October 2025
4,544 CVEs published, −3% on September 2025 and +24% on October 2024. CISA added 31 to KEV.
2025 month by month
- Critical
- 2887% of the 4,181 with a CVSS score
- Added to CISA KEV
- 319 of this month's CVEs are in KEV, listed a median 8 days after publication
- Vendors
- 1,4394,012 products
- Top weakness
- XSSCWE-79 · 721 CVEs
Who drove it
Vendors by distinct CVEs this month, with how many of those CVEs are now in CISA KEV and how far each moved in the ranking.
- 1LinuxLinux, Linux Kernel6511nonenew
- 2Сообщество Свободного Программного ОбеспеченияLinux, Debian Gnu/linux, Freescout5416nonenew
- 3Red HatRed Hat Enterprise Linux, Red Hat Enterprise Linux 9, Red Hat Enterprise Linux 103370nonenew
- 4CanonicalUbuntu, Lxd2010nonenew
- 5Ооо «русбитех-астра»Astra Linux Special Edition, Astra Linux Common Edition1908nonenew
- 6MicrosoftWindows Server 2025, Windows Server 2025 (Server Core Installation), Windows 11 24h2183113new
- 7MavenCom.liferay.portal:release.portal.bom, Com.liferay.portal:com.liferay.portal.impl, Com.liferay:com.liferay.change.tracking.web1035nonenew
- 8Ооо «ред Софт»Ред Ос1007nonenew
- 9NagiosNagios Xi, Xi, Log Server999nonenew
- 10OracleMySQL Server, Oracle Vm VirtualBox, Zfs Storage Appliance Kit7853new
- 11Ао «сбертех»Platform V Sberlinux OS Server781nonenew
- 12code-projectsSimple Food Ordering System, E-commerce Website, Client Details System761nonenew
- 13Nagios Enterprises LlcNagios Xi, Nagios Log Server, Nagios Fusion7310nonenew
- 14PyPIKeras, Bbot, Fastmcp7010nonenew
- 15PackagistMoodle/moodle, Bagisto/bagisto, Magento/project-community-edition641nonenew
- 16Ао «ивк»Альт Сп 10, Альт 8 Сп, Ивк Кольчуга-к (Лкнв.466217.002)645nonenew
- 17FabianSimple Food Ordering System, E-commerce Website, Client Details System631nonenew
- 18GoGithub.com/mattermost/mattermost/server/v8, Github.com/canonical/lxd, Github.com/mattermost/mattermost-server604nonenew
- 19npmFlowise, @strapi/core, @anthropic-ai/claude-code554nonenew
- 20TendaCH22 Firmware, CH22, AC18 Firmware552nonenew
- 21DlinkDir-600l Firmware, Dir-600l, Nuclias Connect454nonenew
- 22Shenzhen Tenda Technology Co., Ltd.Tenda CH22, Tenda AC18, AC6452nonenew
- 23F5BIG-IP, BIG-IP Application Security Manager, BIG-IP Advanced Web Application Firewall4401new
- 24QnapQuts Hero, Qts, Qsync Central440nonenew
- 25AndsoftE-tms409nonenew
Severity
How this month's CVEs score on CVSS; 363 have no score yet. Severity is not exploitation.
- Critical288
- High1,462
- Medium2,269
- Low162
New in the top 100
Not in the top 100 in any of the 24 months before.
What kind of weakness
Weakness classes (CWE) by distinct CVEs, with how far each moved in the ranking.
- CWE-79XSS721
- CWE-89SQL Injection309
- CWE-862Missing Authorization175
- CWE-74Injection173
- CWE-476NULL Pointer Dereference144
- CWE-284Improper Access Control143
- CWE-416Use After Free132
- CWE-121113
- CWE-200Information Exposure107
- CWE-94Code Injection102
- CWE-78OS Command Injection99
- CWE-352CSRF98
- CWE-22Path Traversal96
- CWE-40191
- CWE-119Memory Buffer Bounds89
- CWE-125Out-of-bounds Read89
- CWE-787Out-of-bounds Write89
- CWE-434Unrestricted File Upload72
- CWE-502Deserialization70
- CWE-400Resource Consumption60
Where it landed
The month's CVEs by the sector of the software they affect. A CVE that touches several sectors counts in each.
- Operating Systems1,11622% of sector-tagged CVEs
- Web & CMS Plugins93918% of sector-tagged CVEs
- Enterprise Software69113% of sector-tagged CVEs
- OSS Libraries54311% of sector-tagged CVEs
- Networking Infrastructure3306% of sector-tagged CVEs
- Security Products2355% of sector-tagged CVEs
- ICS / OT / IoT2044% of sector-tagged CVEs
- 8 smaller sectors768
- Not yet classified302
Which weakness, where
The top weakness classes against the vendors and the sectors that carried them.
The lighter the cell, the more CVEs. Point at one to read it.
| By vendor | 79XSS | 89SQL Injection | 862Missing Authorization | 74Injection | 476NULL Pointer Dereference | 284Improper Access Control | 416Use After Free | 121 | 200Information Exposure | 94Code Injection |
|---|---|---|---|---|---|---|---|---|---|---|
| Linux | 76 | 42 | ||||||||
| Сообщество Свободного Программного Обеспечения | 5 | 1 | 63 | 35 | 1 | 1 | ||||
| Red Hat Inc. | 33 | 23 | 1 | 1 | 1 | |||||
| Canonical Ltd. | 20 | 13 | ||||||||
| Ооо «русбитех-астра» | 1 | 11 | 11 | 1 | 1 | |||||
| Microsoft | 1 | 2 | 1 | 15 | 50 | 1 | 14 | |||
| Microsoft Corp | 1 | 1 | 12 | 50 | 1 | 14 | ||||
| Ооо «ред Софт» | 1 | 1 | 10 | 4 | 5 | 1 | 4 | |||
| Ао «сбертех» | 13 | 6 | ||||||||
| Maven | 24 | 3 | 10 | |||||||
| Nagios | 51 | 6 | 3 | 1 | 1 | |||||
| Oracle | 2 | 21 | 8 |
In the news
The CVEs security news mentioned most in October 2025.