CVE Tools
Track your stack

June 2025

3,875 CVEs published, −11% on May 2025 and +16% on June 2024. CISA added 20 to KEV.

2025 month by month

2025, month by month. Point at another month to read it.
2025: CVEs published per month
YearJanFebMarAprMayJunJulAugSepOctNovDecYear total
2025January 2025: 4,463 CVEs14 added to CISA KEVFebruary 2025: 3,940 CVEs27 added to CISA KEVMarch 2025: 4,251 CVEs32 added to CISA KEVApril 2025: 4,282 CVEs15 added to CISA KEVMay 2025: 4,361 CVEs24 added to CISA KEVJune 2025: 3,875 CVEs20 added to CISA KEVJuly 2025: 4,086 CVEs20 added to CISA KEVAugust 2025: 3,871 CVEs15 added to CISA KEVSeptember 2025: 4,664 CVEs16 added to CISA KEVOctober 2025: 4,544 CVEs31 added to CISA KEVNovember 2025: 3,194 CVEs11 added to CISA KEVDecember 2025: 5,771 CVEs20 added to CISA KEV51,302+23%
Critical
2938% of the 3,631 with a CVSS score
Added to CISA KEV
2018 of this month's CVEs are in KEV, listed a median 28 days after publication
Vendors
1,5965,330 products
Top weakness
XSSCWE-79 · 737 CVEs

Who drove it

Vendors by distinct CVEs this month, with how many of those CVEs are now in CISA KEV and how far each moved in the ranking.

  1. 1Сообщество Свободного Программного ОбеспеченияLinux, Debian Gnu/linux, Xwiki Platform40721nonenew
  2. 2LinuxLinux, Linux Kernel3750nonenew
  3. 3AdobeAdobe Experience Manager, Experience Manager, Adobe Acrobat Document Cloud2600nonenew
  4. 4Red HatRed Hat Enterprise Linux, Red Hat Enterprise Linux 9, Red Hat Enterprise Linux 825971new
  5. 5Ооо «ред Софт»Ред Ос154124new
  6. 6code-projectsInventory Management System, Simple Pizza Ordering System, Online Shoe Store1531nonenew
  7. 7CanonicalUbuntu, Cloud-init, Authd14531new
  8. 8Ооо «русбитех-астра»Astra Linux Special Edition, Astra Linux Common Edition, Пк "ald Pro"124102new
  9. 9PhpgurukulArt Gallery Management System, Pre-school Enrollment System, Complaint Management System1230nonenew
  10. 10Ао "нппкт"Осон Основа Оnyx113102new
  11. 11TotolinkX15, X15 Firmware, EX1200T Firmware782nonenew
  12. 12MicrosoftWindows Server 2025 (Server Core Installation), Windows Server 2025, Windows Server 20227624new
  13. 13Ао «сбертех»Platform V Sberlinux OS Server762nonenew
  14. 14FabianSimple Online Hotel Reservation System, School Fees Payment System, Simple Forum650nonenew
  15. 15Ао «ивк»Альт Сп 10, Альт 8 Сп646nonenew
  16. 16MavenOrg.geoserver.web:gs-web-app, Org.geoserver:gs-wfs, Org.apache.tomcat.embed:tomcat-embed-core589nonenew
  17. 17DebianDebian Linux, Yubiserver, Pdns5562new
  18. 18SourcecodesterBest Salon Management System, Student Result Management System, Simple Company Website520nonenew
  19. 19GoGithub.com/filebrowser/filebrowser/v2, Github.com/mattermost/mattermost/server/v8, Github.com/mattermost/mattermost-server504nonenew
  20. 20Novell Inc.Opensuse Leap, Suse Linux Enterprise Server, Suse Linux Enterprise Server For Sap Applications4961new
  21. 21IBMQradar Suite Software, Infosphere Information Server, Cloud Pak For Security483nonenew
  22. 22PyPISalt, Backend.ai, Langchain-chatchat476nonenew
  23. 23DlinkDir-619l Firmware, Dir-619l, Dir-816 Firmware447nonenew
  24. 24D-LinkDir-619l, Dir-816, Di-7300g+415nonenew
  25. 25IBM Corp.Qradar Suite Software, IBM Cloud Pak For Security, IBM Planning Analytics Local393nonenew

Severity

How this month's CVEs score on CVSS; 244 have no score yet. Severity is not exploitation.

  • Critical2938%
  • High1,28935%
  • Medium1,85151%
  • Low1985%

Breakouts

Vendors with at least three times their own 12-month median.

  1. Phpgurukul12314.5×
  2. Fabian6510.8×
  3. code-projects1539.0×
  4. Debian554.6×
  5. Adobe2604.4×
  6. Campcodes213.5×
  7. Totolink783.1×

New in the top 100

Not in the top 100 in any of the 24 months before.

  1. Carmelo22#36
  2. Drupal21#40
  3. Freefloat14#60
  4. Thembay14#61
  5. Anujk30513#62
  6. Linksys13#65
  7. Ооо «увеон»13#67
  8. Juzaweb12#69
  9. Preh Car Connect Gmbh (Joynext Gmbh)12#70
  10. Saltstack11#73

What kind of weakness

Weakness classes (CWE) by distinct CVEs, with how far each moved in the ranking.

  1. CWE-79XSS737new
  2. CWE-89SQL Injection437new
  3. CWE-74Injection345new
  4. CWE-119Memory Buffer Bounds192new
  5. CWE-352CSRF161new
  6. CWE-862Missing Authorization157new
  7. CWE-120Buffer Overflow113new
  8. CWE-22Path Traversal112new
  9. CWE-94Code Injection104new
  10. CWE-416Use After Free87new
  11. CWE-476NULL Pointer Dereference81new
  12. CWE-78OS Command Injection79new
  13. CWE-787Out-of-bounds Write77new
  14. CWE-9875new
  15. CWE-125Out-of-bounds Read73new
  16. CWE-77Command Injection71new
  17. CWE-12168new
  18. CWE-284Improper Access Control62new
  19. CWE-434Unrestricted File Upload59new
  20. CWE-20Improper Input Validation58new

Where it landed

The month's CVEs by the sector of the software they affect. A CVE that touches several sectors counts in each.

Area is CVEs this month. Point at a sector to read it.

Which weakness, where

The top weakness classes against the vendors and the sectors that carried them.

Snapshot v1, computed Jun 11, 2026, 06:05 UTC. MethodologyAll months on record

Nuclei coverage and the detection gap are held back while the template mirror is repaired.

We use analytics cookies to see which pages and articles actually help people. Decline and none of them run — the site works the same. What we store