June 2025
3,875 CVEs published, −11% on May 2025 and +16% on June 2024. CISA added 20 to KEV.
2025 month by month
- Critical
- 2938% of the 3,631 with a CVSS score
- Added to CISA KEV
- 2018 of this month's CVEs are in KEV, listed a median 28 days after publication
- Vendors
- 1,5965,330 products
- Top weakness
- XSSCWE-79 · 737 CVEs
Who drove it
Vendors by distinct CVEs this month, with how many of those CVEs are now in CISA KEV and how far each moved in the ranking.
- 1Сообщество Свободного Программного ОбеспеченияLinux, Debian Gnu/linux, Xwiki Platform40721nonenew
- 2LinuxLinux, Linux Kernel3750nonenew
- 3AdobeAdobe Experience Manager, Experience Manager, Adobe Acrobat Document Cloud2600nonenew
- 4Red HatRed Hat Enterprise Linux, Red Hat Enterprise Linux 9, Red Hat Enterprise Linux 825971new
- 5Ооо «ред Софт»Ред Ос154124new
- 6code-projectsInventory Management System, Simple Pizza Ordering System, Online Shoe Store1531nonenew
- 7CanonicalUbuntu, Cloud-init, Authd14531new
- 8Ооо «русбитех-астра»Astra Linux Special Edition, Astra Linux Common Edition, Пк "ald Pro"124102new
- 9PhpgurukulArt Gallery Management System, Pre-school Enrollment System, Complaint Management System1230nonenew
- 10Ао "нппкт"Осон Основа Оnyx113102new
- 11TotolinkX15, X15 Firmware, EX1200T Firmware782nonenew
- 12MicrosoftWindows Server 2025 (Server Core Installation), Windows Server 2025, Windows Server 20227624new
- 13Ао «сбертех»Platform V Sberlinux OS Server762nonenew
- 14FabianSimple Online Hotel Reservation System, School Fees Payment System, Simple Forum650nonenew
- 15Ао «ивк»Альт Сп 10, Альт 8 Сп646nonenew
- 16MavenOrg.geoserver.web:gs-web-app, Org.geoserver:gs-wfs, Org.apache.tomcat.embed:tomcat-embed-core589nonenew
- 17DebianDebian Linux, Yubiserver, Pdns5562new
- 18SourcecodesterBest Salon Management System, Student Result Management System, Simple Company Website520nonenew
- 19GoGithub.com/filebrowser/filebrowser/v2, Github.com/mattermost/mattermost/server/v8, Github.com/mattermost/mattermost-server504nonenew
- 20Novell Inc.Opensuse Leap, Suse Linux Enterprise Server, Suse Linux Enterprise Server For Sap Applications4961new
- 21IBMQradar Suite Software, Infosphere Information Server, Cloud Pak For Security483nonenew
- 22PyPISalt, Backend.ai, Langchain-chatchat476nonenew
- 23DlinkDir-619l Firmware, Dir-619l, Dir-816 Firmware447nonenew
- 24D-LinkDir-619l, Dir-816, Di-7300g+415nonenew
- 25IBM Corp.Qradar Suite Software, IBM Cloud Pak For Security, IBM Planning Analytics Local393nonenew
Severity
How this month's CVEs score on CVSS; 244 have no score yet. Severity is not exploitation.
- Critical293
- High1,289
- Medium1,851
- Low198
Breakouts
Vendors with at least three times their own 12-month median.
New in the top 100
Not in the top 100 in any of the 24 months before.
What kind of weakness
Weakness classes (CWE) by distinct CVEs, with how far each moved in the ranking.
- CWE-79XSS737
- CWE-89SQL Injection437
- CWE-74Injection345
- CWE-119Memory Buffer Bounds192
- CWE-352CSRF161
- CWE-862Missing Authorization157
- CWE-120Buffer Overflow113
- CWE-22Path Traversal112
- CWE-94Code Injection104
- CWE-416Use After Free87
- CWE-476NULL Pointer Dereference81
- CWE-78OS Command Injection79
- CWE-787Out-of-bounds Write77
- CWE-9875
- CWE-125Out-of-bounds Read73
- CWE-77Command Injection71
- CWE-12168
- CWE-284Improper Access Control62
- CWE-434Unrestricted File Upload59
- CWE-20Improper Input Validation58
Where it landed
The month's CVEs by the sector of the software they affect. A CVE that touches several sectors counts in each.
- Web & CMS Plugins1,05223% of sector-tagged CVEs
- Operating Systems73416% of sector-tagged CVEs
- Enterprise Software44110% of sector-tagged CVEs
- OSS Libraries4209% of sector-tagged CVEs
- Consumer Software3828% of sector-tagged CVEs
- Networking Infrastructure3287% of sector-tagged CVEs
- Hardware Firmware2125% of sector-tagged CVEs
- 8 smaller sectors694
- Not yet classified363
Which weakness, where
The top weakness classes against the vendors and the sectors that carried them.
The lighter the cell, the more CVEs. Point at one to read it.
| By vendor | 79XSS | 89SQL Injection | 74Injection | 119Memory Buffer Bounds | 352CSRF | 862Missing Authorization | 120Buffer Overflow | 22Path Traversal | 94Code Injection | 416Use After Free |
|---|---|---|---|---|---|---|---|---|---|---|
| Сообщество Свободного Программного Обеспечения | 2 | 3 | 4 | 4 | 10 | 1 | 33 | |||
| Linux | 40 | |||||||||
| Adobe | 222 | 7 | ||||||||
| Adobe Systems Inc. | 221 | 7 | ||||||||
| Red Hat Inc. | 5 | 1 | 25 | |||||||
| Ооо «ред Софт» | 1 | 1 | 1 | 10 | 14 | |||||
| Canonical Ltd. | 4 | 16 | ||||||||
| code-projects | 16 | 124 | 123 | 3 | 3 | 1 | 14 | |||
| Ооо «русбитех-астра» | 1 | 2 | 4 | 12 | ||||||
| Phpgurukul | 17 | 100 | 97 | 1 | 1 | 3 | 15 | |||
| Ао «нппкт» | 1 | 1 | 7 | 11 | ||||||
| Ао «сбертех» | 1 | 9 |
CVEs published in June 2025
38 vulnerabilities from this month that were exploited in the wild (CISA KEV), covered in the news, explained on cve.tools or searched for. Known-exploited first, then by CVSS.
- CVE-2025-20281Cisco ISE API Unauthenticated Remote Code Execution VulnerabilityKEV10.0
- CVE-2025-32975Quest KACE Systems Management Appliance (SMA) 13.0.x before 13.0.385, 13.1.x before 13.1.81, 13.2.x before 13.2.183, 14.0.x before 14.0.341 (Patch 5), and 14.1.x before 14.1.101 (Patch 4) contains ...KEV10.0
- CVE-2025-49113Roundcube Webmail before 1.5.10 and 1.6.x before 1.6.11 allows remote code execution by authenticated users because the _from parameter in a URL is not validated in program/actions/settings/upload....KEV9.9
- CVE-2025-6543Memory overflow vulnerability leading to unintended control flow and Denial of ServiceKEV9.8
- CVE-2025-32463Sudo before 1.9.17p1 allows local users to obtain root access because /etc/nsswitch.conf from a user-controlled directory is used with the --chroot option.KEV9.3
- CVE-2025-5086Deserialization of Untrusted Data vulnerability affecting DELMIA Apriso from Release 2020 through Release 2025KEV9.0
- CVE-2025-33053Internet Shortcut Files Remote Code Execution VulnerabilityKEV8.8
- CVE-2025-33073Windows SMB Client Elevation of Privilege VulnerabilityKEV8.8
- CVE-2025-5419Out of bounds read and write in V8 in Google Chrome prior to 137.0.7151.68 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)KEV8.8
- CVE-2025-21479Incorrect Authorization in GraphicsKEV8.6
- CVE-2025-21480Incorrect Authorization in Graphics WindowsKEV8.6
- CVE-2025-6554Type confusion in V8 in Google Chrome prior to 138.0.7204.96 allowed a remote attacker to perform arbitrary read/write via a crafted HTML page. (Chromium security severity: High)KEV8.1
- CVE-2025-6218RARLAB WinRAR Directory Traversal Remote Code Execution VulnerabilityKEV7.8
- CVE-2025-27038Use After Free in GraphicsKEV7.5
- CVE-2025-5777NetScaler ADC and NetScaler Gateway - Insufficient input validation leading to memory overreadKEV7.5
- CVE-2025-48700An issue was discovered in Zimbra Collaboration (ZCS) 8.8.15 and 9.0 and 10.0 and 10.1. A Cross-Site Scripting (XSS) vulnerability in the Zimbra Classic UI allows attackers to execute arbitrary Jav...KEV6.1
- CVE-2025-47827In IGEL OS before 11, Secure Boot can be bypassed because the igel-flash-driver module improperly verifies a cryptographic signature. Ultimately, a crafted root filesystem can be mounted from an un...KEV4.6
- CVE-2025-43200This issue was addressed with improved checks. This issue is fixed in iOS 15.8.4 and iPadOS 15.8.4, iOS 16.7.11 and iPadOS 16.7.11, iOS 18.3.1 and iPadOS 18.3.1, iPadOS 17.7.5, macOS Sequoia 15.3.1...KEV4.2
- CVE-2025-30220GeoTools, GeoServer, and GeoNetwork XML External Entity (XXE) Processing Vulnerability in XSD schema handling9.9
- CVE-2025-34037Linksys Routers E/WAG/WAP/WES/WET/WRT-Series9.8
- CVE-2025-44148Cross Site Scripting (XSS) vulnerability in MailEnable before v10 allows a remote attacker to execute arbitrary code via the failure.aspx component9.8
- CVE-2025-45988Blink routers BL-WR9000 V2.4.9 , BL-AC2100_AZ3 V1.0.4, BL-X10_AC8 v1.0.5 , BL-LTE300 v1.2.3, BL-F1200_AT1 v1.0.0, BL-X26_AC8 v1.2.8, BLAC450M_AE4 v4.0.0 and BL-X26_DA3 v1.2.7 were discovered to con...9.8
- CVE-2025-49002Dataease H2 Database Remote Code Execution (RCE) Bypass Vulnerability9.8
- CVE-2025-36038IBM WebSphere Application Server code execution9.0
- CVE-2025-5788TOTOLINK X15 HTTP POST Request formReflashClientTbl buffer overflow8.8
- CVE-2025-4278Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) in GitLab8.7
- CVE-2024-51983Unauthenticated Denial of Service (DoS) via malformed WS-Scan request affecting multiple models from Brother Industries, Ltd, FUJIFILM Business Innovation, Ricoh, Toshiba Tec, and Konica Minolta, Inc.7.5
- CVE-2025-4365NetScaler Console and NetScaler SDX (SVM) - Arbitrary file read7.5
- CVE-2025-48976Apache Commons FileUpload, Apache Commons FileUpload: FileUpload DoS via part headers7.5
- CVE-2025-48988Apache Tomcat: FileUpload large number of parts with headers DoS7.5
- CVE-2025-6665code-projects Inventory Management System editBrand.php sql injection7.3
- CVE-2025-47959Visual Studio Remote Code Execution Vulnerability7.1
- CVE-2025-5301Reflected Cross-Site Scripting in ONLYOFFICE Docs (DocumentServer)6.1
- CVE-2024-57708An issue in OneTrust SDK v.6.33.0 allows a local attacker to cause a denial of service via the Object.setPrototypeOf, __proto__, and Object.assign components. NOTE: this is disputed by the Supplier...5.7
- CVE-2025-1055K7 Security Anti-Malware: IOCTL in K7RKScan.sys Allows Arbitrary Termination of High-Privilege and System Processes by a Low-Privilege User5.6
- CVE-2025-5731Infinispan: credential leakage in infinispan cli5.5
- CVE-2025-46927Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)5.4
- CVE-2024-51977Unauthenticated leak of sensitive information affecting multiple models from Brother Industries, Ltd., FUJIFILM Business Innovation, Ricoh, Toshiba Tec, and Konica Minolta, Inc.5.3