August 2025
3,871 CVEs published, −5% on July 2025 and +28% on August 2024. CISA added 15 to KEV.
2025 month by month
- Critical
- 34310% of the 3,461 with a CVSS score
- Added to CISA KEV
- 1510 of this month's CVEs are in KEV, listed a median 4.5 days after publication
- Vendors
- 1,5295,309 products
- Top weakness
- XSSCWE-79 · 570 CVEs
Who drove it
Vendors by distinct CVEs this month, with how many of those CVEs are now in CISA KEV and how far each moved in the ranking.
- 1Сообщество Свободного Программного ОбеспеченияLinux, Debian Gnu/linux, Gpac27610nonenew
- 2Ооо «ред Софт»Ред Ос, Ред База Данных2389nonenew
- 3LinuxLinux, Linux Kernel1860nonenew
- 4Ооо «русбитех-астра»Astra Linux Special Edition, Astra Linux Common Edition1683nonenew
- 5MicrosoftWindows Server 2025 (Server Core Installation), Windows Server 2025, Windows Server 2022, 23h2 Edition (Server Core Installation)1248nonenew
- 6Ао «ивк»Альт Сп 10, Альт 8 Сп1033nonenew
- 7MavenCom.liferay.portal:release.portal.bom, Org.pytorch:executorch-android, Com.liferay.portal:release.dxp.bom8110nonenew
- 8AdobeAdobe Indesign, Indesign, Indesign Desktop7911new
- 9Red HatRed Hat Enterprise Linux, Red Hat Enterprise Linux 9, Red Hat Enterprise Linux 8792nonenew
- 10DebianDebian Linux, Devscripts771nonenew
- 11GoGithub.com/mattermost/mattermost-plugin-confluence, Github.com/mattermost/mattermost/server/v8, Github.com/mattermost/mattermost-server756nonenew
- 12PyPIPicklescan, Executorch, Apache-superset759nonenew
- 13Ао "нппкт"Осон Основа Оnyx753nonenew
- 14CanonicalUbuntu721nonenew
- 15Ао «сбертех»Platform V Sberlinux OS Server, Субд «platform V Pangolin Db»720nonenew
- 16code-projectsOnline Medicine Guide, Human Resource Integrated System, Simple Grading System540nonenew
- 17ItsourcecodeApartment Management System, Online Tour and Travel Management System, Sports Management System530nonenew
- 18HuaweiHarmonyos, Emui, Enzoh-w5611t Firmware520nonenew
- 19GoogleAndroid, Chrome, Google Chrome515nonenew
- 20npm@anthropic-ai/claude-code, Next, Flowise519nonenew
- 21LinksysRE6300 Firmware, RE6350, RE6350 Firmware500nonenew
- 22CiscoCisco Firepower Threat Defense Software, Cisco Adaptive Security Appliance (ASA) Software, Firepower Threat Defense481nonenew
- 23PortabilisI-educar, I-diario480nonenew
- 24TendaAC6 Firmware, AC20 Firmware, AC20474nonenew
- 25LiferayDxp, Digital Experience Platform, Portal462nonenew
Severity
How this month's CVEs score on CVSS; 410 have no score yet. Severity is not exploitation.
- Critical343
- High1,275
- Medium1,599
- Low244
Breakouts
Vendors with at least three times their own 12-month median.
New in the top 100
Not in the top 100 in any of the 24 months before.
What kind of weakness
Weakness classes (CWE) by distinct CVEs, with how far each moved in the ranking.
- CWE-79XSS570
- CWE-89SQL Injection323
- CWE-74Injection216
- CWE-94Code Injection190
- CWE-121151
- CWE-78OS Command Injection151
- CWE-862Missing Authorization109
- CWE-22Path Traversal107
- CWE-476NULL Pointer Dereference104
- CWE-284Improper Access Control100
- CWE-416Use After Free98
- CWE-434Unrestricted File Upload95
- CWE-119Memory Buffer Bounds93
- CWE-352CSRF88
- CWE-77Command Injection82
- CWE-125Out-of-bounds Read80
- CWE-200Information Exposure76
- CWE-787Out-of-bounds Write68
- CWE-122Heap Buffer Overflow66
- CWE-20Improper Input Validation64
Where it landed
The month's CVEs by the sector of the software they affect. A CVE that touches several sectors counts in each.
- Web & CMS Plugins88220% of sector-tagged CVEs
- Enterprise Software61714% of sector-tagged CVEs
- Operating Systems58414% of sector-tagged CVEs
- OSS Libraries49611% of sector-tagged CVEs
- Networking Infrastructure3187% of sector-tagged CVEs
- Hardware Firmware2406% of sector-tagged CVEs
- Consumer Software1854% of sector-tagged CVEs
- 8 smaller sectors671
- Not yet classified326
Which weakness, where
The top weakness classes against the vendors and the sectors that carried them.
The lighter the cell, the more CVEs. Point at one to read it.
| By vendor | 79XSS | 89SQL Injection | 74Injection | 94Code Injection | 121 | 78OS Command Injection | 862Missing Authorization | 22Path Traversal | 476NULL Pointer Dereference | 284Improper Access Control |
|---|---|---|---|---|---|---|---|---|---|---|
| Сообщество Свободного Программного Обеспечения | 5 | 1 | 4 | 2 | 2 | 59 | ||||
| Ооо «ред Софт» | 4 | 1 | 2 | 4 | 44 | 1 | ||||
| Linux | 44 | |||||||||
| Ооо «русбитех-астра» | 4 | 2 | 32 | |||||||
| Microsoft | 1 | 3 | 1 | 1 | 3 | 4 | ||||
| Microsoft Corp | 1 | 3 | 1 | 1 | 3 | 3 | ||||
| Ао «ивк» | 1 | 23 | ||||||||
| Maven | 24 | 1 | 1 | 1 | 1 | |||||
| Adobe | 10 | 1 | 1 | 1 | ||||||
| Debian | 18 | |||||||||
| Go | 1 | 2 | 1 | 7 | 6 | 2 | 1 | |||
| PyPI | 2 | 1 | 5 | 2 |