June 2025

June 2025 closed with 3,875 published CVEs — +16.3% YoY . 293 criticals, 20 added to CISA KEV (1 ransomware-linked). сообщество свободного программного обеспечения led volume, mostly via linux. Biggest breakout: phpgurukul at ×14.5 their 12-month median. Top weakness class — CWE-79 (737 CVE). 10 vendors cracked the top-100 for the first time.

Time to exploit

How fast the community ships detection after a CVE drops.

• KEV 4microsoft76 CVE
• KEV 2ооо «русбитех-астра»124 CVE
• KEV 2ао "нппкт"113 CVE
• KEV 2google21 CVE

Top vendors

Ranked by distinct CVE count this period.

• 1сообщество свободного программного обеспечения—
  407 CVE21 critCVSS 6.2
  Nuclei 3PoC 19
  linux (301) · debian gnu/linux (179) · xwiki platform (9)
• 2linux—
  375 CVECVSS 6.0
  PoC 2
  linux (375) · linux kernel (375)
• 3adobe—
  260 CVECVSS 5.7
  ×4.4
  adobe experience manager (229) · experience manager (224) · adobe acrobat document cloud (10)
• 4redhat—
  259 CVE7 critCVSS 6.7
  KEV 1Nuclei 1PoC 5
  red hat enterprise linux (237) · red hat enterprise linux 9 (28) · red hat enterprise linux 8 (27)
• 5ооо «ред софт»—
  154 CVE12 critCVSS 6.4
  KEV 4Nuclei 3PoC 12
  ред ос (154)
• 6code-projects—
  153 CVE1 critCVSS 6.7
  ×9.0Nuclei 1PoC 145
  inventory management system (20) · simple pizza ordering system (14) · online shoe store (12)
• 7canonical—
  145 CVE3 critCVSS 6.2
  KEV 1Nuclei 1PoC 4
  ubuntu (143) · cloud-init (2) · authd (1)
• 8ооо «русбитех-астра»—
  124 CVE10 critCVSS 6.7
  KEV 2PoC 10
  astra linux special edition (121) · astra linux common edition (29) · пк "ald pro" (2)
• 9phpgurukul—
  123 CVECVSS 6.2
  ×14.5PoC 112
  art gallery management system (9) · pre-school enrollment system (9) · complaint management system (9)
• 10ао "нппкт"—
  113 CVE10 critCVSS 6.6
  KEV 2PoC 9
  осон основа оnyx (113)
• 11totolink—
  78 CVE2 critCVSS 7.9
  ×3.1PoC 65
  x15 (20) · x15 firmware (20) · ex1200t firmware (19)
• 12microsoft—
  76 CVE2 critCVSS 7.1
  KEV 4PoC 3
  windows server 2025 (server core installation) (43) · windows server 2025 (43) · windows server 2022 (42)
• 13ао «сбертех»—
  76 CVE2 critCVSS 6.1
  PoC 4
  platform v sberlinux os server (76)
• 14fabian—
  65 CVECVSS 6.5
  ×10.8Nuclei 1PoC 65
  simple online hotel reservation system (11) · school fees payment system (9) · simple forum (8)
• 15ао «ивк»—
  64 CVE6 critCVSS 6.6
  PoC 5
  альт сп 10 (36) · альт 8 сп (35)
• 16maven—
  58 CVE9 critCVSS 7.3
  Nuclei 4PoC 5
  org.geoserver.web:gs-web-app (6) · org.geoserver:gs-wfs (3) · org.apache.tomcat.embed:tomcat-embed-core (3)
• 17debian—
  55 CVE6 critCVSS 6.4
  ×4.6KEV 2Nuclei 2PoC 4
  debian linux (50) · yubiserver (2) · pdns (1)
• 18sourcecodester—
  52 CVECVSS 5.4
  PoC 50
  best salon management system (21) · student result management system (10) · simple company website (7)
• 19go—
  50 CVE4 critCVSS 6.1
  Nuclei 1PoC 10
  github.com/filebrowser/filebrowser/v2 (8) · github.com/mattermost/mattermost/server/v8 (7) · github.com/mattermost/mattermost-server (7)
• 20novell inc.—
  49 CVE6 critCVSS 6.4
  KEV 1Nuclei 1PoC 2
  opensuse leap (47) · suse linux enterprise server (47) · suse linux enterprise server for sap applications (47)
• 21ibm—
  48 CVE3 critCVSS 6.3
  qradar suite software (5) · infosphere information server (5) · cloud pak for security (5)
• 22pypi—
  47 CVE6 critCVSS 6.7
  PoC 6
  salt (9) · backend.ai (3) · langchain-chatchat (3)
• 23dlink—
  44 CVE7 critCVSS 8.1
  PoC 33
  dir-619l firmware (14) · dir-619l (14) · dir-816 firmware (7)
• 24d-link—
  41 CVE5 critCVSS 8.0
  PoC 32
  dir-619l (14) · dir-816 (6) · di-7300g+ (4)
• 25ibm corp.—
  39 CVE3 critCVSS 6.4
  qradar suite software (5) · ibm cloud pak for security (5) · ibm planning analytics local (4)
• 26packagist—
  39 CVE2 critCVSS 6.3
  KEV 1Nuclei 2PoC 4
  starcitizentools/citizen-skin (5) · magento/community-edition (5) · magento/project-community-edition (4)
• 27tenda—
  39 CVECVSS 8.3
  PoC 34
  ac6 firmware (7) · ac5 firmware (5) · ac5 (5)
• 28shenzhen tenda technology co., ltd.—
  37 CVECVSS 8.2
  PoC 33
  ac6 (6) · tenda ac15 (4) · tenda ac9 (4)
• 29npm—
  34 CVE7 critCVSS 6.4
  Nuclei 1PoC 9
  erxes (3) · webpack-dev-server (2) · @haxtheweb/haxcms-nodejs (2)
• 30samsung—
  30 CVE6 critCVSS 7.3
  exynos 1480 firmware (9) · exynos 2400 firmware (9) · exynos 2200 firmware (8)
• 31trendmicro—
  28 CVE6 critCVSS 7.9
  trend micro endpoint encryption (8) · apex central (8) · trend micro apex central (8)
• 32trend micro, inc.—
  28 CVE6 critCVSS 7.9
  trend micro apex central (8) · trend micro endpoint encryption policy server (8) · trend micro apex one as a service (5)
• 33unknown—
  24 CVE2 critCVSS 5.8
  Nuclei 23PoC 24
  newsletter (3) · file provider (2) · buddypress docs (1)
• 34pdf-xchange—
  23 CVECVSS 5.3
  pdf-tools (23) · pdf-xchange editor (23) · pdf-xchange pro (3)
• 35tracker software products ltd.—
  23 CVECVSS 5.3
  pdf-tools (23) · pdf-xchange editor (23) · pdf-xchange pro (23)
• 36carmelo—
  22 CVECVSS 6.5
  NEWPoC 18
  simple pizza ordering system (14) · traffic offense reporting system (4) · movie ticketing system (2)
• 37apache—
  21 CVE5 critCVSS 7.9
  Nuclei 1PoC 1
  cloudstack (5) · kafka (3) · tomcat (3)
• 38apache software foundation—
  21 CVE5 critCVSS 8.0
  Nuclei 1PoC 1
  apache cloudstack (5) · tomcat (3) · kafka (3)
• 39campcodes—
  21 CVECVSS 7.3
  ×3.5PoC 21
  online hospital management system (6) · online teacher record management system (5) · sales and inventory system (5)
• 40drupal—
  21 CVECVSS 6.8
  NEW
  simple klaro (2) · quick node block (2) · cookies consent management (2)
• 41fedora project—
  21 CVE2 critCVSS 6.0
  PoC 3
  fedora (19) · fedora epel (12) · nbdkit plugin framework (2)
• 42google—
  21 CVE1 critCVSS 7.4
  KEV 2PoC 1
  google chrome (10) · chrome (10) · android (4)
• 43mayurik—
  21 CVECVSS 6.3
  PoC 21
  best salon management system (21)
• 44qnap—
  21 CVECVSS 7.6
  file station 5 (14) · file station (13) · quts hero (2)
• 45gitlab—
  20 CVECVSS 5.9
  PoC 11
  gitlab (20)
• 46sick—
  20 CVECVSS 5.8
  field analytics (12) · media server (10) · logistic diagnostic analytics (3)
• 47sick ag—
  20 CVECVSS 5.8
  sick field analytics (9) · sick media server (9) · tire analytics (3)
• 48ооо «нцпр»—
  20 CVE3 critCVSS 7.1
  PoC 2
  мсвсфера (20)
• 49gitlab inc.—
  19 CVECVSS 5.9
  PoC 11
  gitlab (19)
• 50cisco—
  18 CVE4 critCVSS 6.4
  KEV 1Nuclei 1PoC 18
  cisco unified contact center express (6) · unified contact center express (6) · cisco identity services engine software (5)

Top weaknesses

CWE classes by distinct CVE count.

Sectors

Solution categories ranked by distinct CVE count this period.

• Web & CMS Plugins1,052 CVE
  86 crit502 vendorsCVSS 7.8
  best salon management system (21) · inventory management system (20) · dm corporative cms (18)
• Operating Systems734 CVE
  286 crit197 KEV51 vendorsCVSS 7.1
  linux (676) · linux kernel (375) · red hat enterprise linux (237)
• Enterprise Software441 CVE
  50 crit5 KEV108 vendorsCVSS 7.4
  art gallery management system (9) · complaint management system (9) · pre-school enrollment system (9)
• OSS Libraries420 CVE
  73 crit1 KEV123 vendorsCVSS 8.7
  geoserver (12) · deno (8) · cpython (6)
• Consumer Software382 CVE
  20 crit2 KEV45 vendorsCVSS 8.1
  adobe experience manager (447) · experience manager (224) · pdf-tools (46)
• Networking Infrastructure328 CVE
  162 crit8 KEV71 vendorsCVSS 9.8
  x15 (20) · x15 firmware (20) · ex1200t (19)
• Hardware Firmware212 CVE
  680 crit389 KEV64 vendorsCVSS 7.9
  volkswagen mib3 infotainment system mib3 oi mqb (12) · qcs-ax2-a12 firmware (8) · qcs-ax2-s5 firmware (8)
• ICS / OT / IoT149 CVE
  85 crit58 vendorsCVSS 8.4
  field analytics (15) · media server (11) · sick field analytics (9)
• Security Products132 CVE
  34 crit69 vendorsCVSS 7.7
  trend micro apex central (16) · apex one (9) · apex central (8)
• Cloud & SaaS121 CVE
  16 crit8 KEV55 vendorsCVSS 7.6
  диспетчер подключений виртуальных рабочих мест термидеск (13) · salt (11) · vmware nsx (9)
• Mobile Apps70 CVE
  11 crit15 KEV10 vendorsCVSS 9.8
  android (12) · harmonyos (11) · chrome (10)
• Databases64 CVE
  5 crit16 vendorsCVSS 7.8
  ibm cloud pak for security (5) · qradar suite software (5) · cognos analytics (4)
• DevTools & CI64 CVE
  5 crit23 vendorsCVSS 9.8
  gitlab (39) · git-annex (2) · gogs (2)
• Communications53 CVE
  23 crit4 KEV33 vendorsCVSS 7.7
  011209 sip emergency intercom (5) · 011209 sip emergency intercom firmware (4) · cyberdata 011209 sip emergency intercom (4)
• AI / ML41 CVE
  9 crit36 vendorsCVSS 7.3
  fastgpt (4) · llama.cpp (4) · backendai (3)
• Unclassified363 CVE
  41 crit186 vendorsCVSS 6.8
  мсвсфера (20) · dir-619l (14) · blogbook (8)