February 2025
3,940 CVEs published, −12% on January 2025 and +32% on February 2024. CISA added 27 to KEV.
2025 month by month
- Critical
- 2537% of the 3,695 with a CVSS score
- Added to CISA KEV
- 2715 of this month's CVEs are in KEV, listed a median 7 days after publication
- Vendors
- 1,5075,570 products
- Top weakness
- XSSCWE-79 · 643 CVEs
Who drove it
Vendors by distinct CVEs this month, with how many of those CVEs are now in CISA KEV and how far each moved in the ranking.
- 1LinuxLinux Kernel, Linux9100nonenew
- 2Сообщество Свободного Программного ОбеспеченияLinux, Debian Gnu/linux, Xwayland715141new
- 3CanonicalUbuntu, Ubuntu Linux3234nonenew
- 4Red HatRed Hat Enterprise Linux, Red Hat Enterprise Linux 9, Red Hat Enterprise Linux 83002nonenew
- 5Ооо «русбитех-астра»Astra Linux Special Edition, Astra Linux Common Edition, Пк Св "брест"2547nonenew
- 6Ао "нппкт"Осон Основа Оnyx1947nonenew
- 7Ооо «ред Софт»Ред Ос1575nonenew
- 8IBMEntirex, Applinx, Security Verify Access792nonenew
- 9MicrosoftWindows Server 2025 (Server Core Installation), Windows Server 2025, Windows 11 Version 24h27413new
- 10Intel10th Generation Intel Core Processor Family, 12th Generation Intel Core Processor Family, Intel Proset/wireless Wifi650nonenew
- 11UnknownPaid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content, Zarinpal Paid Download, Wp Finance640nonenew
- 12PackagistMagento/community-edition, Magento/project-community-edition, Leantime/leantime604nonenew
- 13Novell Inc.Suse Linux Enterprise Server, Suse Linux Enterprise Server For Sap Applications, Suse Linux Enterprise High Performance Computing561nonenew
- 14Ао «ивк»Альт Сп 10, Альт 8 Сп565nonenew
- 15AdobeAdobe Commerce, Adobe Commerce B2B, Commerce B2B511nonenew
- 16GoogleAndroid, Google Chrome, Chrome472nonenew
- 17npmMongosh, Better-auth, @ckeditor/ckeditor5-real-time-collaboration475nonenew
- 18PhpjabbersCinema Booking System, Hotel Booking System, Restaurant Booking System432nonenew
- 19Q-freeMaxtime439nonenew
- 20Ооо «открытая Мобильная Платформа»Ос Аврора, Аврора Центр420nonenew
- 21GoGithub.com/mattermost/mattermost/server/v8, Github.com/mayswind/ezbookkeeping, Github.com/clidey/whodb/core3571new
- 22Ао «нтц Ит Роса»Роса Хром, Rosa Virtualization 3.0, Роса Кобальт320nonenew
- 23CiscoCisco IOS XE, IOS XE, IOS302nonenew
- 24EnituretechnologyLtl Freight Quotes – Unishippers Edition, Ltl Freight Quotes – Worldwide Express Edition, Ltl Freight Quotes – Globaltranz Edition281nonenew
- 25IBM Corp.IBM Openpages With Watson, IBM Openpages, Cognos Controller281nonenew
Severity
How this month's CVEs score on CVSS; 245 have no score yet. Severity is not exploitation.
- Critical253
- High1,219
- Medium2,068
- Low155
Breakouts
Vendors with at least three times their own 12-month median.
New in the top 100
Not in the top 100 in any of the 24 months before.
What kind of weakness
Weakness classes (CWE) by distinct CVEs, with how far each moved in the ranking.
- CWE-79XSS643
- CWE-89SQL Injection209
- CWE-476NULL Pointer Dereference180
- CWE-416Use After Free147
- CWE-352CSRF144
- CWE-862Missing Authorization128
- CWE-787Out-of-bounds Write110
- CWE-401109
- CWE-22Path Traversal92
- CWE-94Code Injection91
- CWE-125Out-of-bounds Read89
- CWE-284Improper Access Control82
- CWE-20Improper Input Validation72
- CWE-362Race Condition68
- CWE-74Injection67
- CWE-200Information Exposure59
- CWE-120Buffer Overflow48
- CWE-78OS Command Injection46
- CWE-66745
- CWE-77Command Injection42
Where it landed
The month's CVEs by the sector of the software they affect. A CVE that touches several sectors counts in each.
- Operating Systems1,30430% of sector-tagged CVEs
- Web & CMS Plugins82219% of sector-tagged CVEs
- Enterprise Software4069% of sector-tagged CVEs
- OSS Libraries3478% of sector-tagged CVEs
- Hardware Firmware2115% of sector-tagged CVEs
- Networking Infrastructure2035% of sector-tagged CVEs
- 9 smaller sectors712
- Not yet classified353
Which weakness, where
The top weakness classes against the vendors and the sectors that carried them.
The lighter the cell, the more CVEs. Point at one to read it.
| By vendor | 79XSS | 89SQL Injection | 476NULL Pointer Dereference | 416Use After Free | 352CSRF | 862Missing Authorization | 787Out-of-bounds Write | 401 | 22Path Traversal | 94Code Injection |
|---|---|---|---|---|---|---|---|---|---|---|
| Linux | 154 | 109 | 26 | 94 | ||||||
| Сообщество Свободного Программного Обеспечения | 7 | 2 | 99 | 109 | 36 | 43 | 2 | 5 | ||
| Canonical Ltd. | 43 | 57 | 14 | 24 | 1 | |||||
| Red Hat Inc. | 40 | 44 | 20 | 16 | 1 | |||||
| Ооо «русбитех-астра» | 2 | 1 | 32 | 46 | 26 | 6 | 1 | |||
| Ао «нппкт» | 1 | 23 | 39 | 15 | 1 | |||||
| Ооо «ред Софт» | 7 | 2 | 16 | 22 | 15 | 4 | 1 | 1 | ||
| IBM | 14 | 4 | 5 | 1 | ||||||
| Microsoft Corp | 12 | |||||||||
| Microsoft | 8 | 1 | ||||||||
| Intel Corp. | 2 | 1 | 2 | |||||||
| Packagist | 21 | 2 | 1 | 1 | 2 | 1 |
CVEs published in February 2025
27 vulnerabilities from this month that were exploited in the wild (CISA KEV), covered in the news, explained on cve.tools or searched for. Known-exploited first, then by CVSS.
- CVE-2024-57968Advantive VeraCore before 2024.4.2.1 allows remote authenticated users to upload files to unintended folders (e.g., ones that are accessible during web browsing by other users). upload.aspx can be ...KEV9.9
- CVE-2025-24016Remote code execution in Wazuh serverKEV9.9
- CVE-2025-24893Remote code execution as guest via SolrSearchMacros request in xwikiKEV9.8
- CVE-2025-0108PAN-OS: Authentication Bypass in the Management Web InterfaceKEV9.1
- CVE-2023-52163Digiever DS-2105 Pro 3.1.0.71-11 devices allow time_tzsetup.cgi Command Injection. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.KEV8.8
- CVE-2024-40890**UNSUPPORTED WHEN ASSIGNED** A post-authentication command injection vulnerability in the CGI program of the legacy DSL CPE Zyxel VMG4325-B10A firmware version 1.00(AAFR.4)C0_20170615 could allow ...KEV8.8
- CVE-2024-40891**UNSUPPORTED WHEN ASSIGNED** A post-authentication command injection vulnerability in the management commands of the legacy DSL CPE Zyxel VMG4325-B10A firmware version 1.00(AAFR.4)C0_20170615 cou...KEV8.8
- CVE-2025-0994Trimble Cityworks versions prior to 15.8.9 and Cityworks with office companion versions prior to 23.10 are vulnerable to a deserialization vulnerability. This could allow an authenticated user to p...KEV8.8
- CVE-2025-24989Microsoft Power Pages Elevation of Privilege VulnerabilityKEV8.2
- CVE-2025-24472An Authentication Bypass Using an Alternate Path or Channel vulnerability [CWE-288] affecting FortiOS 7.0.0 through 7.0.16 and FortiProxy 7.2.0 through 7.2.12, 7.0.0 through 7.0.19 may allow a rem...KEV8.1
- CVE-2025-21418Windows Ancillary Function Driver for WinSock Elevation of Privilege VulnerabilityKEV7.8
- CVE-2025-21391Windows Storage Elevation of Privilege VulnerabilityKEV7.1
- CVE-2025-0111PAN-OS: Authenticated File Read Vulnerability in the Management Web InterfaceKEV6.5
- CVE-2025-24200An authorization issue was addressed with improved state management. This issue is fixed in iOS 15.8.4 and iPadOS 15.8.4, iOS 16.7.11 and iPadOS 16.7.11, iOS 18.3.1 and iPadOS 18.3.1, iPadOS 17.7.5...KEV6.1
- CVE-2025-25181A SQL injection vulnerability in timeoutWarning.asp in Advantive VeraCore through 2025.1.0 allows remote attackers to execute arbitrary SQL commands via the PmSess1 parameter.KEV5.8
- CVE-2024-8425WooCommerce Ultimate Gift Card <= 2.9.2 - Unauthenticated Arbitrary File Upload9.8
- CVE-2025-1044Logsign Unified SecOps Platform Authentication Bypass Vulnerability9.8
- CVE-2024-57668In Code-projects Shopping Portal v1.0, the insert-product.php page has an arbitrary file upload vulnerability.8.8
- CVE-2024-12368Improper access control in the auth_oauth module of Odoo Community 15.0 and Odoo Enterprise 15.0 allows an internal user to export the OAuth tokens of other users.8.1
- CVE-2024-8550Local File Inclusion (LFI) in modelscope/agentscope7.5
- CVE-2024-13352Legull <= 1.2.2 - Reflected XSS7.1
- CVE-2024-39284Uncontrolled search path for some Intel(R) Advisor software before version 2024.2 may allow an authenticated user to potentially enable escalation of privilege via local access.6.7
- CVE-2025-1113taisan tarzan-cms Add Theme admin#themes upload deserialization6.3
- CVE-2025-1608LB-LINK AC1900 Router set_manpwd websGetVar os command injection6.3
- CVE-2025-1609LB-LINK AC1900 Router set_cmd websGetVar os command injection6.3
- CVE-2024-34035An issue was discovered in O-RAN Near Realtime RIC H-Release. To trigger the crashing of the e2mgr, an adversary must flood the system with a significant quantity of E2 Subscription Requests origin...5.7
- CVE-2024-13520Gift Cards (Gift Vouchers and Packages) (WooCommerce Supported) <= 4.4.9 - Missing Authorization to Unauthenticated Price, Date, and Note Updates5.3