May 2025
4,361 CVEs published, +2% on April 2025 and −20% on May 2024. CISA added 24 to KEV.
2025 month by month
- Critical
- 37610% of the 3,947 with a CVSS score
- Added to CISA KEV
- 2419 of this month's CVEs are in KEV, listed a median 6 days after publication
- Vendors
- 1,6364,304 products
- Top weakness
- XSSCWE-79 · 607 CVEs
Who drove it
Vendors by distinct CVEs this month, with how many of those CVEs are now in CISA KEV and how far each moved in the ranking.
- 1LinuxLinux Kernel, Linux5500nonenew
- 2Сообщество Свободного Программного ОбеспеченияLinux, Debian Gnu/linux, Freescout5029nonenew
- 3Ооо «ред Софт»Ред Ос2884nonenew
- 4Ооо «русбитех-астра»Astra Linux Special Edition, Astra Linux Common Edition, Пк "ald Pro"2884nonenew
- 5Ао "нппкт"Осон Основа Оnyx2404nonenew
- 6UnknownIlli Link Party!, Ekc Tournament Manager, Wp Maps2265nonenew
- 7Red HatRed Hat Enterprise Linux, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 92182nonenew
- 8CanonicalUbuntu, Ubuntu Linux, Apport2170nonenew
- 9Ао «сбертех»Platform V Sberlinux OS Server, Субд «platform V Pangolin Db»1530nonenew
- 10DebianDebian Linux, Trixie1450nonenew
- 11PhpgurukulPark Ticketing Management System, Company Visitor Management System, News Portal Project1223nonenew
- 12MicrosoftWindows Server 2025 (Server Core Installation), Windows Server 2022 23h2, Windows Server 2022, 23h2 Edition (Server Core Installation)8555new
- 13ApplemacOS, iPadOS, iOS and iPadOS795nonenew
- 14TotolinkA3002R Firmware, A3002R, A3002RU6812nonenew
- 15CampcodesSales and Inventory System, Online Hospital Management System, Online Shopping Portal610nonenew
- 16Ао «ивк»Альт Сп 10, Альт 8 Сп521nonenew
- 17DlinkDi-7003g Firmware, Di-7003gv2, Dir-600l Firmware502nonenew
- 18GoGithub.com/mattermost/mattermost/server/v8, Github.com/zitadel/zitadel, Github.com/gardener/gardener5011nonenew
- 19IntelIntel Iris XE Graphics, Intel Arc Graphics, Intel Data Center Gpu Flex 170490nonenew
- 20CiscoCisco IOS XE Software, IOS XE, Cisco IOS XE481nonenew
- 21PyPIVllm, Langroid, Vyper475nonenew
- 22IBMDB2, DB2 For Linux, Unix and Windows, Concert Software451nonenew
- 23SourcecodesterStock Management System, Online Student Clearance System, Client Database Management System450nonenew
- 24D-LinkDi-7003gv2, Dir-600l, Dir-619l430nonenew
- 25PackagistMautic/core, Typo3/cms-core, Nitsan/ns-backup4251new
Severity
How this month's CVEs score on CVSS; 414 have no score yet. Severity is not exploitation.
- Critical376
- High1,372
- Medium2,025
- Low174
Breakouts
Vendors with at least three times their own 12-month median.
New in the top 100
Not in the top 100 in any of the 24 months before.
What kind of weakness
Weakness classes (CWE) by distinct CVEs, with how far each moved in the ranking.
- CWE-79XSS607
- CWE-89SQL Injection414
- CWE-74Injection310
- CWE-119Memory Buffer Bounds162
- CWE-787Out-of-bounds Write149
- CWE-476NULL Pointer Dereference144
- CWE-352CSRF143
- CWE-862Missing Authorization140
- CWE-120Buffer Overflow133
- CWE-284Improper Access Control109
- CWE-416Use After Free100
- CWE-125Out-of-bounds Read98
- CWE-77Command Injection98
- CWE-94Code Injection97
- CWE-40196
- CWE-12188
- CWE-20Improper Input Validation85
- CWE-22Path Traversal79
- CWE-502Deserialization74
- CWE-434Unrestricted File Upload72
Where it landed
The month's CVEs by the sector of the software they affect. A CVE that touches several sectors counts in each.
- Web & CMS Plugins1,00321% of sector-tagged CVEs
- Operating Systems92919% of sector-tagged CVEs
- Enterprise Software66814% of sector-tagged CVEs
- Networking Infrastructure3888% of sector-tagged CVEs
- OSS Libraries3698% of sector-tagged CVEs
- ICS / OT / IoT1804% of sector-tagged CVEs
- 9 smaller sectors909
- Not yet classified363
Which weakness, where
The top weakness classes against the vendors and the sectors that carried them.
The lighter the cell, the more CVEs. Point at one to read it.
| By vendor | 79XSS | 89SQL Injection | 74Injection | 119Memory Buffer Bounds | 787Out-of-bounds Write | 476NULL Pointer Dereference | 352CSRF | 862Missing Authorization | 120Buffer Overflow | 284Improper Access Control |
|---|---|---|---|---|---|---|---|---|---|---|
| Сообщество Свободного Программного Обеспечения | 9 | 2 | 22 | 17 | 95 | 4 | 23 | 2 | ||
| Linux | 18 | 118 | 3 | |||||||
| Ооо «русбитех-астра» | 1 | 6 | 18 | 60 | 2 | 4 | 1 | |||
| Ооо «ред Софт» | 2 | 1 | 3 | 11 | 53 | 2 | 3 | |||
| Red Hat Inc. | 1 | 3 | 6 | 44 | 4 | 1 | ||||
| Canonical Ltd. | 3 | 7 | 42 | 2 | ||||||
| Ао «нппкт» | 3 | 17 | 43 | 2 | 3 | 2 | ||||
| Ао «сбертех» | 2 | 9 | 50 | 3 | ||||||
| Debian | 8 | 32 | ||||||||
| Phpgurukul | 5 | 115 | 111 | 1 | ||||||
| Microsoft Corp | 11 | 2 | 2 | |||||||
| Microsoft | 10 | 2 | 3 |