May 2025
4,361 CVEs published, +2% on April 2025 and −20% on May 2024. CISA added 24 to KEV.
2025 month by month
- Critical
- 37610% of the 3,947 with a CVSS score
- Added to CISA KEV
- 2419 of this month's CVEs are in KEV, listed a median 6 days after publication
- Vendors
- 1,6364,304 products
- Top weakness
- XSSCWE-79 · 607 CVEs
Who drove it
Vendors by distinct CVEs this month, with how many of those CVEs are now in CISA KEV and how far each moved in the ranking.
- 1LinuxLinux Kernel, Linux5500nonenew
- 2Сообщество Свободного Программного ОбеспеченияLinux, Debian Gnu/linux, Freescout5029nonenew
- 3Ооо «ред Софт»Ред Ос2884nonenew
- 4Ооо «русбитех-астра»Astra Linux Special Edition, Astra Linux Common Edition, Пк "ald Pro"2884nonenew
- 5Ао "нппкт"Осон Основа Оnyx2404nonenew
- 6UnknownIlli Link Party!, Ekc Tournament Manager, Wp Maps2265nonenew
- 7Red HatRed Hat Enterprise Linux, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 92182nonenew
- 8CanonicalUbuntu, Ubuntu Linux, Apport2170nonenew
- 9Ао «сбертех»Platform V Sberlinux OS Server, Субд «platform V Pangolin Db»1530nonenew
- 10DebianDebian Linux, Trixie1450nonenew
- 11PhpgurukulPark Ticketing Management System, Company Visitor Management System, News Portal Project1223nonenew
- 12MicrosoftWindows Server 2025 (Server Core Installation), Windows Server 2022 23h2, Windows Server 2022, 23h2 Edition (Server Core Installation)8555new
- 13ApplemacOS, iPadOS, iOS and iPadOS795nonenew
- 14TotolinkA3002R Firmware, A3002R, A3002RU6812nonenew
- 15CampcodesSales and Inventory System, Online Hospital Management System, Online Shopping Portal610nonenew
- 16Ао «ивк»Альт Сп 10, Альт 8 Сп521nonenew
- 17DlinkDi-7003g Firmware, Di-7003gv2, Dir-600l Firmware502nonenew
- 18GoGithub.com/mattermost/mattermost/server/v8, Github.com/zitadel/zitadel, Github.com/gardener/gardener5011nonenew
- 19IntelIntel Iris XE Graphics, Intel Arc Graphics, Intel Data Center Gpu Flex 170490nonenew
- 20CiscoCisco IOS XE Software, IOS XE, Cisco IOS XE481nonenew
- 21PyPIVllm, Langroid, Vyper475nonenew
- 22IBMDB2, DB2 For Linux, Unix and Windows, Concert Software451nonenew
- 23SourcecodesterStock Management System, Online Student Clearance System, Client Database Management System450nonenew
- 24D-LinkDi-7003gv2, Dir-600l, Dir-619l430nonenew
- 25PackagistMautic/core, Typo3/cms-core, Nitsan/ns-backup4251new
Severity
How this month's CVEs score on CVSS; 414 have no score yet. Severity is not exploitation.
- Critical376
- High1,372
- Medium2,025
- Low174
Breakouts
Vendors with at least three times their own 12-month median.
New in the top 100
Not in the top 100 in any of the 24 months before.
What kind of weakness
Weakness classes (CWE) by distinct CVEs, with how far each moved in the ranking.
- CWE-79XSS607
- CWE-89SQL Injection414
- CWE-74Injection310
- CWE-119Memory Buffer Bounds162
- CWE-787Out-of-bounds Write149
- CWE-476NULL Pointer Dereference144
- CWE-352CSRF143
- CWE-862Missing Authorization140
- CWE-120Buffer Overflow133
- CWE-284Improper Access Control109
- CWE-416Use After Free100
- CWE-125Out-of-bounds Read98
- CWE-77Command Injection98
- CWE-94Code Injection97
- CWE-40196
- CWE-12188
- CWE-20Improper Input Validation85
- CWE-22Path Traversal79
- CWE-502Deserialization74
- CWE-434Unrestricted File Upload72
Where it landed
The month's CVEs by the sector of the software they affect. A CVE that touches several sectors counts in each.
- Web & CMS Plugins1,00321% of sector-tagged CVEs
- Operating Systems92919% of sector-tagged CVEs
- Enterprise Software66814% of sector-tagged CVEs
- Networking Infrastructure3888% of sector-tagged CVEs
- OSS Libraries3698% of sector-tagged CVEs
- ICS / OT / IoT1804% of sector-tagged CVEs
- 9 smaller sectors909
- Not yet classified363
Which weakness, where
The top weakness classes against the vendors and the sectors that carried them.
The lighter the cell, the more CVEs. Point at one to read it.
| By vendor | 79XSS | 89SQL Injection | 74Injection | 119Memory Buffer Bounds | 787Out-of-bounds Write | 476NULL Pointer Dereference | 352CSRF | 862Missing Authorization | 120Buffer Overflow | 284Improper Access Control |
|---|---|---|---|---|---|---|---|---|---|---|
| Сообщество Свободного Программного Обеспечения | 9 | 2 | 22 | 17 | 95 | 4 | 23 | 2 | ||
| Linux | 18 | 118 | 3 | |||||||
| Ооо «русбитех-астра» | 1 | 6 | 18 | 60 | 2 | 4 | 1 | |||
| Ооо «ред Софт» | 2 | 1 | 3 | 11 | 53 | 2 | 3 | |||
| Red Hat Inc. | 1 | 3 | 6 | 44 | 4 | 1 | ||||
| Canonical Ltd. | 3 | 7 | 42 | 2 | ||||||
| Ао «нппкт» | 3 | 17 | 43 | 2 | 3 | 2 | ||||
| Ао «сбертех» | 2 | 9 | 50 | 3 | ||||||
| Debian | 8 | 32 | ||||||||
| Phpgurukul | 5 | 115 | 111 | 1 | ||||||
| Microsoft Corp | 11 | 2 | 2 | |||||||
| Microsoft | 10 | 2 | 3 |
CVEs published in May 2025
34 vulnerabilities from this month that were exploited in the wild (CISA KEV), covered in the news, explained on cve.tools or searched for. Known-exploited first, then by CVSS.
- CVE-2025-32756A stack-based buffer overflow vulnerability [CWE-121] vulnerability in Fortinet FortiCamera 2.1.0 through 2.1.3, FortiCamera 2.0 all versions, FortiCamera 1.1 all versions, FortiMail 7.6.0 through ...KEV9.8
- CVE-2025-4632Improper limitation of a pathname to a restricted directory vulnerability in Samsung MagicINFO 9 Server version before 21.1052 allows attackers to write arbitrary file as system authority.KEV9.8
- CVE-2025-2775SysAid On-Prem <= 23.3.40 Checkin Proceessing XML External Entity InjectionKEV9.3
- CVE-2025-2776SysAid On-Prem <= 23.3.40 serverurl Proceessing XML External Entity InjectionKEV9.3
- CVE-2025-42999Insecure Deserialization in SAP NetWeaver (Visual Composer development server)KEV9.1
- CVE-2025-4008Arbitrary Command Injection in Smartbedded MeteoBridgeKEV8.8
- CVE-2025-30400Microsoft DWM Core Library Elevation of Privilege VulnerabilityKEV7.8
- CVE-2025-32701Windows Common Log File System Driver Elevation of Privilege VulnerabilityKEV7.8
- CVE-2025-32706Windows Common Log File System Driver Elevation of Privilege VulnerabilityKEV7.8
- CVE-2025-32709Windows Ancillary Function Driver for WinSock Elevation of Privilege VulnerabilityKEV7.8
- CVE-2025-30397Scripting Engine Memory Corruption VulnerabilityKEV7.5
- CVE-2025-34026Versa Concerto Actuator Authentication Bypass Information LeakKEV7.5
- CVE-2025-27920Output Messenger before 2.0.63 was vulnerable to a directory traversal attack through improper file path handling. By using ../ sequences in parameters, attackers could access sensitive files outsi...KEV7.2
- CVE-2025-4428Remote Code ExecutionKEV7.2
- CVE-2025-35939Craft CMS stores user-provided content in session filesKEV5.3
- CVE-2025-4427Authentication BypassKEV5.3
- CVE-2025-48927The TeleMessage service through 2025-05-05 configures Spring Boot Actuator with an exposed heap dump endpoint at a /heapdump URI, as exploited in the wild in May 2025.KEV5.3
- CVE-2025-48928The TeleMessage service through 2025-05-05 is based on a JSP application in which the heap content is roughly equivalent to a "core dump" in which a password previously sent over HTTP would be incl...KEV4.0
- CVE-2025-47729The TeleMessage archiving backend through 2025-05-05 holds cleartext copies of messages from TM SGNL (aka Archive Signal) app users, which is different functionality than described in the TeleMessa...KEV1.9
- CVE-2025-47916Invision Community 5.0.0 before 5.0.7 allows remote code execution via crafted template strings to themeeditor.php. The issue lies within the themeeditor controller (file: /applications/core/module...10.0
- CVE-2025-43562ColdFusion | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') (CWE-78)9.1
- CVE-2025-41450Authentication bypass with privileged access in Danfoss AK-SM 8xxA Series prior to version 4.28.2
- CVE-2025-3833SQL Injection8.1
- CVE-2024-13928Authenticated SQL Injection7.2
- CVE-2024-55466An arbitrary file upload vulnerability in the Image Gallery of ThingsBoard Community, ThingsBoard Cloud and ThingsBoard Professional v3.8.1 allows attackers to execute arbitrary code via uploading ...6.5
- CVE-2024-57337An arbitrary file upload vulnerability in the opcode 500 functionality of M2Soft CROWNIX Report & ERS v5.x to v5.5.14.1070, v7.x to v7.4.3.960, and v8.x to v8.2.0.345 allows attackers to execute ar...6.5
- CVE-2025-44176Tenda FH451 V1.0.0.9 is vulnerable to Remote Code Execution in the formSafeEmailFilter function.6.5
- CVE-2025-5000Linksys FGW3000-AH/FGW3000-HK HTTP POST Request sysconf.cgi control_panel_sw command injection6.3
- CVE-2022-49817net: mhi: Fix memory leak in mhi_net_dellink()5.5
- CVE-2024-58135Mojolicious versions from 7.28 through 9.45 for Perl will generate weak HMAC session cookie secrets via "mojo generate app" by default5.3
- CVE-2025-4270TOTOLINK A720R Config cstecgi.cgi information disclosure5.3
- CVE-2025-46736Umbraco Makes User Enumeration Feasible Based on Timing of Login Response5.3
- CVE-2024-51991October CMS Allows Unprotected SVG Rename in Media Manager4.9
- CVE-2024-12808WP ERP | Complete HR solution with recruitment < 1.13.4 - Admin+ Stored XSS4.8