November 2025
3,194 CVEs published, −30% on October 2025 and −23% on November 2024. CISA added 11 to KEV.
2025 month by month
- Critical
- 2699% of the 2,937 with a CVSS score
- Added to CISA KEV
- 1110 of this month's CVEs are in KEV, listed a median 9 days after publication
- Vendors
- 1,4204,050 products
- Top weakness
- XSSCWE-79 · 432 CVEs
Who drove it
Vendors by distinct CVEs this month, with how many of those CVEs are now in CISA KEV and how far each moved in the ranking.
- 1Сообщество Свободного Программного ОбеспеченияLinux, Debian Gnu/linux, Wpe Webkit1735nonenew
- 2Ооо «русбитех-астра»Astra Linux Special Edition, Astra Linux Common Edition, Пк "ald Pro"16471new
- 3Ооо «ред Софт»Ред Ос, Ред База Данных11441new
- 4ApplemacOS, iOS and iPadOS, iPadOS11301new
- 5MicrosoftWindows 11 24h2, Windows 11 Version 24h2, Windows 11 25h210953new
- 6LinuxLinux, Linux Kernel1040nonenew
- 7Red HatRed Hat Enterprise Linux, Red Hat Enterprise Linux 9, Red Hat Enterprise Linux 10842nonenew
- 8GoogleChrome, Google Chrome, Android7701new
- 9GoGithub.com/mattermost/mattermost/server/v8, Github.com/mattermost/mattermost-server, Kubevirt.io/kubevirt705nonenew
- 10npmAstro, Directus, Node-forge5781new
- 11Ао "нппкт"Осон Основа Оnyx5411new
- 12Ао «ивк»Альт 8 Сп, Альт Сп 10481nonenew
- 13PyPIPgadmin4, Trytond, Vllm474nonenew
- 14IBMDB2, Concert, Cloud Pak For Business Automation403nonenew
- 15PackagistMantisbt/mantisbt, Phppgadmin/phppgadmin, Drupal/core391nonenew
- 16code-projectsStudent Information System, Responsive Hotel Site, Simple Online Hotel Reservation System380nonenew
- 17CanonicalUbuntu342nonenew
- 18SourcecodesterTrain Station Ticketing System, Best House Rental Management System, Baby Care System340nonenew
- 19Ао «сбертех»Platform V Sberlinux OS Server, Субд «platform V Pangolin Db»341nonenew
- 20ItsourcecodeInventory Management System, Web-based Internet Laboratory Management System, Covid Tracking System320nonenew
- 21MavenOrg.geoserver:gs-wms, Org.geoserver.web:gs-web-app, Lsfusion.platform:web-client3021new
- 22PhpgurukulStudent Record System, Online Shopping Portal, Complaint Management System301nonenew
- 23AdobeFormat Plugins, Adobe Format Plugins, Illustrator On Ipad290nonenew
- 24FabianStudent Information System, Responsive Hotel Site, Simple Cafe Ordering System290nonenew
- 25DellControlvault3 Plus, Controlvault3, Cloudlink283nonenew
Severity
How this month's CVEs score on CVSS; 257 have no score yet. Severity is not exploitation.
- Critical269
- High966
- Medium1,585
- Low117
New in the top 100
Not in the top 100 in any of the 24 months before.
What kind of weakness
Weakness classes (CWE) by distinct CVEs, with how far each moved in the ranking.
- CWE-79XSS432
- CWE-89SQL Injection262
- CWE-862Missing Authorization208
- CWE-74Injection154
- CWE-284Improper Access Control110
- CWE-787Out-of-bounds Write88
- CWE-200Information Exposure86
- CWE-434Unrestricted File Upload82
- CWE-352CSRF81
- CWE-22Path Traversal77
- CWE-94Code Injection67
- CWE-12165
- CWE-20Improper Input Validation58
- CWE-78OS Command Injection56
- CWE-125Out-of-bounds Read55
- CWE-639Auth Bypass via User Key53
- CWE-306Missing Auth for Critical Function52
- CWE-416Use After Free50
- CWE-9847
- CWE-119Memory Buffer Bounds44
Where it landed
The month's CVEs by the sector of the software they affect. A CVE that touches several sectors counts in each.
- Web & CMS Plugins79421% of sector-tagged CVEs
- Enterprise Software53514% of sector-tagged CVEs
- Operating Systems50113% of sector-tagged CVEs
- OSS Libraries36910% of sector-tagged CVEs
- Mobile Apps2356% of sector-tagged CVEs
- Hardware Firmware2055% of sector-tagged CVEs
- Networking Infrastructure1775% of sector-tagged CVEs
- ICS / OT / IoT1584% of sector-tagged CVEs
- 7 smaller sectors567
- Not yet classified266
Which weakness, where
The top weakness classes against the vendors and the sectors that carried them.
The lighter the cell, the more CVEs. Point at one to read it.
| By vendor | 79XSS | 89SQL Injection | 862Missing Authorization | 74Injection | 284Improper Access Control | 787Out-of-bounds Write | 200Information Exposure | 352CSRF | 434Unrestricted File Upload | 22Path Traversal |
|---|---|---|---|---|---|---|---|---|---|---|
| Сообщество Свободного Программного Обеспечения | 3 | 1 | 1 | 5 | 1 | |||||
| Ооо «русбитех-астра» | 2 | 12 | 1 | |||||||
| Ооо «ред Софт» | 1 | 2 | 2 | 1 | 4 | 1 | 3 | |||
| Apple | 2 | 22 | 7 | 11 | 2 | |||||
| Microsoft Corp | 3 | 1 | 1 | 4 | 4 | 2 | 2 | |||
| Linux | ||||||||||
| 1 | 9 | |||||||||
| Microsoft | 3 | 1 | 1 | 4 | 1 | 2 | 3 | |||
| Go | 2 | 3 | 1 | 4 | 5 | |||||
| Google Inc | 1 | 7 | ||||||||
| Red Hat Inc. | ||||||||||
| npm | 9 | 3 | 2 |
In the news
The CVEs security news mentioned most in November 2025.
- CVE-2025-12101Cross-Site Scripting (XSS)18.8
- CVE-2025-5777NetScaler ADC and NetScaler Gateway - Insufficient input validation leading to memory overread17.5
- CVE-2025-64446A relative path traversal vulnerability in Fortinet FortiWeb 8.0.0 through 8.0.1, FortiWeb 7.6.0 through 7.6.4, FortiWeb 7.4.0 through 7.4.9, FortiWeb 7.2.0 through 7.2.11, FortiWeb 7.0.0 through 7...19.8