April 2025
4,282 CVEs published, +1% on March 2025 and +14% on April 2024. CISA added 15 to KEV.
2025 month by month
- Critical
- 3308% of the 4,055 with a CVSS score
- Added to CISA KEV
- 1516 of this month's CVEs are in KEV, listed a median 5 days after publication
- Vendors
- 2,0105,306 products
- Top weakness
- XSSCWE-79 · 796 CVEs
Who drove it
Vendors by distinct CVEs this month, with how many of those CVEs are now in CISA KEV and how far each moved in the ranking.
- 1Сообщество Свободного Программного ОбеспеченияLinux, Debian Gnu/linux, Xwiki Platform390162new
- 2Ооо «русбитех-астра»Astra Linux Special Edition, Astra Linux Common Edition, Пк "ald Pro"28341new
- 3LinuxLinux, Linux Kernel2800nonenew
- 4Ооо «ред Софт»Ред Ос23971new
- 5Ао "нппкт"Осон Основа Оnyx22251new
- 6MicrosoftWindows Server 2025, Windows Server 2025 (Server Core Installation), Windows Server 202214621new
- 7Red HatRed Hat Enterprise Linux, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 91303nonenew
- 8Ао «сбертех»Platform V Sberlinux OS Server1222nonenew
- 9Ао «ивк»Альт Сп 10, Альт 8 Сп1043nonenew
- 10CanonicalUbuntu, Mysql-k8s-operator, Ubuntu Linux950nonenew
- 11PhpgurukulMen Salon Management System, Covid19 Testing Management System, Park Ticketing Management System835nonenew
- 12SiemensTelecontrol Server Basic, Sentron 7kt PAC1260, Sentron 7kt PAC1260 Data Manager818nonenew
- 13OracleMySQL Server, MySQL Cluster, E-business Suite731nonenew
- 14code-projectsPatient Record Management System, Online Restaurant Management System, Blood Bank Management System630nonenew
- 15PackagistMoodle/moodle, Yeswiki/yeswiki, Shopware/platform5982new
- 16GoGithub.com/mattermost/mattermost/server/v8, Github.com/rancher/rancher, Github.com/osrg/gobgp/v3567nonenew
- 17MavenOrg.keycloak:keycloak-services, Org.opencms:opencms-core, Org.elasticsearch:elasticsearch5610nonenew
- 18AdobeColdfusion, Framemaker, Adobe Framemaker524nonenew
- 19Novell Inc.Suse Linux Enterprise Server, Suse Linux Enterprise Server For Sap Applications, Opensuse Leap522nonenew
- 20npmTarteaucitronjs, React-router, Mathlive472nonenew
- 21TotolinkA810R Firmware, A810R, A3100R4711nonenew
- 22IBMAspera Console, Txseries For Multiplatforms, Infosphere Information Server361nonenew
- 23PyPIVllm, Picklescan, Langflow36111new
- 24SourcecodesterWeb-based Pharmacy Product Management System, Online Eyewear Shop, Apartment Visitor Management System350nonenew
- 25QualcommWCD9380 Firmware, Fastconnect 6900 Firmware, Fastconnect 7800 Firmware340nonenew
Severity
How this month's CVEs score on CVSS; 227 have no score yet. Severity is not exploitation.
- Critical330
- High1,564
- Medium1,962
- Low199
Breakouts
Vendors with at least three times their own 12-month median.
New in the top 100
Not in the top 100 in any of the 24 months before.
What kind of weakness
Weakness classes (CWE) by distinct CVEs, with how far each moved in the ranking.
- CWE-79XSS796
- CWE-89SQL Injection392
- CWE-352CSRF250
- CWE-862Missing Authorization241
- CWE-74Injection202
- CWE-284Improper Access Control139
- CWE-94Code Injection129
- CWE-119Memory Buffer Bounds99
- CWE-476NULL Pointer Dereference94
- CWE-787Out-of-bounds Write91
- CWE-125Out-of-bounds Read90
- CWE-22Path Traversal88
- CWE-120Buffer Overflow85
- CWE-416Use After Free82
- CWE-20Improper Input Validation67
- CWE-434Unrestricted File Upload66
- CWE-502Deserialization65
- CWE-9864
- CWE-918SSRF57
- CWE-200Information Exposure56
Where it landed
The month's CVEs by the sector of the software they affect. A CVE that touches several sectors counts in each.
Which weakness, where
The top weakness classes against the vendors and the sectors that carried them.
The lighter the cell, the more CVEs. Point at one to read it.
| By vendor | 79XSS | 89SQL Injection | 352CSRF | 862Missing Authorization | 74Injection | 284Improper Access Control | 94Code Injection | 119Memory Buffer Bounds | 476NULL Pointer Dereference | 787Out-of-bounds Write |
|---|---|---|---|---|---|---|---|---|---|---|
| Сообщество Свободного Программного Обеспечения | 4 | 2 | 3 | 1 | 2 | 1 | 11 | 71 | 11 | |
| Ооо «русбитех-астра» | 2 | 1 | 1 | 1 | 3 | 54 | 7 | |||
| Linux | 62 | 8 | ||||||||
| Ооо «ред Софт» | 5 | 1 | 3 | 3 | 1 | 3 | 3 | 7 | 27 | 4 |
| Ао «нппкт» | 1 | 4 | 1 | 3 | 37 | 8 | ||||
| Microsoft Corp | 1 | 8 | 1 | 2 | ||||||
| Microsoft | 1 | 1 | 7 | 2 | ||||||
| Ао «сбертех» | 3 | 30 | 5 | |||||||
| Red Hat Inc. | 2 | 4 | 23 | 5 | ||||||
| Ао «ивк» | 1 | 1 | 1 | 1 | 3 | 10 | 3 | |||
| Canonical Ltd. | 2 | 15 | 6 | |||||||
| Phpgurukul | 2 | 74 | 69 | 1 |
CVEs published in April 2025
27 vulnerabilities from this month that were exploited in the wild (CISA KEV), covered in the news, explained on cve.tools or searched for. Known-exploited first, then by CVSS.
- CVE-2025-31324Missing Authorization check in SAP NetWeaver (Visual Composer development server)KEV10.0
- CVE-2025-32432Craft CMS Allows Remote Code ExecutionKEV10.0
- CVE-2025-32433Erlang/OTP SSH Vulnerable to Pre-Authentication RCEKEV10.0
- CVE-2025-34028Commvault Command Center Innovation Release <= 11.38.25 Unathenticated Install Package Path TraversalKEV10.0
- CVE-2025-31161CrushFTP 10 before 10.8.4 and 11 before 11.3.1 allows authentication bypass and takeover of the crushadmin account (unless a DMZ proxy instance is used), as exploited in the wild in March and April...KEV9.8
- CVE-2025-31200A memory corruption issue was addressed with improved bounds checking. This issue is fixed in iOS 18.4.1 and iPadOS 18.4.1, macOS Sequoia 15.4.1, tvOS 18.4.1, visionOS 2.4.1, watchOS 11.5. Processi...KEV9.8
- CVE-2025-31201This issue was addressed by removing the vulnerable code. This issue is fixed in iOS 18.4.1 and iPadOS 18.4.1, macOS Sequoia 15.4.1, tvOS 18.4.1, visionOS 2.4.1. An attacker with arbitrary read and...KEV9.8
- CVE-2025-3248Langflow < 1.3.0 Unauthenticated RCE via /api/v1/validate/codeKEV9.8
- CVE-2025-42599Active! mail 6 BuildInfo: 6.60.05008561 and earlier contains a stack-based buffer overflow vulnerability. Receiving a specially crafted request created and sent by a remote unauthenticated attacker...KEV9.8
- CVE-2024-58136Yii 2 before 2.0.52 mishandles the attaching of behavior that is defined by an __class array key, a CVE-2024-4990 regression, as exploited in the wild in February through April 2025.KEV9.0
- CVE-2025-22457A stack-based buffer overflow in Ivanti Connect Secure before version 22.7R2.6, Ivanti Policy Secure before version 22.7R1.4, and Ivanti ZTA Gateways before version 22.8R2.2 allows a remote unauthe...KEV9.0
- CVE-2025-30406Gladinet CentreStack through 16.1.10296.56315 (fixed in 16.4.10315.56368) has a deserialization vulnerability due to the CentreStack portal's hardcoded machineKey use, as exploited in the wild in M...KEV9.0
- CVE-2025-3928Commvault Web Server unspecified vulnerabilityKEV8.8
- CVE-2025-3935ScreenConnect Exposure to ASP.NET ViewState Code InjectionKEV8.1
- CVE-2025-29824Windows Common Log File System Driver Elevation of Privilege VulnerabilityKEV7.8
- CVE-2025-1976Code injection exposure in Fabric OS 9.1.0 through 9.1.1d6KEV6.7
- CVE-2023-44755Sacco Management system v1.0 was discovered to contain a SQL injection vulnerability via the password parameter at /sacco/ajax.php.9.8
- CVE-2024-56325Apache Pinot: Authentication bypass issue. If the path does not contain / and contain . authentication is not required9.8
- CVE-2025-28146Edimax AC1200 Wave 2 Dual-Band Gigabit Router BR-6478AC V3 1.0.15 was discovered to contain a command injection vulnerability via fota_url in /boafrm/formLtefotaUpgradeQuectel9.8
- CVE-2025-30065Apache Parquet Java: Arbitrary code execution in the parquet-avro module when reading an Avro schema from a Parquet file metadata9.8
- CVE-2025-3538D-Link DI-8100 jhttpd auth.asp auth_asp stack-based overflow8.8
- CVE-2025-3102SureTriggers <= 1.0.78 - Authorization Bypass due to Missing Empty Value Check to Unauthenticated Administrative User Creation8.1
- CVE-2025-3886CatoNetworks CatoClient up to 5.8 PrivilegedHelperTool Race Condition8.1
- CVE-2024-33452An issue in OpenResty lua-nginx-module v.0.10.26 and before allows a remote attacker to conduct HTTP request smuggling via a crafted HEAD request.7.7
- CVE-2024-11859DLL Search Order Hijacking in ESET products for Windows6.6
- CVE-2025-31486Vite allows server.fs.deny to be bypassed with .svg or relative paths5.3
- CVE-2025-4037code-projects ATM Banking moneyWithdraw logic error4.4