CVE Tools
Sign in
month report

July 2025

Data as of Jun 11, 2026, 06:05 UTCSnapshot v1 Sources CVEList V5+NVD+GHSA+CSAF+FSTEC BDU+CISA KEV+EPSS+Nuclei templates Methodology →

July 2025 closed with 4,086 published CVEs — +25.8% YoY . 368 criticals, 20 added to CISA KEV (4 ransomware-linked). сообщество свободного программного обеспечения led volume, mostly via linux. Biggest breakout: debian at ×40.2 their 12-month median. Top weakness class — CWE-79 (483 CVE). 10 vendors cracked the top-100 for the first time.

Print view
Total CVEs
4,086
— MoM+25.8% YoY
Severity mix
368 / 1,455
critical / high
KEV added
20
4 ransomware-linked
Nuclei coverage
11.4%
467 CVEs with templates

Time to exploit

How fast the community ships detection after a CVE drops.

Days → Nuclei (median)
233.4
n=467
Within 7 days
0.0%
Within 30 days
0.0%
Days → KEV (median)
14
n=14
Detection gap

KEV pressure, no Nuclei coverage

July 2025 · vendors with active exploitation listed by CISA but no public detection template.

Weakness × Vendor

What's spreading where in July 2025

Cells shaded by share of vendor's hottest weakness. Click any cell to open the CWE history.

79XSS89SQL Injection74Injection119Memory Buffer Bounds94Code Injection476NULL Pointer Dereference121CWE-12122Path Traversal434Unrestricted File Upload125Out-of-bounds Readсообщество свободного программного обеспечения373331017132linux8626ооо «ред софт»215276223ооо «русбитех-астра»111270224red hat inc.514519ао «нппкт»5139218ао «сбертех»241211debian4416ао «ивк»16133217code-projects4134134414microsoft corp12313microsoft12313

Most discussed CVEs — July 2025

No CVE mentions in the news this month yet.

Breakout vendors

CVE count ≥3× their own 12-period median.

First time in top-100

Vendors never in top-100 in the prior 24 periods.

Top vendors

Ranked by distinct CVE count this period.

  • 1сообщество свободного программного обеспечения—
    536 CVE18 critCVSS 6.3
    KEV 1Nuclei 2PoC 26
    linux (406) · debian gnu/linux (140) · gpac (22)
  • 2linux—
    401 CVECVSS 6.1
    KEV 1PoC 1
    linux (401) · linux kernel (401)
  • 3ооо «ред софт»—
    395 CVE6 critCVSS 6.3
    KEV 3Nuclei 2PoC 15
    ред ос (395)
  • 4ооо «русбитех-астра»—
    372 CVE8 critCVSS 6.5
    KEV 3PoC 11
    astra linux special edition (372) · astra linux common edition (47)
  • 5redhat—
    294 CVE2 critCVSS 6.3
    PoC 7
    red hat enterprise linux (275) · red hat enterprise linux 8 (19) · red hat enterprise linux 9 (19)
  • 6ао "нппкт"—
    236 CVE6 critCVSS 6.4
    KEV 3PoC 7
    осон основа оnyx (236)
  • 7ао «сбертех»—
    228 CVE3 critCVSS 6.2
    KEV 2PoC 5
    platform v sberlinux os server (228)
  • 8debian—
    201 CVECVSS 6.2
    ×40.2KEV 3PoC 1
    debian linux (200) · dpkg (1)
  • 9ао «ивк»—
    178 CVE8 critCVSS 6.5
    KEV 2PoC 7
    альт 8 сп (131) · альт сп 10 (53)
  • 10code-projects—
    154 CVECVSS 7.0
    ×14.7PoC 154
    exam form submission (20) · online appointment booking system (14) · church donation system (14)
  • 11microsoft—
    149 CVE5 critCVSS 7.6
    KEV 4Nuclei 3PoC 4
    windows server 2025 (server core installation) (97) · windows server 2025 (97) · windows server 2022 23h2 (94)
  • 12canonical—
    118 CVE2 critCVSS 6.4
    PoC 6
    ubuntu (112) · juju (3) · juju\/utils (1)
  • 13cadsofttools—
    91 CVECVSS 7.8
    NEW
    cadimage (91)
  • 14irfanview—
    91 CVECVSS 7.8
    NEW×18.2
    irfanview (91)
  • 15phpgurukul—
    86 CVECVSS 5.8
    ×21.5Nuclei 1PoC 84
    vehicle parking management system (13) · apartment visitors management system (9) · online fire reporting system (9)
  • 16apple—
    85 CVE25 critCVSS 7.2
    KEV 3
    macos (78) · ipados (29) · iphone os (25)
  • 17oracle—
    85 CVE1 critCVSS 5.9
    mysql server (29) · mysql (28) · e-business suite (9)
  • 18adobe—
    73 CVE3 critCVSS 6.8
    Nuclei 1
    adobe framemaker (15) · framemaker (15) · coldfusion (13)
  • 19maven—
    69 CVE6 critCVSS 6.7
    Nuclei 1PoC 1
    org.glassfish.main.admingui:console-common (5) · org.keycloak:keycloak-services (4) · org.jenkins-ci.plugins:applitools-eyes (3)
  • 20novell inc.—
    68 CVE2 critCVSS 6.3
    PoC 8
    opensuse leap (61) · suse linux enterprise server (60) · suse linux enterprise server for sap applications (59)
  • 21campcodes—
    65 CVECVSS 6.9
    ×10.8PoC 63
    employee management system (10) · payroll management system (9) · courier management system (8)
  • 22tenda—
    63 CVECVSS 8.5
    PoC 54
    fh451 firmware (15) · fh451 (15) · o3v2 (10)
  • 23npm—
    59 CVE4 critCVSS 6.9
    KEV 1Nuclei 2PoC 7
    @haxtheweb/haxcms-nodejs (6) · directus (4) · @finos/git-proxy (4)
  • 24shenzhen tenda technology co., ltd.—
    57 CVECVSS 8.5
    PoC 49
    tenda fh451 (14) · tenda o3 (10) · tenda fh1201 (8)
  • 25ibm—
    54 CVECVSS 6.1
    db2 (8) · openpages with watson (6) · cognos analytics mobile (4)
  • 26pypi—
    51 CVE5 critCVSS 7.0
    Nuclei 1PoC 18
    transformers (5) · pyload-ng (5) · openexr (3)
  • 27irfan skiljan—
    42 CVECVSS 7.7
    NEW
    irfanview (42)
  • 28samsung—
    41 CVE12 critCVSS 7.9
    magicinfo 9 server (18) · android (12) · data management server firmware (6)
  • 29anisha—
    37 CVECVSS 7.3
    NEWPoC 37
    online appointment booking system (14) · job diary (5) · jonnys liquor (3)
  • 30crates.io—
    36 CVECVSS 4.1
    sequoia-openpgp (4) · cosmwasm-std (2) · curve25519-dalek (2)
  • 31fabian—
    36 CVECVSS 6.5
    ×4.5PoC 36
    online ordering system (7) · voting system (7) · chat system (5)
  • 32go—
    34 CVE7 critCVSS 7.3
    Nuclei 2PoC 4
    github.com/mattermost/mattermost/server/v8 (3) · github.com/lf-edge/ekuiper/v2 (3) · github.com/mattermost/mattermost-server (3)
  • 33totolink—
    33 CVE3 critCVSS 8.1
    PoC 30
    t6 firmware (13) · t6 (13) · a702r firmware (6)
  • 34jenkins—
    32 CVECVSS 5.9
    jenkins applitools eyes plugin (3) · applitools eyes (3) · jenkins readyapi functional testing plugin (2)
  • 35ibm corp.—
    31 CVECVSS 5.9
    ibm db2 connect server (8) · ibm db2 (8) · ibm openpages (5)
  • 36labredescefetrj—
    31 CVE3 critCVSS 7.1
    NEWPoC 15
    wegia (31)
  • 37wegia—
    31 CVE3 critCVSS 7.1
    NEWPoC 15
    wegia (31)
  • 38cd foundation—
    30 CVECVSS 5.9
    applitools eyes (3) · apica loadtest (2) · dead man's snitch (2)
  • 39wikimedia foundation—
    30 CVE3 critCVSS 6.4
    NEWPoC 1
    mediawiki - abusefilter extension (3) · mediawiki - checkuser extension (3) · mediawiki - securepoll extension (3)
  • 40sap—
    29 CVE5 critCVSS 6.1
    sap netweaver (4) · sap business warehouse (4) · sapcar (4)
  • 41dlink—
    28 CVE3 critCVSS 7.3
    PoC 24
    dir-513 (7) · di-8100 firmware (6) · dir-513 firmware (6)
  • 42sap_se—
    28 CVE5 critCVSS 6.1
    sapcar (4) · sap netweaver application server for abap (2) · sap businessobjects content administrator workbench (1)
  • 43qualcomm—
    26 CVE1 critCVSS 7.4
    fastconnect 7800 firmware (24) · wcd9380 firmware (22) · fastconnect 6900 firmware (22)
  • 44qualcomm, inc.—
    26 CVE1 critCVSS 7.6
    snapdragon (26)
  • 45d-link—
    25 CVE3 critCVSS 7.9
    PoC 21
    dir-513 (7) · di-8100 (6) · di-500wf (1)
  • 46packagist—
    25 CVE5 critCVSS 7.6
    KEV 1Nuclei 2PoC 9
    starcitizentools/citizen-skin (2) · codeigniter4/framework (2) · elmsln/haxcms (2)
  • 47samsung electronics—
    25 CVE11 critCVSS 8.4
    NEW
    magicinfo 9 server (18) · data management server (5) · wlan ap wea453e (1)
  • 48apache—
    24 CVE1 critCVSS 7.2
    PoC 1
    http server (9) · tomcat (3) · jspwiki (2)
  • 49apache software foundation—
    24 CVE1 critCVSS 7.2
    PoC 1
    http server (9) · apache http server (9) · tomcat (3)
  • 50carmelo—
    24 CVECVSS 6.9
    NEWPoC 24
    church donation system (14) · food ordering review system (3) · simple pizza ordering system (3)

Top weaknesses

CWE classes by distinct CVE count.

1CWE-79483—
2CWE-89425—
3CWE-74304—
4CWE-119196—
5CWE-94140—
6CWE-476131—
7CWE-121116—
8CWE-22116—
9CWE-434113—
10CWE-125111—
11CWE-284110—
12CWE-862106—
13CWE-7898—
14CWE-78793—
15CWE-41691—
16CWE-2077—
17CWE-12272—
18CWE-12066—
19CWE-20063—
20CWE-35262—

Sectors

Solution categories ranked by distinct CVE count this period.

  • Operating Systems908 CVE
    171 crit44 KEV38 vendorsCVSS 8.8
    linux (807) · linux kernel (401) · ред ос (395)
  • Web & CMS Plugins843 CVE
    93 crit1 KEV373 vendorsCVSS 7.5
    exam form submission (20) · http server (18) · church donation system (14)
  • Enterprise Software517 CVE
    51 crit1 KEV143 vendorsCVSS 8.0
    poly clariti manager (20) · glpi (16) · db2 (8)
  • OSS Libraries434 CVE
    51 crit13 KEV113 vendorsCVSS 7.6
    imagemagick (8) · axiom axiomjdk (7) · gnutls (7)
  • Consumer Software353 CVE
    41 crit1 KEV41 vendorsCVSS 8.5
    cadimage (91) · adobe framemaker (30) · coldfusion (26)
  • Networking Infrastructure325 CVE
    121 crit11 KEV78 vendorsCVSS 8.5
    junos (42) · junos os evolved (36) · junos os (21)
  • ICS / OT / IoT259 CVE
    107 crit75 vendorsCVSS 8.1
    endress+hauser meac300-fnade4 (19) · meac300-fnade4 firmware (19) · charx sec-3000 (18)
  • Mobile Apps172 CVE
    106 crit17 KEV14 vendorsCVSS 7.2
    macos (117) · ipados (50) · visionos (35)
  • Hardware Firmware166 CVE
    243 crit41 vendorsCVSS 7.6
    qconvergeconsole (16) · mt6890, mt7615, mt7622, mt7663, mt7915, mt7916, mt7981, mt7986 (7) · 3rd gen amd epyc (4)
  • Security Products152 CVE
    18 crit1 KEV75 vendorsCVSS 7.0
    conjur (5) · blitz identity provider (4) · onelogin active directory connector (adc) (3)
  • Databases145 CVE
    7 crit20 vendorsCVSS 6.6
    mysql server (51) · mysql (37) · vm virtualbox (14)
  • DevTools & CI103 CVE
    6 crit5 KEV35 vendorsCVSS 7.0
    applitools eyes (6) · apica loadtest (4) · nouvola divecloud (4)
  • Cloud & SaaS97 CVE
    45 crit1 KEV52 vendorsCVSS 7.7
    tableau server (8) · studentmanage (5) · n8n (4)
  • AI / ML72 CVE
    21 crit32 vendorsCVSS 8.2
    gpt-sovits (9) · gpt-sovits-webui (9) · llamaindex (8)
  • Communications58 CVE
    5 crit1 KEV31 vendorsCVSS 7.3
    clariti manager (7) · zoom (4) · avid nexis e-series (3)
  • Unclassified341 CVE
    67 crit2 KEV184 vendorsCVSS 7.2
    мсвсфера (22) · online appointment booking system (14) · quiter gateway (11)
Weakness × Sector

Which weaknesses hit which solution categories in July 2025

Cells shaded by share of the sector's hottest weakness. Click a row to open the sector history.

79XSS89SQL Injection74Injection119Memory Buffer Bounds94Code Injection476NULL Pointer Dereference121CWE-12122Path Traversal434Unrestricted File Upload125Out-of-bounds ReadOperating Systems62117411377158Web & CMS Plugins24125119742229651Enterprise Software12212697364147192OSS Libraries369916233221118Consumer Software26242274965131438Networking Infrastructure102131045280731ICS / OT / IoT16134711412104Hardware Firmware122341518213Security Products117311523Databases61224511