CVE Tools
Track your stack

September 2025

4,664 CVEs published, +20% on August 2025 and +80% on September 2024. CISA added 16 to KEV.

2025 month by month

2025, month by month. Point at another month to read it.
2025: CVEs published per month
YearJanFebMarAprMayJunJulAugSepOctNovDecYear total
2025January 2025: 4,463 CVEs14 added to CISA KEVFebruary 2025: 3,940 CVEs27 added to CISA KEVMarch 2025: 4,251 CVEs32 added to CISA KEVApril 2025: 4,282 CVEs15 added to CISA KEVMay 2025: 4,361 CVEs24 added to CISA KEVJune 2025: 3,875 CVEs20 added to CISA KEVJuly 2025: 4,086 CVEs20 added to CISA KEVAugust 2025: 3,871 CVEs15 added to CISA KEVSeptember 2025: 4,664 CVEs16 added to CISA KEVOctober 2025: 4,544 CVEs31 added to CISA KEVNovember 2025: 3,194 CVEs11 added to CISA KEVDecember 2025: 5,771 CVEs20 added to CISA KEV51,302+23%
Critical
2786% of the 4,293 with a CVSS score
Added to CISA KEV
1614 of this month's CVEs are in KEV, listed a median 15.5 days after publication
Vendors
1,6944,959 products
Top weakness
XSSCWE-79 · 696 CVEs

Who drove it

Vendors by distinct CVEs this month, with how many of those CVEs are now in CISA KEV and how far each moved in the ranking.

  1. 1LinuxLinux Kernel, Linux7370nonenew
  2. 2Сообщество Свободного Программного ОбеспеченияLinux, Debian Gnu/linux, Pytorch5409nonenew
  3. 3Ооо «русбитех-астра»Astra Linux Special Edition, Astra Linux Common Edition, Parsec28862new
  4. 4Red HatRed Hat Enterprise Linux, Red Hat Enterprise Linux 9, Red Hat Enterprise Linux 102674nonenew
  5. 5CanonicalUbuntu1981nonenew
  6. 6GoogleAndroid, Google Chrome, Chrome18694new
  7. 7Ао «ивк»Альт Сп 10, Альт 8 Сп17421new
  8. 8DebianDebian Linux13901new
  9. 9Ооо «ред Софт»Ред Ос, Ред База Данных13372new
  10. 10Ао «сбертех»Platform V Sberlinux OS Server12601new
  11. 11MicrosoftWindows Server 2025, Windows Server 2025 (Server Core Installation), Windows Server 2022, 23h2 Edition (Server Core Installation)10951new
  12. 12npmFlowise, @anthropic-ai/claude-code, Express-xss-sanitizer10012nonenew
  13. 13MavenCom.liferay.portal:release.portal.bom, Com.liferay.portal:com.liferay.portal.impl, Org.jenkins-ci.main:jenkins-core906nonenew
  14. 14ApplemacOS, iOS and iPadOS, iPhone OS836nonenew
  15. 15CampcodesOnline Learning Management System, Grocery Sales and Inventory System, Computer Sales and Inventory System720nonenew
  16. 16SourcecodesterPet Grooming Management Software, Online Student File Management System, Online Exam Form Submission690nonenew
  17. 17PyPIPicklescan, Ethyca-fides, Ml-logger574nonenew
  18. 18GoD7y.io/dragonfly/v2, Github.com/dragonflyoss/dragonfly, Github.com/mattermost/mattermost/server/v85511nonenew
  19. 19ItsourcecodePos Point of Sale System, Student Information Management System, Open Source Job Portal550nonenew
  20. 20LiferayDxp, Digital Experience Platform, Portal500nonenew
  21. 21PhpgurukulOnline Fire Reporting System, Beauty Parlour Management System, Small Crm499nonenew
  22. 22Ао "нппкт"Осон Основа Оnyx4761new
  23. 23TendaG3 Firmware, F3 Firmware, AC18 Firmware452nonenew
  24. 24IBMConcert, Concert Software, Watsonx.data440nonenew
  25. 25VasionVirtual Appliance Application, Virtual Appliance Host, Print Virtual Appliance Host4119nonenew

Severity

How this month's CVEs score on CVSS; 371 have no score yet. Severity is not exploitation.

  • Critical2786%
  • High1,42233%
  • Medium2,40356%
  • Low1904%

New in the top 100

Not in the top 100 in any of the 24 months before.

  1. Vasion41#25
  2. Apprain32#31
  3. Portabilis26#40
  4. Akinsoft21#47
  5. Wavlink19#50
  6. Wavlink Technology Ltd.16#55
  7. Dragonflyoss11#64
  8. Jeecg11#65
  9. Bmc10#68
  10. Copeland Lp10#69

What kind of weakness

Weakness classes (CWE) by distinct CVEs, with how far each moved in the ranking.

  1. CWE-79XSS696new
  2. CWE-89SQL Injection358new
  3. CWE-74Injection292new
  4. CWE-862Missing Authorization205new
  5. CWE-476NULL Pointer Dereference179new
  6. CWE-352CSRF160new
  7. CWE-401155new
  8. CWE-416Use After Free137new
  9. CWE-94Code Injection134new
  10. CWE-284Improper Access Control121new
  11. CWE-125Out-of-bounds Read119new
  12. CWE-787Out-of-bounds Write96new
  13. CWE-77Command Injection89new
  14. CWE-78OS Command Injection83new
  15. CWE-22Path Traversal77new
  16. CWE-434Unrestricted File Upload75new
  17. CWE-20Improper Input Validation71new
  18. CWE-918SSRF71new
  19. CWE-200Information Exposure67new
  20. CWE-26663new

Where it landed

The month's CVEs by the sector of the software they affect. A CVE that touches several sectors counts in each.

Area is CVEs this month. Point at a sector to read it.

Which weakness, where

The top weakness classes against the vendors and the sectors that carried them.

Snapshot v1, computed Jun 11, 2026, 06:05 UTC. MethodologyAll months on record

Nuclei coverage and the detection gap are held back while the template mirror is repaired.

We use analytics cookies to see which pages and articles actually help people. Decline and none of them run — the site works the same. What we store