April 2025
4,282 CVEs published, +1% on March 2025 and +14% on April 2024. CISA added 15 to KEV.
2025 month by month
- Critical
- 3308% of the 4,055 with a CVSS score
- Added to CISA KEV
- 1516 of this month's CVEs are in KEV, listed a median 5 days after publication
- Vendors
- 2,0105,306 products
- Top weakness
- XSSCWE-79 · 796 CVEs
Who drove it
Vendors by distinct CVEs this month, with how many of those CVEs are now in CISA KEV and how far each moved in the ranking.
- 1Сообщество Свободного Программного ОбеспеченияLinux, Debian Gnu/linux, Xwiki Platform390162new
- 2Ооо «русбитех-астра»Astra Linux Special Edition, Astra Linux Common Edition, Пк "ald Pro"28341new
- 3LinuxLinux, Linux Kernel2800nonenew
- 4Ооо «ред Софт»Ред Ос23971new
- 5Ао "нппкт"Осон Основа Оnyx22251new
- 6MicrosoftWindows Server 2025, Windows Server 2025 (Server Core Installation), Windows Server 202214621new
- 7Red HatRed Hat Enterprise Linux, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 91303nonenew
- 8Ао «сбертех»Platform V Sberlinux OS Server1222nonenew
- 9Ао «ивк»Альт Сп 10, Альт 8 Сп1043nonenew
- 10CanonicalUbuntu, Mysql-k8s-operator, Ubuntu Linux950nonenew
- 11PhpgurukulMen Salon Management System, Covid19 Testing Management System, Park Ticketing Management System835nonenew
- 12SiemensTelecontrol Server Basic, Sentron 7kt PAC1260, Sentron 7kt PAC1260 Data Manager818nonenew
- 13OracleMySQL Server, MySQL Cluster, E-business Suite731nonenew
- 14code-projectsPatient Record Management System, Online Restaurant Management System, Blood Bank Management System630nonenew
- 15PackagistMoodle/moodle, Yeswiki/yeswiki, Shopware/platform5982new
- 16GoGithub.com/mattermost/mattermost/server/v8, Github.com/rancher/rancher, Github.com/osrg/gobgp/v3567nonenew
- 17MavenOrg.keycloak:keycloak-services, Org.opencms:opencms-core, Org.elasticsearch:elasticsearch5610nonenew
- 18AdobeColdfusion, Framemaker, Adobe Framemaker524nonenew
- 19Novell Inc.Suse Linux Enterprise Server, Suse Linux Enterprise Server For Sap Applications, Opensuse Leap522nonenew
- 20npmTarteaucitronjs, React-router, Mathlive472nonenew
- 21TotolinkA810R Firmware, A810R, A3100R4711nonenew
- 22IBMAspera Console, Txseries For Multiplatforms, Infosphere Information Server361nonenew
- 23PyPIVllm, Picklescan, Langflow36111new
- 24SourcecodesterWeb-based Pharmacy Product Management System, Online Eyewear Shop, Apartment Visitor Management System350nonenew
- 25QualcommWCD9380 Firmware, Fastconnect 6900 Firmware, Fastconnect 7800 Firmware340nonenew
Severity
How this month's CVEs score on CVSS; 227 have no score yet. Severity is not exploitation.
- Critical330
- High1,564
- Medium1,962
- Low199
Breakouts
Vendors with at least three times their own 12-month median.
New in the top 100
Not in the top 100 in any of the 24 months before.
What kind of weakness
Weakness classes (CWE) by distinct CVEs, with how far each moved in the ranking.
- CWE-79XSS796
- CWE-89SQL Injection392
- CWE-352CSRF250
- CWE-862Missing Authorization241
- CWE-74Injection202
- CWE-284Improper Access Control139
- CWE-94Code Injection129
- CWE-119Memory Buffer Bounds99
- CWE-476NULL Pointer Dereference94
- CWE-787Out-of-bounds Write91
- CWE-125Out-of-bounds Read90
- CWE-22Path Traversal88
- CWE-120Buffer Overflow85
- CWE-416Use After Free82
- CWE-20Improper Input Validation67
- CWE-434Unrestricted File Upload66
- CWE-502Deserialization65
- CWE-9864
- CWE-918SSRF57
- CWE-200Information Exposure56
Where it landed
The month's CVEs by the sector of the software they affect. A CVE that touches several sectors counts in each.
Which weakness, where
The top weakness classes against the vendors and the sectors that carried them.
The lighter the cell, the more CVEs. Point at one to read it.
| By vendor | 79XSS | 89SQL Injection | 352CSRF | 862Missing Authorization | 74Injection | 284Improper Access Control | 94Code Injection | 119Memory Buffer Bounds | 476NULL Pointer Dereference | 787Out-of-bounds Write |
|---|---|---|---|---|---|---|---|---|---|---|
| Сообщество Свободного Программного Обеспечения | 4 | 2 | 3 | 1 | 2 | 1 | 11 | 71 | 11 | |
| Ооо «русбитех-астра» | 2 | 1 | 1 | 1 | 3 | 54 | 7 | |||
| Linux | 62 | 8 | ||||||||
| Ооо «ред Софт» | 5 | 1 | 3 | 3 | 1 | 3 | 3 | 7 | 27 | 4 |
| Ао «нппкт» | 1 | 4 | 1 | 3 | 37 | 8 | ||||
| Microsoft Corp | 1 | 8 | 1 | 2 | ||||||
| Microsoft | 1 | 1 | 7 | 2 | ||||||
| Ао «сбертех» | 3 | 30 | 5 | |||||||
| Red Hat Inc. | 2 | 4 | 23 | 5 | ||||||
| Ао «ивк» | 1 | 1 | 1 | 1 | 3 | 10 | 3 | |||
| Canonical Ltd. | 2 | 15 | 6 | |||||||
| Phpgurukul | 2 | 74 | 69 | 1 |