February 2025
3,940 CVEs published, −12% on January 2025 and +32% on February 2024. CISA added 27 to KEV.
2025 month by month
- Critical
- 2537% of the 3,695 with a CVSS score
- Added to CISA KEV
- 2715 of this month's CVEs are in KEV, listed a median 7 days after publication
- Vendors
- 1,5075,570 products
- Top weakness
- XSSCWE-79 · 643 CVEs
Who drove it
Vendors by distinct CVEs this month, with how many of those CVEs are now in CISA KEV and how far each moved in the ranking.
- 1LinuxLinux Kernel, Linux9100nonenew
- 2Сообщество Свободного Программного ОбеспеченияLinux, Debian Gnu/linux, Xwayland715141new
- 3CanonicalUbuntu, Ubuntu Linux3234nonenew
- 4Red HatRed Hat Enterprise Linux, Red Hat Enterprise Linux 9, Red Hat Enterprise Linux 83002nonenew
- 5Ооо «русбитех-астра»Astra Linux Special Edition, Astra Linux Common Edition, Пк Св "брест"2547nonenew
- 6Ао "нппкт"Осон Основа Оnyx1947nonenew
- 7Ооо «ред Софт»Ред Ос1575nonenew
- 8IBMEntirex, Applinx, Security Verify Access792nonenew
- 9MicrosoftWindows Server 2025 (Server Core Installation), Windows Server 2025, Windows 11 Version 24h27413new
- 10Intel10th Generation Intel Core Processor Family, 12th Generation Intel Core Processor Family, Intel Proset/wireless Wifi650nonenew
- 11UnknownPaid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content, Zarinpal Paid Download, Wp Finance640nonenew
- 12PackagistMagento/community-edition, Magento/project-community-edition, Leantime/leantime604nonenew
- 13Novell Inc.Suse Linux Enterprise Server, Suse Linux Enterprise Server For Sap Applications, Suse Linux Enterprise High Performance Computing561nonenew
- 14Ао «ивк»Альт Сп 10, Альт 8 Сп565nonenew
- 15AdobeAdobe Commerce, Adobe Commerce B2B, Commerce B2B511nonenew
- 16GoogleAndroid, Google Chrome, Chrome472nonenew
- 17npmMongosh, Better-auth, @ckeditor/ckeditor5-real-time-collaboration475nonenew
- 18PhpjabbersCinema Booking System, Hotel Booking System, Restaurant Booking System432nonenew
- 19Q-freeMaxtime439nonenew
- 20Ооо «открытая Мобильная Платформа»Ос Аврора, Аврора Центр420nonenew
- 21GoGithub.com/mattermost/mattermost/server/v8, Github.com/mayswind/ezbookkeeping, Github.com/clidey/whodb/core3571new
- 22Ао «нтц Ит Роса»Роса Хром, Rosa Virtualization 3.0, Роса Кобальт320nonenew
- 23CiscoCisco IOS XE, IOS XE, IOS302nonenew
- 24EnituretechnologyLtl Freight Quotes – Unishippers Edition, Ltl Freight Quotes – Worldwide Express Edition, Ltl Freight Quotes – Globaltranz Edition281nonenew
- 25IBM Corp.IBM Openpages With Watson, IBM Openpages, Cognos Controller281nonenew
Severity
How this month's CVEs score on CVSS; 245 have no score yet. Severity is not exploitation.
- Critical253
- High1,219
- Medium2,068
- Low155
Breakouts
Vendors with at least three times their own 12-month median.
New in the top 100
Not in the top 100 in any of the 24 months before.
What kind of weakness
Weakness classes (CWE) by distinct CVEs, with how far each moved in the ranking.
- CWE-79XSS643
- CWE-89SQL Injection209
- CWE-476NULL Pointer Dereference180
- CWE-416Use After Free147
- CWE-352CSRF144
- CWE-862Missing Authorization128
- CWE-787Out-of-bounds Write110
- CWE-401109
- CWE-22Path Traversal92
- CWE-94Code Injection91
- CWE-125Out-of-bounds Read89
- CWE-284Improper Access Control82
- CWE-20Improper Input Validation72
- CWE-362Race Condition68
- CWE-74Injection67
- CWE-200Information Exposure59
- CWE-120Buffer Overflow48
- CWE-78OS Command Injection46
- CWE-66745
- CWE-77Command Injection42
Where it landed
The month's CVEs by the sector of the software they affect. A CVE that touches several sectors counts in each.
- Operating Systems1,30430% of sector-tagged CVEs
- Web & CMS Plugins82219% of sector-tagged CVEs
- Enterprise Software4069% of sector-tagged CVEs
- OSS Libraries3478% of sector-tagged CVEs
- Hardware Firmware2115% of sector-tagged CVEs
- Networking Infrastructure2035% of sector-tagged CVEs
- 9 smaller sectors712
- Not yet classified353
Which weakness, where
The top weakness classes against the vendors and the sectors that carried them.
The lighter the cell, the more CVEs. Point at one to read it.
| By vendor | 79XSS | 89SQL Injection | 476NULL Pointer Dereference | 416Use After Free | 352CSRF | 862Missing Authorization | 787Out-of-bounds Write | 401 | 22Path Traversal | 94Code Injection |
|---|---|---|---|---|---|---|---|---|---|---|
| Linux | 154 | 109 | 26 | 94 | ||||||
| Сообщество Свободного Программного Обеспечения | 7 | 2 | 99 | 109 | 36 | 43 | 2 | 5 | ||
| Canonical Ltd. | 43 | 57 | 14 | 24 | 1 | |||||
| Red Hat Inc. | 40 | 44 | 20 | 16 | 1 | |||||
| Ооо «русбитех-астра» | 2 | 1 | 32 | 46 | 26 | 6 | 1 | |||
| Ао «нппкт» | 1 | 23 | 39 | 15 | 1 | |||||
| Ооо «ред Софт» | 7 | 2 | 16 | 22 | 15 | 4 | 1 | 1 | ||
| IBM | 14 | 4 | 5 | 1 | ||||||
| Microsoft Corp | 12 | |||||||||
| Microsoft | 8 | 1 | ||||||||
| Intel Corp. | 2 | 1 | 2 | |||||||
| Packagist | 21 | 2 | 1 | 1 | 2 | 1 |