Month report
February 2025
Rolled up 2026-09-22 22:46 from 376,476 CVE records
3,673 CVEs published, +31.9% on the same month last year. 264 rated critical, 27 listed by CISA as exploited. linux led with 909; the most common weakness class was CWE-79 (576). sourcecodester climbed 76 places, the largest move. 6 vendors ranked for the first time.
Published
3,673
-14%on the previous month
Critical / high
264 / 1,227
of the 3,362 scored
Medium / low
1,701 / 170
the rest of the scored bands
Added to CISA KEV
27
listed as exploited this month
Public exploit
109
exploit code indexed publicly
Scanner template
56
1.5% of the month
Publication to KEV
How long before CISA listed them
15 published this month and listed since — not the 27 listed during it.
Median days to listing
7
from publication to CISA's date added
Listed within 7 days
53.3%
of the 15
Listed within 30 days
60%
of the 15
Detection gap
Listed as exploited, no public template
CVEs CISA listed this month
Listed this month
27
added to the CISA KEV catalog
With a template
7
25.9% covered
No template
20
nothing in the public index
Measured against the nuclei-templates CVE index only. No template there does not mean a CVE is undetectable by any other tool.
Vendors
Ranked by distinct CVEs this month
Δ is the move against last month's rank.
| # | Vendor | Top products | ||||||
|---|---|---|---|---|---|---|---|---|
| 1 | linux | 909 | 18 | 3 | linux (909) · simatic s7 1500 tm mfp gnu linux subsystem (37) · simatic s7 1500 cpu 1518 4 pn dp mfp (33) | — | ||
| 2 | ibm | 79 | 2 | entirex (13) · applinx (9) · openpages with watson (8) | ↑1 | |||
| 3 | siemens | 79 | 2 | 3 | linux (55) · simatic s7 1500 cpu 1518 4 pn dp mfp (37) · simatic s7 1500 cpu 1518f 4 pn dp mfp (37) | ↑8 | ||
| 4 | microsoft | 67 | 1 | 3 | 1 | windows server 2025 (37) · windows server 2025 server core installation (37) · windows 11 version 24h2 (35) | ↓2 | |
| 5 | adobe | 51 | 1 | adobe commerce (31) · indesign desktop (7) · adobe experience manager (6) | ↑17 | |||
| 6 | q free | 43 | 9 | maxtime (43) | new | |||
| 7 | cisco | 29 | 2 | 2 | cisco ios xe software (8) · ios (8) · cisco secure email (5) | ↑42 | ||
| 8 | redhat | 29 | 3 | red hat enterprise linux 10 (25) · red hat enterprise linux 8 (25) · red hat enterprise linux 9 (25) | ↑6 | |||
| 9 | enituretechnology | 28 | 1 | 7 | ltl freight quotes unishippers edition (3) · ltl freight quotes worldwide express edition (3) · distance based shipping calculator (2) | ↑71 | ||
| 10 | samsung mobile | 26 | samsung mobile devices (17) · blockchain keystore (2) · easysetup (1) | · | ||||
| 11 | qualcomm | 24 | 1 | snapdragon (24) | ↑5 | |||
| 12 | code projects | 22 | real estate property management system (9) · blood bank system (3) · job recruitment (3) | ↓2 | ||||
| 13 | labredescefetrj | 22 | 22 | wegia (22) | — | |||
| 14 | sourcecodester | 22 | best church management software (8) · best employee management system (4) · e learning system (2) | ↑76 | ||||
| 15 | gitlab | 19 | 1 | gitlab (18) · gitlab vscode fork (1) | ↑30 | |||
| 16 | gnu | 19 | binutils (13) · elfutils (6) · ruggedcom rst2428p (2) | · | ||||
| 17 | nvidia | 19 | cuda toolkit (10) · nvjpeg2000 (4) · igx orin (2) | ↑20 | ||||
| 18 | amd | 18 | amd ryzen 4000 series desktop processor with radeon graphics (10) · amd ryzen 4000 series mobile processors with radeon graphics (10) · amd ryzen 5000 series desktop processor with radeon graphics (10) | · | ||||
| 19 | f5 | 17 | 2 | big ip (14) · big ip next central manager (2) · big ip next (1) | · | |||
| 20 | sap se | 17 | 1 | sap netweaver and abap platform sdccn (2) · sap netweaver application server java (2) · sap abap platform abap build framework (1) | ↑3 | |||
| 21 | mediatek | 16 | mt6739 mt6761 mt6765 mt6768 mt6771 mt6779 mt6781 mt6785 mt6833 mt6853 mt6873 mt6877 mt6885 mt6893 mt8167 mt8167s mt8175 mt8185 mt8195 mt8321 mt8362a mt8365 mt8385 mt8395 mt8666 mt8667 mt8673 mt8675 mt8678 mt8765 mt8766 mt8768 mt8771 mt8775 mt8781 mt8786 mt8788 mt8789 mt8791t mt8795t mt8797 mt8798 mt8893 (8) · mt7615 mt7622 mt7663 mt7915 mt7916 mt7981 mt7986 (2) · mt2737 mt3603 mt6835 mt6878 mt6886 mt6897 mt6985 mt6989 mt6990 mt7902 mt7920 mt7921 mt7922 mt7925 mt7927 mt8195 mt8370 mt8390 mt8395 mt8518s mt8532 mt8678 (1) | ↑5 | ||||
| 22 | dell | 15 | powerprotect dd (4) · dell bsafe ssl j (2) · recoverpoint for vms (2) | ↑20 | ||||
| 23 | fortinet | 15 | 1 | 2 | fortios (4) · fortianalyzer (3) · fortimanager (3) | ↓14 | ||
| 24 | mozilla | 14 | 7 | 1 | thunderbird (13) · firefox (12) | ↑3 | ||
| 25 | apache | 13 | 3 | apache cassandra (3) · apache james server (2) · apache atlas (1) | ↓7 | |||
| 26 | bplugins | 12 | alert box block display notice alerts in the front end (1) · animated text block (1) · bslider create responsive image post product and video sliders (1) | ↑70 | ||||
| 27 | pdf xchange | 12 | pdf xchange editor (12) | · | ||||
| 28 | 10 | chrome (9) · zx (1) | ↓23 | |||||
| 29 | huawei | 10 | harmonyos (10) · emui (4) | ↓17 | ||||
| 30 | ivanti | 10 | 4 | connect secure (7) · policy secure (6) · cloud services application (2) | ↓15 | |||
| 31 | zoom communications | 10 | zoom workplace apps (3) · zoom workplace apps and sdks (3) · zoom apps for macos (2) | ↑44 | ||||
| 32 | discourse | 9 | discourse (9) | · | ||||
| 33 | hitachi vantara | 9 | 1 | pentaho business analytics server (9) · pentaho data integration analytics (9) | · | |||
| 34 | moodle project | 9 | 1 | moodle (9) | new | |||
| 35 | schneider electric | 9 | asco 5310 single channel remote annunciator (4) · asco 5350 eight channel remote annunciator (4) · enerlin x eife lv851001 (3) | ↑12 | ||||
| 36 | brocade | 8 | brocade sannav (5) · brocade fabric os (2) · ascg (1) | · | ||||
| 37 | itsourcecode | 8 | tailoring management system (8) | ↑45 | ||||
| 38 | progress software | 8 | progress telerik document processing libraries (1) · progress telerik kendo ui for vue (1) · progress telerik reporting (1) | · | ||||
| 39 | churchcrm | 7 | 5 | 1 | churchcrm (7) | · | ||
| 40 | cyberark | 7 | 1 | endpoint privilege manager (5) · privileged access manager (2) | · | |||
| 41 | dario health | 7 | dario application database and internet based server infrastructure (7) · usb c blood glucose monitoring system starter kit android applications (4) | new | ||||
| 42 | wpjobportal | 7 | wp job portal ai powered recruitment system for company or job board website (6) · wp job portal (1) | · | ||||
| 43 | benner | 6 | modernanet (5) · connecta (1) | new | ||||
| 44 | chimpstudio | 6 | 5 | 1 | wp foodbakery (4) · wp directorybox manager (2) | · | ||
| 45 | denx | 6 | u boot (6) · ruggedcom rox mx5000 (2) · ruggedcom rox mx5000re (2) | new | ||||
| 46 | eclipse foundation | 6 | threadx (3) · eclipse omr (2) · openvsx (1) | · | ||||
| 47 | hp | 6 | 1 | certain hp laserjet pro hp laserjet enterprise hp laserjet managed printers (3) · certain hp laserjet pro printers (1) · certain poly devices (1) | · | |||
| 48 | humming heads | 6 | defense platform home edition (6) | new | ||||
| 49 | mattermost | 6 | 3 | 1 | mattermost (6) | ↓20 | ||
| 50 | palo alto networks | 6 | 2 | 1 | 1 | cloud ngfw (3) · pan os (3) · prisma access (3) | ↑39 |
One CVE is counted once per vendor, product or weakness class it lists, so a ranking column sums to more than the month's total. Only the month's top 100 keys per dimension are stored. The KEV column counts CVEs published in 2025-02 that are on the CISA KEV catalog today. The 27 in the headline is what CISA listed during the month, whenever those CVEs were published. All 50 ranked vendors are listed; a zero count renders as a dot.
Weaknesses
CWE classes by distinct CVEs
- 1CWE-795763 critical—
- 2CWE-8920551 critical↑1
- 3CWE-4161426 critical↑16
- 4CWE-3521404 critical↓2
- 5CWE-4761251 critical↑9
- 6CWE-8621211 critical↓2
- 7CWE-948915 critical↓1
- 8CWE-22799 critical↑3
- 9CWE-2847615 critical↑4
- 10CWE-401730 critical↑59
- 1CWE-74652 critical↓6
- 2CWE-20592 critical↑18
- 3CWE-787578 critical↓4
- 4CWE-362551 critical↑46
- 5CWE-200540 critical↓5
- 6CWE-125490 critical↑5
- 7CWE-1204614 critical↓10
- 8CWE-78439 critical↓3
- 9CWE-77392 critical↓2
- 10CWE-4343714 critical↓8
One CVE is counted once per vendor, product or weakness class it lists, so a ranking column sums to more than the month's total. Only the month's top 100 keys per dimension are stored.