CVE Tools
Sign in
month report

November 2025

Data as of Jun 11, 2026, 06:05 UTCSnapshot v1 Sources CVEList V5+NVD+GHSA+CSAF+FSTEC BDU+CISA KEV+EPSS+Nuclei templates Methodology →

November 2025 closed with 3,194 published CVEs. 269 criticals, 11 added to CISA KEV. сообщество свободного программного обеспечения led volume, mostly via linux. Top weakness class — CWE-79 (432 CVE). 10 vendors cracked the top-100 for the first time.

Print view
Total CVEs
3,194
— MoM— YoY
Severity mix
269 / 966
critical / high
KEV added
11
0 ransomware-linked
Nuclei coverage
21.2%
676 CVEs with templates

Time to exploit

How fast the community ships detection after a CVE drops.

Days → Nuclei (median)
115.7
n=676
Within 7 days
0.0%
Within 30 days
0.0%
Days → KEV (median)
9
n=10
Detection gap

KEV pressure, no Nuclei coverage

November 2025 · vendors with active exploitation listed by CISA but no public detection template.

Weakness × Vendor

What's spreading where in November 2025

Cells shaded by share of vendor's hottest weakness. Click any cell to open the CWE history.

79XSS89SQL Injection862Missing Authorization74Injection284CWE-284787Out-of-bounds Write200Information Exposure434Unrestricted File Upload352CSRF22Path Traversalсообщество свободного программного обеспечения31151ооо «русбитех-астра»2121ооо «ред софт»1221413apple2227112microsoft corp3114422linuxgoogle19microsoft3114123go23145google inc17red hat inc.npm932

Most discussed CVEs — November 2025

No CVE mentions in the news this month yet.

First time in top-100

Vendors never in top-100 in the prior 24 periods.

Top vendors

Ranked by distinct CVE count this period.

  • 1сообщество свободного программного обеспечения—
    173 CVE5 critCVSS 5.9
    Nuclei 1PoC 11
    linux (97) · debian gnu/linux (95) · wpe webkit (11)
  • 2ооо «русбитех-астра»—
    164 CVE7 critCVSS 6.6
    KEV 1Nuclei 1PoC 12
    astra linux special edition (160) · astra linux common edition (61) · пк "ald pro" (1)
  • 3ооо «ред софт»—
    114 CVE4 critCVSS 6.3
    KEV 1Nuclei 1PoC 14
    ред ос (101) · ред база данных (13)
  • 4apple—
    113 CVECVSS 5.7
    KEV 1PoC 1
    macos (94) · ios and ipados (72) · ipados (69)
  • 5microsoft—
    109 CVE5 critCVSS 7.2
    KEV 3PoC 1
    windows 11 24h2 (37) · windows 11 version 24h2 (36) · windows 11 25h2 (36)
  • 6linux—
    104 CVECVSS 5.6
    linux (104) · linux kernel (2)
  • 7redhat—
    84 CVE2 critCVSS 6.8
    PoC 7
    red hat enterprise linux (64) · red hat enterprise linux 9 (14) · red hat enterprise linux 10 (13)
  • 8google—
    77 CVECVSS 6.5
    KEV 1PoC 7
    chrome (66) · google chrome (65) · android (8)
  • 9go—
    70 CVE5 critCVSS 6.1
    PoC 10
    github.com/mattermost/mattermost/server/v8 (10) · github.com/mattermost/mattermost-server (10) · kubevirt.io/kubevirt (7)
  • 10npm—
    57 CVE8 critCVSS 7.1
    KEV 1Nuclei 2PoC 14
    astro (6) · directus (4) · node-forge (3)
  • 11ао "нппкт"—
    54 CVE1 critCVSS 6.9
    KEV 1PoC 1
    осон основа оnyx (54)
  • 12ао «ивк»—
    48 CVE1 critCVSS 6.2
    PoC 3
    альт 8 сп (26) · альт сп 10 (24)
  • 13pypi—
    47 CVE4 critCVSS 6.9
    Nuclei 1PoC 11
    pgadmin4 (4) · trytond (3) · vllm (3)
  • 14ibm—
    40 CVE3 critCVSS 6.4
    db2 (9) · concert (7) · cloud pak for business automation (4)
  • 15packagist—
    39 CVE1 critCVSS 5.7
    Nuclei 1PoC 16
    mantisbt/mantisbt (4) · phppgadmin/phppgadmin (4) · drupal/core (4)
  • 16code-projects—
    38 CVECVSS 6.1
    PoC 37
    student information system (6) · responsive hotel site (6) · simple online hotel reservation system (4)
  • 17canonical—
    34 CVE2 critCVSS 6.1
    PoC 1
    ubuntu (34)
  • 18sourcecodester—
    34 CVECVSS 5.8
    PoC 33
    train station ticketing system (4) · best house rental management system (4) · baby care system (2)
  • 19ао «сбертех»—
    34 CVE1 critCVSS 6.4
    PoC 7
    platform v sberlinux os server (33) · субд «platform v pangolin db» (2)
  • 20itsourcecode—
    32 CVECVSS 6.9
    PoC 32
    inventory management system (7) · web-based internet laboratory management system (5) · covid tracking system (5)
  • 21maven—
    30 CVE2 critCVSS 6.6
    KEV 1Nuclei 1PoC 6
    org.geoserver:gs-wms (2) · org.geoserver.web:gs-web-app (2) · lsfusion.platform:web-client (2)
  • 22phpgurukul—
    30 CVE1 critCVSS 6.0
    PoC 28
    student record system (9) · online shopping portal (7) · complaint management system (5)
  • 23adobe—
    29 CVECVSS 7.3
    format plugins (9) · adobe format plugins (9) · illustrator on ipad (5)
  • 24fabian—
    29 CVECVSS 5.7
    PoC 28
    student information system (6) · responsive hotel site (6) · simple cafe ordering system (4)
  • 25dell—
    28 CVE3 critCVSS 7.5
    controlvault3 plus (8) · controlvault3 (8) · cloudlink (7)
  • 26dlink—
    28 CVE2 critCVSS 8.0
    PoC 22
    dwr-m920 (9) · dwr-m920 firmware (9) · dir-822k (8)
  • 27nvidia—
    27 CVE1 critCVSS 6.3
    dgx os (14) · dgx spark (14) · nvidia dgx os (13)
  • 28mediatek, inc.—
    25 CVECVSS 6.4
    mt6890, mt7615, mt7622, mt7663, mt7915, mt7916, mt7981, mt7986 (12) · mt2735, mt2737, mt6739, mt6761, mt6762, mt6762d, mt6762m, mt6763, mt6765, mt6765t, mt6767, mt6768, mt6769, mt6769k, mt6769s, mt6769t, mt6769z, mt6771, mt6813, mt6833, mt6833p, mt6835, mt6835t, mt6853, mt6853t, mt6855, mt6855t, mt6873, mt6875, mt6875t, mt6877, mt6877t, mt6877tt, mt6878, mt6878m, mt6879, mt6880, mt6883, mt6885, mt6886, mt6889, mt6890, mt6891, mt6893, mt6895, mt6895tt, mt6896, mt6897, mt6899, mt6980, mt6980d, mt6983, mt6983t, mt6985, mt6985t, mt6989, mt6989t, mt6990, mt6991, mt8666, mt8667, mt8673, mt8675, mt8676, mt8678, mt8765, mt8766, mt8766r, mt8768, mt8771, mt8786, mt8788, mt8788e, mt8791, mt8791t, mt8792, mt8793, mt8795t, mt8797, mt8798, mt8863, mt8873, mt8883, mt8893 (2) · mt2718, mt2737, mt6835, mt6878, mt6886, mt6897, mt6899, mt6982, mt6985, mt6986, mt6986d, mt6989, mt6990, mt6991, mt8676, mt8678, mt8755, mt8893 (2)
  • 29tenda—
    25 CVE1 critCVSS 7.9
    PoC 14
    ac21 firmware (8) · ax3 firmware (4) · ac21 (3)
  • 30samsung—
    24 CVE1 critCVSS 6.9
    exynos 1380 firmware (13) · exynos 2400 firmware (10) · exynos 2200 firmware (9)
  • 31campcodes—
    23 CVECVSS 6.0
    PoC 22
    school fees payment management system (8) · supplier management system (5) · retro basketball shoes online store (4)
  • 32advantech—
    22 CVE2 critCVSS 7.1
    NEWPoC 1
    webaccess/vpn (12) · webaccess\/vpn (12) · iview (5)
  • 33shenzhen tenda technology co., ltd.—
    22 CVE1 critCVSS 7.5
    PoC 13
    tenda ac21 (8) · tenda ax3 (4) · ax1803 (2)
  • 34intel—
    21 CVECVSS 5.8
    computing improvement program (11) · quickassist technology (10)
  • 35apache—
    19 CVE1 critCVSS 6.4
    openoffice (7) · cloudstack (2) · kvrocks (2)
  • 36apache software foundation—
    19 CVE1 critCVSS 6.4
    apache openoffice (7) · openoffice (7) · apache ofbiz (2)
  • 37huawei—
    19 CVE1 critCVSS 6.5
    harmonyos (19) · emui (3)
  • 38huawei technologies co., ltd.—
    19 CVE1 critCVSS 6.5
    NEW
    harmonyos (19) · emui (3)
  • 39unknown—
    19 CVE3 critCVSS 7.2
    Nuclei 19PoC 10
    ace user management (1) · age-restriction (1) · attention-bar (1)
  • 40dbbroadcast—
    18 CVE11 critCVSS 8.5
    NEWPoC 18
    mozart dds next 1000 firmware (17) · mozart dds next 100 firmware (17) · mozart dds next 2000 firmware (17)
  • 41fedora project—
    18 CVECVSS 5.9
    fedora (18) · fedora epel (18)
  • 42fortinet—
    18 CVE1 critCVSS 5.8
    KEV 2Nuclei 1PoC 1
    forticlientwindows (3) · fortiweb (3) · fortiadc (3)
  • 43fortinet inc.—
    18 CVE1 critCVSS 5.8
    KEV 2Nuclei 1PoC 1
    fortiadc (3) · forticlient windows (3) · fortios (3)
  • 44mediatek inc.—
    18 CVECVSS 7.1
    software development kit (15) · lr12a (3) · nr15 (3)
  • 45qnap—
    18 CVE2 critCVSS 6.7
    file station (9) · file station 5 (9) · download station (2)
  • 46sap—
    18 CVE2 critCVSS 6.2
    business connector (4) · sap business connector (sap bc) (4) · sap netweaver application server for abap and abap platform (2)
  • 47sap_se—
    18 CVE2 critCVSS 6.2
    sap business connector (4) · sap business one (sld) (1) · sap commoncryptolib (1)
  • 48advantech co., ltd—
    17 CVE2 critCVSS 6.9
    NEW
    advantech webaccess/vpn (12) · advantech iview (5)
  • 49angeljudesuarez—
    17 CVECVSS 6.9
    PoC 17
    online loan management system (5) · covid tracking system (5) · online voting system (4)
  • 50cisco—
    17 CVE2 critCVSS 6.1
    PoC 17
    cisco unified contact center express (6) · cisco catalyst center (5) · cisco digital network architecture center (dna center) (5)

Top weaknesses

CWE classes by distinct CVE count.

1CWE-79432—
2CWE-89262—
3CWE-862208—
4CWE-74154—
5CWE-284110—
6CWE-78788—
7CWE-20086—
8CWE-43482—
9CWE-35281—
10CWE-2277—
11CWE-9467—
12CWE-12165—
13CWE-2058—
14CWE-7856—
15CWE-12555—
16CWE-63953—
17CWE-30652—
18CWE-41650—
19CWE-9847—
20CWE-11944—

Sectors

Solution categories ranked by distinct CVE count this period.

  • Web & CMS Plugins794 CVE
    45 crit1 KEV420 vendorsCVSS 7.4
    elex wordpress helpdesk & customer ticketing system (7) · booster for woocommerce (3) · easy email subscription (3)
  • Enterprise Software535 CVE
    82 crit150 vendorsCVSS 8.1
    pingalert application server (15) · winplus (10) · db2 (9)
  • Operating Systems501 CVE
    110 crit45 KEV33 vendorsCVSS 7.5
    linux (204) · astra linux special edition (160) · ред ос (101)
  • OSS Libraries369 CVE
    40 crit7 KEV85 vendorsCVSS 7.8
    libpng (12) · libcoap (9) · wolfssl (9)
  • Mobile Apps235 CVE
    7 crit7 KEV8 vendorsCVSS 6.6
    chrome (66) · google chrome (65) · harmonyos (19)
  • Hardware Firmware205 CVE
    148 crit49 vendorsCVSS 9.4
    dgx os (14) · dgx spark (14) · nvidia dgx os (13)
  • Networking Infrastructure177 CVE
    33 crit2 KEV56 vendorsCVSS 7.7
    dwr-m920 (9) · dwr-m920 firmware (9) · ac21 firmware (8)
  • ICS / OT / IoT158 CVE
    258 crit57 vendorsCVSS 8.4
    mozart dds next 100 firmware (17) · mozart dds next 1000 firmware (17) · mozart dds next 2000 firmware (17)
  • Security Products131 CVE
    27 crit2 KEV71 vendorsCVSS 8.0
    blu-ic2 (5) · blu-ic2 firmware (5) · blu-ic4 (5)
  • Cloud & SaaS122 CVE
    27 crit2 KEV46 vendorsCVSS 7.7
    canaldenuncia.app (15) · rallly (10) · fluent bit (5)
  • Consumer Software92 CVE
    43 crit38 vendorsCVSS 8.1
    adobe format plugins (9) · format plugins (9) · substance 3d stager (8)
  • Communications75 CVE
    25 crit3 KEV32 vendorsCVSS 8.3
    mattermost (20) · mattermost server (10) · ussd gateway (5)
  • DevTools & CI55 CVE
    4 crit21 vendorsCVSS 6.5
    youtrack (7) · cursor (6) · lite xl (4)
  • AI / ML49 CVE
    10 crit31 vendorsCVSS 8.8
    cursor (4) · ai engine – the chatbot, ai framework & mcp for wordpress (3) · brightpick mission control / internal logic control (3)
  • Databases43 CVE
    5 crit16 vendorsCVSS 8.8
    ibm concert software (5) · pgadmin 4 (4) · ibm openpages (2)
  • Unclassified266 CVE
    48 crit177 vendorsCVSS 7.0
    mozart fm transmitter (14) · dwr-m920 (9) · soplanning (9)
Weakness × Sector

Which weaknesses hit which solution categories in November 2025

Cells shaded by share of the sector's hottest weakness. Click a row to open the sector history.

79XSS89SQL Injection862Missing Authorization74Injection284CWE-284787Out-of-bounds Write200Information Exposure434Unrestricted File Upload352CSRF22Path TraversalWeb & CMS Plugins2311301409823124394711Enterprise Software8411824772115141017Operating Systems6332643158OSS Libraries46992142354217Consumer Software1851327244115Hardware Firmware52111326466ICS / OT / IoT1920142335413Networking Infrastructure141143122623Security Products113434115231Cloud & SaaS9523289243