January 2025
4,463 CVEs published, +27% on December 2024 and +65% on January 2024. CISA added 14 to KEV.
2025 month by month
- Critical
- 3588% of the 4,262 with a CVSS score
- Added to CISA KEV
- 1417 of this month's CVEs are in KEV, listed a median 12 days after publication
- Vendors
- 2,0965,024 products
- Top weakness
- XSSCWE-79 · 1,069 CVEs
Who drove it
Vendors by distinct CVEs this month, with how many of those CVEs are now in CISA KEV and how far each moved in the ranking.
- 1Сообщество Свободного Программного ОбеспеченияLinux, Debian Gnu/linux, OPEN5GS42323nonenew
- 2LinuxLinux, Linux Kernel2230nonenew
- 3Ооо «русбитех-астра»Astra Linux Special Edition, Astra Linux Common Edition, Astra Linux Special Edition Для «эльбрус»1998nonenew
- 4Ао "нппкт"Осон Основа Оnyx1955nonenew
- 5Ооо «ред Софт»Ред Ос19551new
- 6MicrosoftWindows Server 2022, 23h2 Edition (Server Core Installation), Windows Server 2025 (Server Core Installation), Windows Server 202518453new
- 7CanonicalUbuntu, Apport, Ubuntu Linux1344nonenew
- 8Red HatRed Hat Enterprise Linux, Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 91284nonenew
- 9IBMSterling B2B Integrator, Concert Software, Cloud Pak System1183nonenew
- 10GoogleAndroid, Google Chrome, Chrome1054nonenew
- 11ApplemacOS, iPadOS, iOS and iPadOS10291new
- 12IBM Corp.IBM Sterling B2B Integrator, IBM Concert Software, IBM Engineering Lifecycle Optimization - Publishing883nonenew
- 13OracleMySQL Server, Jd Edwards Enterpriseone Tools, Oracle Agile Plm Framework884nonenew
- 14Novell Inc.Opensuse Leap, Suse Linux Enterprise Server, Suse Linux Enterprise Server For Sap Applications774nonenew
- 15DrupalOpen Social, Node Access Rebuild Progressive, Two-factor Authentication (Tfa)7412nonenew
- 16Ао «ивк»Альт 8 Сп, Альт Сп 10732nonenew
- 17UnknownEmail Subscribers By Icegram Express, Bulk Me Now!, Dyn Business Panel661nonenew
- 18WavlinkWavlink AC3000, Wl-wn533a8 Firmware6261nonenew
- 19PackagistPhpoffice/phpspreadsheet, Phpoffice/phpexcel, Librenms/librenms5921new
- 20FortinetFortimanager, Fortios, Fortimanager Cloud5241new
- 21code-projectsPoint of Sales and Inventory Management System, Online Book Shop, Job Recruitment500nonenew
- 22GoGithub.com/mattermost/mattermost/server/v8, Github.com/t2bot/matrix-media-repo, Github.com/kubewarden/kubewarden-controller493nonenew
- 23Fortinet Inc.Fortios, Fortimanager, Fortimanager Cloud4541new
- 24MavenCom.ruoyi:ruoyi, Org.jboss.hal:hal-console, Org.hl7.fhir.publisher:org.hl7.fhir.publisher.core434nonenew
- 25WegiaWegia378nonenew
Severity
How this month's CVEs score on CVSS; 201 have no score yet. Severity is not exploitation.
- Critical358
- High1,457
- Medium2,305
- Low142
Breakouts
Vendors with at least three times their own 12-month median.
New in the top 100
Not in the top 100 in any of the 24 months before.
What kind of weakness
Weakness classes (CWE) by distinct CVEs, with how far each moved in the ranking.
- CWE-79XSS1,069
- CWE-352CSRF320
- CWE-89SQL Injection292
- CWE-862Missing Authorization288
- CWE-74Injection118
- CWE-94Code Injection116
- CWE-787Out-of-bounds Write113
- CWE-120Buffer Overflow87
- CWE-22Path Traversal82
- CWE-863Incorrect Authorization80
- CWE-476NULL Pointer Dereference76
- CWE-200Information Exposure74
- CWE-434Unrestricted File Upload72
- CWE-284Improper Access Control71
- CWE-125Out-of-bounds Read66
- CWE-78OS Command Injection61
- CWE-122Heap Buffer Overflow60
- CWE-416Use After Free60
- CWE-77Command Injection58
- CWE-770Allocation Without Limits57
Where it landed
The month's CVEs by the sector of the software they affect. A CVE that touches several sectors counts in each.
- Web & CMS Plugins1,33427% of sector-tagged CVEs
- Operating Systems79516% of sector-tagged CVEs
- Enterprise Software4339% of sector-tagged CVEs
- OSS Libraries3517% of sector-tagged CVEs
- Networking Infrastructure3377% of sector-tagged CVEs
- Databases2856% of sector-tagged CVEs
- Mobile Apps2525% of sector-tagged CVEs
- Security Products1974% of sector-tagged CVEs
- 7 smaller sectors561
- Not yet classified429
Which weakness, where
The top weakness classes against the vendors and the sectors that carried them.
The lighter the cell, the more CVEs. Point at one to read it.
| By vendor | 79XSS | 352CSRF | 89SQL Injection | 862Missing Authorization | 74Injection | 94Code Injection | 787Out-of-bounds Write | 120Buffer Overflow | 22Path Traversal | 863Incorrect Authorization |
|---|---|---|---|---|---|---|---|---|---|---|
| Сообщество Свободного Программного Обеспечения | 32 | 7 | 4 | 1 | 3 | 15 | 4 | 5 | 13 | |
| Linux | 6 | 1 | ||||||||
| Ооо «русбитех-астра» | 4 | 1 | 3 | 12 | 1 | 3 | 1 | |||
| Ао «нппкт» | 3 | 8 | 1 | 2 | ||||||
| Ооо «ред Софт» | 5 | 23 | 7 | 3 | 3 | 2 | ||||
| Microsoft | 1 | 1 | 1 | 2 | 1 | |||||
| Microsoft Corp | 4 | 1 | 2 | 1 | ||||||
| Canonical Ltd. | 8 | 3 | 1 | |||||||
| IBM | 20 | 1 | 3 | 1 | 4 | 2 | ||||
| Red Hat Inc. | 1 | 4 | 2 | 2 | ||||||
| 3 | 3 | 5 | 23 | 3 | ||||||
| Apple | 2 | 7 | 2 | 10 | 3 | 2 | 10 |