August 2025
3,871 CVEs published, −5% on July 2025 and +28% on August 2024. CISA added 15 to KEV.
2025 month by month
- Critical
- 34310% of the 3,461 with a CVSS score
- Added to CISA KEV
- 1510 of this month's CVEs are in KEV, listed a median 4.5 days after publication
- Vendors
- 1,5295,309 products
- Top weakness
- XSSCWE-79 · 570 CVEs
Who drove it
Vendors by distinct CVEs this month, with how many of those CVEs are now in CISA KEV and how far each moved in the ranking.
- 1Сообщество Свободного Программного ОбеспеченияLinux, Debian Gnu/linux, Gpac27610nonenew
- 2Ооо «ред Софт»Ред Ос, Ред База Данных2389nonenew
- 3LinuxLinux, Linux Kernel1860nonenew
- 4Ооо «русбитех-астра»Astra Linux Special Edition, Astra Linux Common Edition1683nonenew
- 5MicrosoftWindows Server 2025 (Server Core Installation), Windows Server 2025, Windows Server 2022, 23h2 Edition (Server Core Installation)1248nonenew
- 6Ао «ивк»Альт Сп 10, Альт 8 Сп1033nonenew
- 7MavenCom.liferay.portal:release.portal.bom, Org.pytorch:executorch-android, Com.liferay.portal:release.dxp.bom8110nonenew
- 8AdobeAdobe Indesign, Indesign, Indesign Desktop7911new
- 9Red HatRed Hat Enterprise Linux, Red Hat Enterprise Linux 9, Red Hat Enterprise Linux 8792nonenew
- 10DebianDebian Linux, Devscripts771nonenew
- 11GoGithub.com/mattermost/mattermost-plugin-confluence, Github.com/mattermost/mattermost/server/v8, Github.com/mattermost/mattermost-server756nonenew
- 12PyPIPicklescan, Executorch, Apache-superset759nonenew
- 13Ао "нппкт"Осон Основа Оnyx753nonenew
- 14CanonicalUbuntu721nonenew
- 15Ао «сбертех»Platform V Sberlinux OS Server, Субд «platform V Pangolin Db»720nonenew
- 16code-projectsOnline Medicine Guide, Human Resource Integrated System, Simple Grading System540nonenew
- 17ItsourcecodeApartment Management System, Online Tour and Travel Management System, Sports Management System530nonenew
- 18HuaweiHarmonyos, Emui, Enzoh-w5611t Firmware520nonenew
- 19GoogleAndroid, Chrome, Google Chrome515nonenew
- 20npm@anthropic-ai/claude-code, Next, Flowise519nonenew
- 21LinksysRE6300 Firmware, RE6350, RE6350 Firmware500nonenew
- 22CiscoCisco Firepower Threat Defense Software, Cisco Adaptive Security Appliance (ASA) Software, Firepower Threat Defense481nonenew
- 23PortabilisI-educar, I-diario480nonenew
- 24TendaAC6 Firmware, AC20 Firmware, AC20474nonenew
- 25LiferayDxp, Digital Experience Platform, Portal462nonenew
Severity
How this month's CVEs score on CVSS; 410 have no score yet. Severity is not exploitation.
- Critical343
- High1,275
- Medium1,599
- Low244
Breakouts
Vendors with at least three times their own 12-month median.
New in the top 100
Not in the top 100 in any of the 24 months before.
What kind of weakness
Weakness classes (CWE) by distinct CVEs, with how far each moved in the ranking.
- CWE-79XSS570
- CWE-89SQL Injection323
- CWE-74Injection216
- CWE-94Code Injection190
- CWE-121151
- CWE-78OS Command Injection151
- CWE-862Missing Authorization109
- CWE-22Path Traversal107
- CWE-476NULL Pointer Dereference104
- CWE-284Improper Access Control100
- CWE-416Use After Free98
- CWE-434Unrestricted File Upload95
- CWE-119Memory Buffer Bounds93
- CWE-352CSRF88
- CWE-77Command Injection82
- CWE-125Out-of-bounds Read80
- CWE-200Information Exposure76
- CWE-787Out-of-bounds Write68
- CWE-122Heap Buffer Overflow66
- CWE-20Improper Input Validation64
Where it landed
The month's CVEs by the sector of the software they affect. A CVE that touches several sectors counts in each.
- Web & CMS Plugins88220% of sector-tagged CVEs
- Enterprise Software61714% of sector-tagged CVEs
- Operating Systems58414% of sector-tagged CVEs
- OSS Libraries49611% of sector-tagged CVEs
- Networking Infrastructure3187% of sector-tagged CVEs
- Hardware Firmware2406% of sector-tagged CVEs
- Consumer Software1854% of sector-tagged CVEs
- 8 smaller sectors671
- Not yet classified326
Which weakness, where
The top weakness classes against the vendors and the sectors that carried them.
The lighter the cell, the more CVEs. Point at one to read it.
| By vendor | 79XSS | 89SQL Injection | 74Injection | 94Code Injection | 121 | 78OS Command Injection | 862Missing Authorization | 22Path Traversal | 476NULL Pointer Dereference | 284Improper Access Control |
|---|---|---|---|---|---|---|---|---|---|---|
| Сообщество Свободного Программного Обеспечения | 5 | 1 | 4 | 2 | 2 | 59 | ||||
| Ооо «ред Софт» | 4 | 1 | 2 | 4 | 44 | 1 | ||||
| Linux | 44 | |||||||||
| Ооо «русбитех-астра» | 4 | 2 | 32 | |||||||
| Microsoft | 1 | 3 | 1 | 1 | 3 | 4 | ||||
| Microsoft Corp | 1 | 3 | 1 | 1 | 3 | 3 | ||||
| Ао «ивк» | 1 | 23 | ||||||||
| Maven | 24 | 1 | 1 | 1 | 1 | |||||
| Adobe | 10 | 1 | 1 | 1 | ||||||
| Debian | 18 | |||||||||
| Go | 1 | 2 | 1 | 7 | 6 | 2 | 1 | |||
| PyPI | 2 | 1 | 5 | 2 |
CVEs published in August 2025
34 vulnerabilities from this month that were exploited in the wild (CISA KEV), covered in the news, explained on cve.tools or searched for. Known-exploited first, then by CVSS.
- CVE-2025-43300An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 15.8.5 and iPadOS 15.8.5, iOS 16.7.12 and iPadOS 16.7.12, iOS 18.6.2 and iPadOS 18.6.2, iPadOS 1...KEV10.0
- CVE-2025-54253Adobe Experience Manager | Incorrect Authorization (CWE-863)KEV10.0
- CVE-2025-57819FreePBX Affected by Authentication Bypass Leading to SQL Injection and RCEKEV9.8
- CVE-2025-7775Memory overflow vulnerability leading to Remote Code Execution and/or Denial of ServiceKEV9.8
- CVE-2025-54948A vulnerability in Trend Micro Apex One (on-premise) management console could allow a pre-authenticated remote attacker to upload malicious code and execute commands on affected installations.KEV9.4
- CVE-2025-6205Missing authorization vulnerability affecting DELMIA Apriso from Release 2020 through Release 2025KEV9.1
- CVE-2025-8088Path traversal vulnerability in WinRARKEV8.8
- CVE-2025-8876Command Injection VulnerabilityKEV8.8
- CVE-2025-6204Improper Control of Generation of Code (Code Injection) vulnerability affecting DELMIA Apriso from Release 2020 through Release 2025KEV8.0
- CVE-2025-8875Insecure Deserialization VulnerabilityKEV7.8
- CVE-2025-9377Authenticated RCE via Parental Control command injectionKEV7.2
- CVE-2025-55177Incomplete authorization of linked device synchronization messages in WhatsApp for iOS prior to v2.25.21.73, WhatsApp Business for iOS v2.25.21.78, and WhatsApp for Mac v2.25.21.78 could have allow...KEV5.4
- CVE-2010-20103ProFTPD 1.3.3c Backdoor Command Execution9.8
- CVE-2018-25115D-Link DIR-110/412/600/615/645/815 RCE via service.cgi9.8
- CVE-2025-55583D-Link DIR-868L B1 router firmware version FW2.05WWB02 contains an unauthenticated OS command injection vulnerability in the fileaccess.cgi component. The endpoint /dws/api/UploadFile accepts a pre...9.8
- CVE-2025-57772Dataease H2 JDBC RCE Bypass9.8
- CVE-2025-7441StoryChief <= 1.0.42 - Unauthenticated Arbitrary File Upload9.8
- CVE-2025-53120Securden Unified PAM Path Traversal In File Upload9.4
- CVE-2025-50989OPNsense before 25.1.8 contains an authenticated command injection vulnerability in its Bridge Interface Edit endpoint (interfaces_bridge_edit.php). The span POST parameter is concatenated into a s...9.1
- CVE-2025-20700In the Airoha Bluetooth audio SDK, there is a possible permission bypass that allows access critical data of RACE protocol through Bluetooth LE GATT service. This could lead to remote escalation of...8.8
- CVE-2025-20701In the Airoha Bluetooth audio SDK, there is a possible way to pair Bluetooth audio device without user consent. This could lead to remote escalation of privilege with no additional execution privil...8.8
- CVE-2025-20702In the Airoha Bluetooth audio SDK, there is a possible unauthorized access to the RACE protocol. This could lead to remote escalation of privilege with no additional execution privileges needed. Us...8.8
- CVE-2025-24999Microsoft SQL Server Elevation of Privilege Vulnerability8.8
- CVE-2025-53778Windows NTLM Elevation of Privilege Vulnerability8.8
- CVE-2025-41451Post-Authentication OS Command Injection RCE in Danfoss AK-SM8xxA Series8.2
- CVE-2024-26009An authentication bypass using an alternate path or channel [CWE-288] vulnerability in Fortinet FortiOS 6.4.0 through 6.4.15, FortiOS 6.2.0 through 6.2.16, FortiOS 6.0 all versions, FortiPAM 1.2.0,...8.1
- CVE-2025-8811code-projects Simple Art Gallery registration.php sql injection7.3
- CVE-2025-9533TOTOLINK T10 formLoginAuth.htm improper authentication7.3
- CVE-2025-54136Cursor's Modification of MCP Server Definitions Bypasses Manual Re-approvals7.2
- CVE-2024-32589WordPress Barcode Scanner and Inventory manager plugin <= 1.5.3 - Broken Access Control to XSS vulnerability7.1
- CVE-2025-53760Microsoft SharePoint Elevation of Privilege Vulnerability7.1
- CVE-2025-54867Youki Symlink Following Vulnerability7.0
- CVE-2025-9095ExpressGateway express-gateway REST Endpoint users.js cross site scripting3.5
- CVE-2025-9096ExpressGateway express-gateway REST Endpoint apps.js cross site scripting3.5