CVE Tools
Track your stack

July 2025

4,086 CVEs published, +5% on June 2025 and +26% on July 2024. CISA added 20 to KEV.

2025 month by month

2025, month by month. Point at another month to read it.
2025: CVEs published per month
YearJanFebMarAprMayJunJulAugSepOctNovDecYear total
2025January 2025: 4,463 CVEs14 added to CISA KEVFebruary 2025: 3,940 CVEs27 added to CISA KEVMarch 2025: 4,251 CVEs32 added to CISA KEVApril 2025: 4,282 CVEs15 added to CISA KEVMay 2025: 4,361 CVEs24 added to CISA KEVJune 2025: 3,875 CVEs20 added to CISA KEVJuly 2025: 4,086 CVEs20 added to CISA KEVAugust 2025: 3,871 CVEs15 added to CISA KEVSeptember 2025: 4,664 CVEs16 added to CISA KEVOctober 2025: 4,544 CVEs31 added to CISA KEVNovember 2025: 3,194 CVEs11 added to CISA KEVDecember 2025: 5,771 CVEs20 added to CISA KEV51,302+23%
Critical
36810% of the 3,710 with a CVSS score
Added to CISA KEV
2014 of this month's CVEs are in KEV, listed a median 14 days after publication
Vendors
1,4515,533 products
Top weakness
XSSCWE-79 · 483 CVEs

Who drove it

Vendors by distinct CVEs this month, with how many of those CVEs are now in CISA KEV and how far each moved in the ranking.

  1. 1Сообщество Свободного Программного ОбеспеченияLinux, Debian Gnu/linux, Gpac536181new
  2. 2LinuxLinux, Linux Kernel40101new
  3. 3Ооо «ред Софт»Ред Ос39563new
  4. 4Ооо «русбитех-астра»Astra Linux Special Edition, Astra Linux Common Edition37283new
  5. 5Red HatRed Hat Enterprise Linux, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 92942nonenew
  6. 6Ао "нппкт"Осон Основа Оnyx23663new
  7. 7Ао «сбертех»Platform V Sberlinux OS Server22832new
  8. 8DebianDebian Linux, Dpkg20103new
  9. 9Ао «ивк»Альт 8 Сп, Альт Сп 1017882new
  10. 10code-projectsExam Form Submission, Online Appointment Booking System, Church Donation System1540nonenew
  11. 11MicrosoftWindows Server 2025 (Server Core Installation), Windows Server 2025, Windows Server 2022 23h214954new
  12. 12CanonicalUbuntu, Juju, Juju\/utils1182nonenew
  13. 13CadsofttoolsCadimage910nonenew
  14. 14IrfanviewIrfanview910nonenew
  15. 15PhpgurukulVehicle Parking Management System, Apartment Visitors Management System, Online Fire Reporting System860nonenew
  16. 16ApplemacOS, iPadOS, iPhone OS85253new
  17. 17OracleMySQL Server, MySQL, E-business Suite851nonenew
  18. 18AdobeAdobe Framemaker, Framemaker, Coldfusion733nonenew
  19. 19MavenOrg.glassfish.main.admingui:console-common, Org.keycloak:keycloak-services, Org.jenkins-ci.plugins:applitools-eyes696nonenew
  20. 20Novell Inc.Opensuse Leap, Suse Linux Enterprise Server, Suse Linux Enterprise Server For Sap Applications682nonenew
  21. 21CampcodesEmployee Management System, Payroll Management System, Courier Management System650nonenew
  22. 22TendaFH451 Firmware, FH451, O3V2630nonenew
  23. 23npm@haxtheweb/haxcms-nodejs, Directus, @finos/git-proxy5941new
  24. 24Shenzhen Tenda Technology Co., Ltd.Tenda FH451, Tenda O3, Tenda FH1201570nonenew
  25. 25IBMDB2, Openpages With Watson, Cognos Analytics Mobile540nonenew

Severity

How this month's CVEs score on CVSS; 376 have no score yet. Severity is not exploitation.

  • Critical36810%
  • High1,45539%
  • Medium1,70846%
  • Low1795%

Breakouts

Vendors with at least three times their own 12-month median.

  1. Debian20140.2×
  2. Phpgurukul8621.5×
  3. Irfanview9118.2×
  4. code-projects15414.7×
  5. Campcodes6510.8×
  6. Fabian364.5×

New in the top 100

Not in the top 100 in any of the 24 months before.

  1. Cadsofttools91#13
  2. Irfanview91#14
  3. Irfan Skiljan42#27
  4. Anisha37#29
  5. Labredescefetrj31#36
  6. Wegia31#37
  7. Wikimedia Foundation30#39
  8. Samsung Electronics25#47
  9. Carmelo24#50
  10. Huawei Technologies Co., Ltd.20#57

What kind of weakness

Weakness classes (CWE) by distinct CVEs, with how far each moved in the ranking.

  1. CWE-79XSS483new
  2. CWE-89SQL Injection425new
  3. CWE-74Injection304new
  4. CWE-119Memory Buffer Bounds196new
  5. CWE-94Code Injection140new
  6. CWE-476NULL Pointer Dereference131new
  7. CWE-121116new
  8. CWE-22Path Traversal116new
  9. CWE-434Unrestricted File Upload113new
  10. CWE-125Out-of-bounds Read111new
  11. CWE-284Improper Access Control110new
  12. CWE-862Missing Authorization106new
  13. CWE-78OS Command Injection98new
  14. CWE-787Out-of-bounds Write93new
  15. CWE-416Use After Free91new
  16. CWE-20Improper Input Validation77new
  17. CWE-122Heap Buffer Overflow72new
  18. CWE-120Buffer Overflow66new
  19. CWE-200Information Exposure63new
  20. CWE-352CSRF62new

Where it landed

The month's CVEs by the sector of the software they affect. A CVE that touches several sectors counts in each.

Area is CVEs this month. Point at a sector to read it.

Which weakness, where

The top weakness classes against the vendors and the sectors that carried them.

Snapshot v1, computed Jun 11, 2026, 06:05 UTC. MethodologyAll months on record

Nuclei coverage and the detection gap are held back while the template mirror is repaired.

We use analytics cookies to see which pages and articles actually help people. Decline and none of them run — the site works the same. What we store