---
title: "Security digest: May 14, 2025"
url: https://erroneo.us/security/2025-05-14/
description: "May 14, 2025 vulnerability digest: 1 CISA KEV addition (Fortinet); 3 critical advisories (Maven, PyPI). What to patch and who can relax."
type: security-digest-day
section: "Security Digest"
date_published: 2025-05-14
date_modified: 2025-05-14
publisher: erroneo.us
author: erroneo.us Security Desk
license: All rights reserved. Quote with attribution and a link.
---

# Security digest: May 14, 2025

1 known exploited (cisa kev) addition and 3 critical advisories.

## Take stock

- Do you run any of these? Fortinet Multiple Products. They are being exploited in the wild (CISA KEV). Patch or mitigate if you do; CISA’s federal deadline is 2025-06-04.
- Maven: 3 critical advisories ( io.jenkins.plugins:oidc-provider , io.github.bonigarcia:webdrivermanager , org.apache.iotdb:iotdb-core ). Check with mvn dependency:tree -Dincludes=<groupId>:<artifactId> .
- PyPI: 1 critical advisory ( apache-iotdb ). Check with pip-audit (or: pip show <package>) .
- None of it touches your stack? Then there is nothing to do today. That is a result, not a failure to read carefully.

## Known exploited (CISA KEV)

- [CVE-2025-32756](https://erroneo.us/security/cve/CVE-2025-32756/index.md) Fortinet Multiple Products: Fortinet Multiple Products Stack-Based Buffer Overflow Vulnerability (CISA due 2025-06-04)

## Critical advisories

- [CVE-2025-47884](https://erroneo.us/security/cve/CVE-2025-47884/index.md) Jenkins OpenID Connect Provider Plugin Incorrectly Validates Crafted Build ID Tokens — Maven io.jenkins.plugins:oidc-provider < 111.v29fd614b3617 → 111.v29fd614b_3617
- [CVE-2025-4641](https://erroneo.us/security/cve/CVE-2025-4641/index.md) BoniGarcia WebDriverManager Affected By Improper Restriction of XML External Entity Reference — Maven io.github.bonigarcia:webdrivermanager >= 1.0.0, < 6.1.0 → 6.1.0
- [CVE-2024-24780](https://erroneo.us/security/cve/CVE-2024-24780/index.md) Apache IoTDB Vulnerable to Remote Code Execution — Maven org.apache.iotdb:iotdb-core >= 1.0.0, < 1.3.4 → 1.3.4; PyPI apache-iotdb >= 1.0.0, < 1.3.4 → 1.3.4

---
Source page: https://erroneo.us/security/2025-05-14/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt