CVE Tools
Track your stack

March 2025

4,251 CVEs published, +8% on February 2025 and +26% on March 2024. CISA added 32 to KEV.

2025 month by month

2025, month by month. Point at another month to read it.
2025: CVEs published per month
YearJanFebMarAprMayJunJulAugSepOctNovDecYear total
2025January 2025: 4,463 CVEs14 added to CISA KEVFebruary 2025: 3,940 CVEs27 added to CISA KEVMarch 2025: 4,251 CVEs32 added to CISA KEVApril 2025: 4,282 CVEs15 added to CISA KEVMay 2025: 4,361 CVEs24 added to CISA KEVJune 2025: 3,875 CVEs20 added to CISA KEVJuly 2025: 4,086 CVEs20 added to CISA KEVAugust 2025: 3,871 CVEs15 added to CISA KEVSeptember 2025: 4,664 CVEs16 added to CISA KEVOctober 2025: 4,544 CVEs31 added to CISA KEVNovember 2025: 3,194 CVEs11 added to CISA KEVDecember 2025: 5,771 CVEs20 added to CISA KEV51,302+23%
Critical
42011% of the 3,966 with a CVSS score
Added to CISA KEV
3226 of this month's CVEs are in KEV, listed a median 4 days after publication
Vendors
1,9504,670 products
Top weakness
XSSCWE-79 · 854 CVEs

Who drove it

Vendors by distinct CVEs this month, with how many of those CVEs are now in CISA KEV and how far each moved in the ranking.

  1. 1Сообщество Свободного Программного ОбеспеченияLinux, Debian Gnu/linux, Wpe Webkit312142new
  2. 2LinuxLinux, Linux Kernel2070nonenew
  3. 3Ооо «ред Софт»Ред Ос20242new
  4. 4Ооо «русбитех-астра»Astra Linux Special Edition, Astra Linux Common Edition, Пк "ald Pro"17382new
  5. 5PyPIOpen-webui, Aim, H2O16633nonenew
  6. 6Red HatRed Hat Enterprise Linux, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 81662nonenew
  7. 7ApplemacOS, iPadOS, iOS and iPadOS159461new
  8. 8Ао "нппкт"Осон Основа Оnyx12373new
  9. 9Ао «сбертех»Platform V Sberlinux OS Server10801new
  10. 10Novell Inc.Suse Linux Enterprise Server, Suse Linux Enterprise Server For Sap Applications, Opensuse Leap1022nonenew
  11. 11PhpgurukulBank Locker Management System, Art Gallery Management System, Old Age Home Management System810nonenew
  12. 12CanonicalUbuntu, Accountsservice, Linux-bluefield802nonenew
  13. 13UnknownGdpr Cookie Compliance, Url Shortener | Conversion Tracking | Ab Testing | Woocommerce, Product Labels For Woocommerce (Sale Badges)761nonenew
  14. 14MicrosoftWindows Server 2025, Windows Server 2022, 23h2 Edition (Server Core Installation), Windows Server 20227018new
  15. 15MavenAi.h2o:h2o-core, Io.github.robothy:local-s3-rest, Org.jenkins-ci.main:jenkins-core6481new
  16. 16PackagistDrupal/ai, Drupal/core, Shopxo/shopxo625nonenew
  17. 17Ао «ивк»Альт Сп 10, Альт 8 Сп6281new
  18. 18GoGithub.com/mattermost/mattermost/server/v8, Github.com/ollama/ollama, K8s.io/ingress-nginx605nonenew
  19. 19npmDirectus, Open-webui, Flowise5271new
  20. 20PrinterlogicVasion Print, Virtual Appliance4936nonenew
  21. 21TendaFH1202 Firmware, FH1202, RX3 Firmware4610nonenew
  22. 22FortinetFortios, Fortisandbox, Fortiweb442nonenew
  23. 23AdobeIndesign Desktop, Acrobat, Indesign430nonenew
  24. 24IBMInfosphere Information Server, Engineering Requirements Management Doors Next, Common Cryptographic Architecture393nonenew
  25. 25GoogleGoogle Chrome, Chrome, Android3521new

Severity

How this month's CVEs score on CVSS; 285 have no score yet. Severity is not exploitation.

  • Critical42011%
  • High1,46137%
  • Medium1,86547%
  • Low2206%

Breakouts

Vendors with at least three times their own 12-month median.

  1. Ао «сбертех»1089.8×
  2. Phpgurukul816.2×
  3. Openharmony264.0×
  4. Openatom264.0×
  5. Apple1593.9×
  6. Fortinet443.8×
  7. Fortinet Inc.323.6×
  8. Paloaltonetworks193.2×
  9. Novell Inc.1023.0×

New in the top 100

Not in the top 100 in any of the 24 months before.

  1. Printerlogic49#20
  2. Binary-husky21#43
  3. Open-webui20#47
  4. Openwebui19#51
  5. Applio14#63
  6. Assimp14#64
  7. Iahispano14#66
  8. Libming14#67
  9. Zframeworks14#70
  10. ZJ198314#71

What kind of weakness

Weakness classes (CWE) by distinct CVEs, with how far each moved in the ranking.

  1. CWE-79XSS854new
  2. CWE-89SQL Injection319new
  3. CWE-352CSRF236new
  4. CWE-862Missing Authorization190new
  5. CWE-74Injection183new
  6. CWE-94Code Injection143new
  7. CWE-284Improper Access Control132new
  8. CWE-787Out-of-bounds Write111new
  9. CWE-22Path Traversal103new
  10. CWE-200Information Exposure97new
  11. CWE-125Out-of-bounds Read85new
  12. CWE-119Memory Buffer Bounds78new
  13. CWE-416Use After Free78new
  14. CWE-918SSRF78new
  15. CWE-476NULL Pointer Dereference69new
  16. CWE-78OS Command Injection64new
  17. CWE-502Deserialization63new
  18. CWE-77Command Injection58new
  19. CWE-434Unrestricted File Upload54new
  20. CWE-120Buffer Overflow53new

Where it landed

The month's CVEs by the sector of the software they affect. A CVE that touches several sectors counts in each.

Area is CVEs this month. Point at a sector to read it.

Which weakness, where

The top weakness classes against the vendors and the sectors that carried them.

Snapshot v1, computed Jun 11, 2026, 06:05 UTC. MethodologyAll months on record

Nuclei coverage and the detection gap are held back while the template mirror is repaired.

We use analytics cookies to see which pages and articles actually help people. Decline and none of them run — the site works the same. What we store