March 2025
4,251 CVEs published, +8% on February 2025 and +26% on March 2024. CISA added 32 to KEV.
2025 month by month
- Critical
- 42011% of the 3,966 with a CVSS score
- Added to CISA KEV
- 3226 of this month's CVEs are in KEV, listed a median 4 days after publication
- Vendors
- 1,9504,670 products
- Top weakness
- XSSCWE-79 · 854 CVEs
Who drove it
Vendors by distinct CVEs this month, with how many of those CVEs are now in CISA KEV and how far each moved in the ranking.
- 1Сообщество Свободного Программного ОбеспеченияLinux, Debian Gnu/linux, Wpe Webkit312142new
- 2LinuxLinux, Linux Kernel2070nonenew
- 3Ооо «ред Софт»Ред Ос20242new
- 4Ооо «русбитех-астра»Astra Linux Special Edition, Astra Linux Common Edition, Пк "ald Pro"17382new
- 5PyPIOpen-webui, Aim, H2O16633nonenew
- 6Red HatRed Hat Enterprise Linux, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 81662nonenew
- 7ApplemacOS, iPadOS, iOS and iPadOS159461new
- 8Ао "нппкт"Осон Основа Оnyx12373new
- 9Ао «сбертех»Platform V Sberlinux OS Server10801new
- 10Novell Inc.Suse Linux Enterprise Server, Suse Linux Enterprise Server For Sap Applications, Opensuse Leap1022nonenew
- 11PhpgurukulBank Locker Management System, Art Gallery Management System, Old Age Home Management System810nonenew
- 12CanonicalUbuntu, Accountsservice, Linux-bluefield802nonenew
- 13UnknownGdpr Cookie Compliance, Url Shortener | Conversion Tracking | Ab Testing | Woocommerce, Product Labels For Woocommerce (Sale Badges)761nonenew
- 14MicrosoftWindows Server 2025, Windows Server 2022, 23h2 Edition (Server Core Installation), Windows Server 20227018new
- 15MavenAi.h2o:h2o-core, Io.github.robothy:local-s3-rest, Org.jenkins-ci.main:jenkins-core6481new
- 16PackagistDrupal/ai, Drupal/core, Shopxo/shopxo625nonenew
- 17Ао «ивк»Альт Сп 10, Альт 8 Сп6281new
- 18GoGithub.com/mattermost/mattermost/server/v8, Github.com/ollama/ollama, K8s.io/ingress-nginx605nonenew
- 19npmDirectus, Open-webui, Flowise5271new
- 20PrinterlogicVasion Print, Virtual Appliance4936nonenew
- 21TendaFH1202 Firmware, FH1202, RX3 Firmware4610nonenew
- 22FortinetFortios, Fortisandbox, Fortiweb442nonenew
- 23AdobeIndesign Desktop, Acrobat, Indesign430nonenew
- 24IBMInfosphere Information Server, Engineering Requirements Management Doors Next, Common Cryptographic Architecture393nonenew
- 25GoogleGoogle Chrome, Chrome, Android3521new
Severity
How this month's CVEs score on CVSS; 285 have no score yet. Severity is not exploitation.
- Critical420
- High1,461
- Medium1,865
- Low220
Breakouts
Vendors with at least three times their own 12-month median.
New in the top 100
Not in the top 100 in any of the 24 months before.
What kind of weakness
Weakness classes (CWE) by distinct CVEs, with how far each moved in the ranking.
- CWE-79XSS854
- CWE-89SQL Injection319
- CWE-352CSRF236
- CWE-862Missing Authorization190
- CWE-74Injection183
- CWE-94Code Injection143
- CWE-284Improper Access Control132
- CWE-787Out-of-bounds Write111
- CWE-22Path Traversal103
- CWE-200Information Exposure97
- CWE-125Out-of-bounds Read85
- CWE-119Memory Buffer Bounds78
- CWE-416Use After Free78
- CWE-918SSRF78
- CWE-476NULL Pointer Dereference69
- CWE-78OS Command Injection64
- CWE-502Deserialization63
- CWE-77Command Injection58
- CWE-434Unrestricted File Upload54
- CWE-120Buffer Overflow53
Where it landed
The month's CVEs by the sector of the software they affect. A CVE that touches several sectors counts in each.
- Web & CMS Plugins1,03321% of sector-tagged CVEs
- Operating Systems62313% of sector-tagged CVEs
- OSS Libraries62313% of sector-tagged CVEs
- Enterprise Software60912% of sector-tagged CVEs
- AI / ML3156% of sector-tagged CVEs
- Networking Infrastructure2565% of sector-tagged CVEs
- Mobile Apps2375% of sector-tagged CVEs
- 8 smaller sectors838
- Not yet classified383
Which weakness, where
The top weakness classes against the vendors and the sectors that carried them.
The lighter the cell, the more CVEs. Point at one to read it.
| By vendor | 79XSS | 89SQL Injection | 352CSRF | 862Missing Authorization | 74Injection | 94Code Injection | 284Improper Access Control | 787Out-of-bounds Write | 22Path Traversal | 200Information Exposure |
|---|---|---|---|---|---|---|---|---|---|---|
| Сообщество Свободного Программного Обеспечения | 7 | 1 | 5 | 15 | 3 | 1 | ||||
| Ооо «ред Софт» | 3 | 1 | 1 | 13 | 1 | |||||
| Linux | 4 | |||||||||
| Ооо «русбитех-астра» | 2 | 12 | 1 | |||||||
| PyPI | 3 | 7 | 4 | 1 | 8 | 8 | 1 | |||
| Apple | 2 | 6 | 1 | 24 | 8 | 1 | 38 | |||
| Red Hat Inc. | 1 | 1 | 1 | 2 | 1 | |||||
| Ао «нппкт» | 2 | 1 | 6 | 2 | ||||||
| Ао «сбертех» | 2 | |||||||||
| Novell Inc. | 1 | 1 | 1 | 5 | ||||||
| Canonical Ltd. | 1 | 1 | 1 | |||||||
| Phpgurukul | 6 | 71 | 70 | 6 | 2 |
CVEs published in March 2025
45 vulnerabilities from this month that were exploited in the wild (CISA KEV), covered in the news, explained on cve.tools or searched for. Known-exploited first, then by CVSS.
- CVE-2025-24201An out-of-bounds write issue was addressed with improved checks to prevent unauthorized actions. This issue is fixed in Safari 18.3.1, iOS 15.8.4 and iPadOS 15.8.4, iOS 16.7.11 and iPadOS 16.7.11, ...KEV10.0
- CVE-2024-54085Redfish Authentication BypassKEV9.8
- CVE-2025-1316Edimax IC-7100 IP Camera OS Command InjectionKEV9.8
- CVE-2025-24813Apache Tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUTKEV9.8
- CVE-2025-2746Kentico Xperience <= 13.0.172 Staging Sync Server Digest Password Authentication BypassKEV9.8
- CVE-2025-2747Kentico Xperience <= 13.0.178 Staging Sync Server None Password Type Authentication BypassKEV9.8
- CVE-2025-22224VMware ESXi, and Workstation contain a TOCTOU (Time-of-Check Time-of-Use) vulnerability that leads to an out-of-bounds write. A malicious actor with local administrative privileges on a virtual m...KEV9.3
- CVE-2024-48248NAKIVO Backup & Replication before 11.0.0.88174 allows absolute path traversal for reading files via getImageByPath to /c/router (this may lead to remote code execution across the enterprise becaus...KEV8.6
- CVE-2025-30066tj-actions changed-files before 46 allows remote attackers to discover secrets by reading actions logs. (The tags v1 through v45.0.7 were affected on 2025-03-14 and 2025-03-15 because they were mod...KEV8.6
- CVE-2025-30154Multiple Reviewdog actions were compromised during a specific time periodKEV8.6
- CVE-2025-2783Incorrect handle provided in unspecified circumstances in Mojo in Google Chrome on Windows prior to 134.0.6998.177 allowed a remote attacker to perform a sandbox escape via a malicious file. (Chrom...KEV8.3
- CVE-2025-22225VMware ESXi contains an arbitrary write vulnerability. A malicious actor with privileges within the VMX process may trigger an arbitrary kernel write leading to an escape of the sandbox.KEV8.2
- CVE-2025-27363An out of bounds write exists in FreeType versions 2.13.0 and below (newer versions of FreeType are not vulnerable) when attempting to parse font subglyph structures related to TrueType GX and vari...KEV8.1
- CVE-2025-24985Windows Fast FAT File System Driver Remote Code Execution VulnerabilityKEV7.8
- CVE-2025-24993Windows NTFS Remote Code Execution VulnerabilityKEV7.8
- CVE-2025-2749Kentico Xperience <= 13.0.178 Staging Media File Upload Authenticated RCEKEV7.2
- CVE-2025-29635A command injection vulnerability in D-Link DIR-823X 240126 and 240802 allows an authorized attacker to execute arbitrary commands on remote devices by sending a POST request to /goform/set_prohibi...KEV7.2
- CVE-2025-22226VMware ESXi, Workstation, and Fusion contain an information disclosure vulnerability due to an out-of-bounds read in HGFS. A malicious actor with administrative privileges to a virtual machine ma...KEV7.1
- CVE-2025-24983Windows Win32 Kernel Subsystem Elevation of Privilege VulnerabilityKEV7.0
- CVE-2025-26633Microsoft Management Console Security Feature Bypass VulnerabilityKEV7.0
- CVE-2025-24054NTLM Hash Disclosure Spoofing VulnerabilityKEV6.5
- CVE-2025-24991Windows NTFS Information Disclosure VulnerabilityKEV5.5
- CVE-2025-27915An issue was discovered in Zimbra Collaboration (ZCS) 9.0 and 10.0 and 10.1. A stored cross-site scripting (XSS) vulnerability exists in the Classic Web Client due to insufficient sanitization of H...KEV5.4
- CVE-2025-31125Vite has a `server.fs.deny` bypassed for `inline` and `raw` with `?import` queryKEV5.3
- CVE-2025-24984Windows NTFS Information Disclosure VulnerabilityKEV4.6
- CVE-2025-21590Junos OS: An local attacker with shell access can execute arbitrary codeKEV4.4
- CVE-2024-12824Nokri – Job Board WordPress Theme <= 1.6.2 - Unauthenticated Arbitrary Password Change9.8
- CVE-2024-55964An issue was discovered in Appsmith before 1.52. An incorrectly configured PostgreSQL instance in the Appsmith image leads to remote command execution inside the Appsmith Docker container. The atta...9.8
- CVE-2025-1974ingress-nginx admission controller RCE escalation9.8
- CVE-2025-25579TOTOLINK A3002R V4.0.0-B20230531.1404 is vulnerable to Command Injection in /bin/boa via bandstr.9.8
- CVE-2025-29927Authorization Bypass in Next.js Middleware9.1
- CVE-2024-7044Stored XSS in open-webui/open-webui8.9
- CVE-2024-7764SQL Injection in vanna-ai/vanna8.1
- CVE-2024-13919Laravel Reflected XSS via Route Parameter in Debug-Mode Error Page8.0
- CVE-2024-12070Denial of Service in haotian-liu/llava7.5
- CVE-2025-24799GLPI allows unauthenticated SQL injection through the inventory endpoint7.5
- CVE-2024-8765Improper Path Equivalence Resolution in lunary-ai/lunary7.3
- CVE-2024-10366IDOR in delete attachments in danny-avila/librechat6.5
- CVE-2024-11173Unhandled Exception in danny-avila/librechat6.5
- CVE-2025-1849zj1983 zz import_data_todb server-side request forgery6.3
- CVE-2025-2479Easy Custom Admin Bar <= 1.0 - Reflected Cross-Site Scripting via msg Parameter6.1
- CVE-2025-2993Tenda FH1202 default.cfg access control5.3
- CVE-2025-30208Vite bypasses server.fs.deny when using `?raw??`5.3
- CVE-2024-13546GenerateBlocks <= 1.9.1 - Authenticated (Contributor+) Sensitive Information Exposure via 'get_image_description'4.3
- CVE-2024-52362IBM App Connect Enterprise Certified Container denial of service4.3