosoft Windows Ancillary Function Driver for WinSock Use-After-Free Vulnerability
- TeleMessage · TM SGNLTeleMessage TM SGNL Hidden Functionality Vulnerability
- GeoVision · Multiple DevicesGeoVision Devices OS Command Injection Vulnerability
- GeoVision · Multiple DevicesGeoVision Devices OS Command Injection Vulnerability
- FreeType · FreeTypeFreeType Out-of-Bounds Write Vulnerability
- Langflow · LangflowLangflow Missing Authentication Vulnerability
- Yiiframework · YiiYiiframework Yii Improper Protection of Alternate Path Vulnerability
- Commvault · Command CenterCommvault Command Center Path Traversal Vulnerability
- SonicWall · SMA100 AppliancesSonicWall SMA100 Appliances OS Command Injection Vulnerability
- Apache · HTTP ServerApache HTTP Server Improper Escaping of Output Vulnerability
Source: CISA's Known Exploited Vulnerabilities catalog, by the date CISA added each flaw. Ransomware use is CISA's flag.