July 2025
4,086 CVEs published, +5% on June 2025 and +26% on July 2024. CISA added 20 to KEV.
2025 month by month
- Critical
- 36810% of the 3,710 with a CVSS score
- Added to CISA KEV
- 2014 of this month's CVEs are in KEV, listed a median 14 days after publication
- Vendors
- 1,4515,533 products
- Top weakness
- XSSCWE-79 · 483 CVEs
Who drove it
Vendors by distinct CVEs this month, with how many of those CVEs are now in CISA KEV and how far each moved in the ranking.
- 1Сообщество Свободного Программного ОбеспеченияLinux, Debian Gnu/linux, Gpac536181new
- 2LinuxLinux, Linux Kernel40101new
- 3Ооо «ред Софт»Ред Ос39563new
- 4Ооо «русбитех-астра»Astra Linux Special Edition, Astra Linux Common Edition37283new
- 5Red HatRed Hat Enterprise Linux, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 92942nonenew
- 6Ао "нппкт"Осон Основа Оnyx23663new
- 7Ао «сбертех»Platform V Sberlinux OS Server22832new
- 8DebianDebian Linux, Dpkg20103new
- 9Ао «ивк»Альт 8 Сп, Альт Сп 1017882new
- 10code-projectsExam Form Submission, Online Appointment Booking System, Church Donation System1540nonenew
- 11MicrosoftWindows Server 2025 (Server Core Installation), Windows Server 2025, Windows Server 2022 23h214954new
- 12CanonicalUbuntu, Juju, Juju\/utils1182nonenew
- 13CadsofttoolsCadimage910nonenew
- 14IrfanviewIrfanview910nonenew
- 15PhpgurukulVehicle Parking Management System, Apartment Visitors Management System, Online Fire Reporting System860nonenew
- 16ApplemacOS, iPadOS, iPhone OS85253new
- 17OracleMySQL Server, MySQL, E-business Suite851nonenew
- 18AdobeAdobe Framemaker, Framemaker, Coldfusion733nonenew
- 19MavenOrg.glassfish.main.admingui:console-common, Org.keycloak:keycloak-services, Org.jenkins-ci.plugins:applitools-eyes696nonenew
- 20Novell Inc.Opensuse Leap, Suse Linux Enterprise Server, Suse Linux Enterprise Server For Sap Applications682nonenew
- 21CampcodesEmployee Management System, Payroll Management System, Courier Management System650nonenew
- 22TendaFH451 Firmware, FH451, O3V2630nonenew
- 23npm@haxtheweb/haxcms-nodejs, Directus, @finos/git-proxy5941new
- 24Shenzhen Tenda Technology Co., Ltd.Tenda FH451, Tenda O3, Tenda FH1201570nonenew
- 25IBMDB2, Openpages With Watson, Cognos Analytics Mobile540nonenew
Severity
How this month's CVEs score on CVSS; 376 have no score yet. Severity is not exploitation.
- Critical368
- High1,455
- Medium1,708
- Low179
Breakouts
Vendors with at least three times their own 12-month median.
New in the top 100
Not in the top 100 in any of the 24 months before.
What kind of weakness
Weakness classes (CWE) by distinct CVEs, with how far each moved in the ranking.
- CWE-79XSS483
- CWE-89SQL Injection425
- CWE-74Injection304
- CWE-119Memory Buffer Bounds196
- CWE-94Code Injection140
- CWE-476NULL Pointer Dereference131
- CWE-121116
- CWE-22Path Traversal116
- CWE-434Unrestricted File Upload113
- CWE-125Out-of-bounds Read111
- CWE-284Improper Access Control110
- CWE-862Missing Authorization106
- CWE-78OS Command Injection98
- CWE-787Out-of-bounds Write93
- CWE-416Use After Free91
- CWE-20Improper Input Validation77
- CWE-122Heap Buffer Overflow72
- CWE-120Buffer Overflow66
- CWE-200Information Exposure63
- CWE-352CSRF62
Where it landed
The month's CVEs by the sector of the software they affect. A CVE that touches several sectors counts in each.
- Operating Systems90818% of sector-tagged CVEs
- Web & CMS Plugins84317% of sector-tagged CVEs
- Enterprise Software51710% of sector-tagged CVEs
- OSS Libraries4349% of sector-tagged CVEs
- Consumer Software3537% of sector-tagged CVEs
- Networking Infrastructure3257% of sector-tagged CVEs
- ICS / OT / IoT2595% of sector-tagged CVEs
- 8 smaller sectors965
- Not yet classified341
Which weakness, where
The top weakness classes against the vendors and the sectors that carried them.
The lighter the cell, the more CVEs. Point at one to read it.
| By vendor | 79XSS | 89SQL Injection | 74Injection | 119Memory Buffer Bounds | 94Code Injection | 476NULL Pointer Dereference | 121 | 22Path Traversal | 434Unrestricted File Upload | 125Out-of-bounds Read |
|---|---|---|---|---|---|---|---|---|---|---|
| Сообщество Свободного Программного Обеспечения | 3 | 7 | 3 | 3 | 3 | 101 | 7 | 1 | 32 | |
| Linux | 86 | 26 | ||||||||
| Ооо «ред Софт» | 2 | 1 | 5 | 2 | 76 | 2 | 23 | |||
| Ооо «русбитех-астра» | 1 | 11 | 2 | 70 | 2 | 24 | ||||
| Red Hat Inc. | 5 | 1 | 45 | 19 | ||||||
| Ао «нппкт» | 5 | 1 | 39 | 2 | 18 | |||||
| Ао «сбертех» | 2 | 41 | 2 | 11 | ||||||
| Debian | 44 | 16 | ||||||||
| Ао «ивк» | 1 | 6 | 1 | 33 | 2 | 17 | ||||
| code-projects | 4 | 134 | 134 | 4 | 14 | |||||
| Microsoft Corp | 1 | 2 | 3 | 13 | ||||||
| Microsoft | 1 | 2 | 3 | 13 |
CVEs published in July 2025
36 vulnerabilities from this month that were exploited in the wild (CISA KEV), covered in the news, explained on cve.tools or searched for. Known-exploited first, then by CVSS.
- CVE-2025-20337Cisco ISE API Unauthenticated Remote Code Execution VulnerabilityKEV10.0
- CVE-2025-47812In Wing FTP Server before 7.4.4. the user and admin web interfaces mishandle '\0' bytes, ultimately allowing injection of arbitrary Lua code into user session files. This can be used to execute arb...KEV10.0
- CVE-2025-25257An improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability [CWE-89] vulnerability in Fortinet FortiWeb 7.6.0 through 7.6.3, FortiWeb 7.4.0 through 7.4.7, ...KEV9.8
- CVE-2025-53770Microsoft SharePoint Server Remote Code Execution VulnerabilityKEV9.8
- CVE-2025-54068Livewire vulnerable to remote command execution during property update hydrationKEV9.8
- CVE-2025-54309CrushFTP 10 before 10.8.5 and 11 before 11.3.4_23, when the DMZ proxy feature is not used, mishandles AS2 validation and consequently allows remote attackers to obtain admin access via HTTPS, as ex...KEV9.0
- CVE-2025-31277The issue was addressed with improved memory handling. This issue is fixed in Safari 18.6, iOS 18.6 and iPadOS 18.6, macOS Sequoia 15.6, tvOS 18.6, visionOS 2.6, watchOS 11.6. Processing maliciousl...KEV8.8
- CVE-2025-49704Microsoft SharePoint Remote Code Execution VulnerabilityKEV8.8
- CVE-2025-6558Insufficient validation of untrusted input in ANGLE and GPU in Google Chrome prior to 138.0.7204.157 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chro...KEV8.8
- CVE-2025-48384Git allows arbitrary code execution through broken config quotingKEV8.0
- CVE-2025-38352posix-cpu-timers: fix race between handle_posix_cpu_timers() and posix_cpu_timer_del()KEV7.8
- CVE-2025-54313eslint-config-prettier 8.10.1, 9.1.1, 10.1.6, and 10.1.7 has embedded malicious code for a supply chain compromise. Installing an affected package executes an install.js file that launches the node...KEV7.5
- CVE-2025-49706Microsoft SharePoint Server Spoofing VulnerabilityKEV6.5
- CVE-2025-47813loginok.html in Wing FTP Server before 7.4.4 discloses the full local installation path of the application when using a long value in the UID cookie.KEV4.3
- CVE-2025-20309Cisco Unified Communications Manager Static SSH Credentials Vulnerability10.0
- CVE-2025-34054AVTECH IP camera, DVR, and NVR Devices Unauthenticated Command Injection10.0
- CVE-2025-53833LaRecipe is vulnerable to Server-Side Template Injection attacks10.0
- CVE-2020-36847Simple File List < 4.2.3 - Remote Code Execution9.8
- CVE-2025-7852WPBookit <= 1.0.6 - Unauthenticated Arbitrary File Upload via image_upload_handle Function9.8
- CVE-2015-10144Responsive Thumbnail Slider < 1.0.1 - Authenticated (Subscriber+) Arbitrary File Upload8.8
- CVE-2025-40737A vulnerability has been identified in SINEC NMS (All versions < V4.0). The affected application does not properly validate file paths when extracting uploaded ZIP files. This could allow an attack...8.8
- CVE-2025-7945D-Link DIR-513 formSetWanDhcpplus buffer overflow8.8
- CVE-2025-8184D-Link DIR-513 HTTP POST Request formSetWanL2TPtriggers formSetWanL2TPcallback stack-based overflow8.8
- CVE-2013-3307Linksys E1000 devices through 2.1.02, E1200 devices before 2.0.05, and E3200 devices through 1.0.04 allow OS command injection via shell metacharacters in the apply.cgi ping_ip parameter on TCP por...8.3
- CVE-2025-6023An open redirect vulnerability has been identified in Grafana OSS that can be exploited to achieve XSS attacks. The vulnerability was introduced in Grafana v11.5.0. The open redirect can be chaine...7.6
- CVE-2025-34057Ruijie NBR Router Administrative Credential Disclosure7.5
- CVE-2025-81731000 Projects ABC Courier Management System Add_reciver.php sql injection7.3
- CVE-2024-13973A post-auth SQL injection vulnerability in WebAdmin of Sophos Firewall versions older than 21.0 MR1 (21.0.1) can potentially lead to administrators achieving arbitrary code execution.6.8
- CVE-2025-54015WordPress HT Contact Form 7 plugin <= 2.0.0 - Local File Inclusion Vulnerability6.6
- CVE-2025-20283Cisco Identity Services Engine Authenticated Remote Code Execution Vulnerability6.5
- CVE-2025-53771Microsoft SharePoint Server Spoofing Vulnerability6.5
- CVE-2025-40598A Reflected cross-site scripting (XSS) vulnerability exists in the SMA100 series web interface, allowing a remote unauthenticated attacker to potentially execute arbitrary JavaScript code.6.1
- CVE-2025-51401A stored cross-site scripting (XSS) vulnerability in the chat transfer function of Live Helper Chat v4.60 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload i...5.4
- CVE-2025-7565LB-LINK BL-AC3600 Web Management Interface lighttpd.cgi geteasycfg information disclosure5.3
- CVE-2025-7207mruby nregs codegen.c scope_new heap-based overflow3.3
- CVE-2013-10037WebTester 5.x install2.php Unauthenticated Command Execution