Month report
June 2025
Rolled up 2026-09-22 05:40 from 376,053 CVE records
3,682 CVEs published, +19.5% on the same month last year. 284 rated critical, 20 listed by CISA as exploited. linux led with 375; the most common weakness class was CWE-79 (708). openharmony climbed 38 places, the largest move. 8 vendors ranked for the first time.
Published
3,682
Critical / high
284 / 1,291
Medium / low
1,602 / 219
Added to CISA KEV
20
Public exploit
123
Scanner template
45
Publication to KEV
How long before CISA listed them
Median days to listing
28
Listed within 7 days
44.4%
Listed within 30 days
50%
Weakness × vendor
Where the two overlap
| Vendor | CWE-79 | CWE-89 | CWE-74 | CWE-119 | CWE-352 | CWE-862 | CWE-120 | CWE-22 |
|---|---|---|---|---|---|---|---|---|
| linux | ||||||||
| adobe | 222 | |||||||
| code projects | 14 | 123 | 123 | 3 | 3 | 1 | ||
| phpgurukul | 15 | 97 | 97 | 1 | 1 | |||
| totolink | 7 | 3 | 58 | 53 | ||||
| microsoft | 1 | 1 | 1 | 1 | ||||
| sourcecodester | 12 | 32 | 32 | 1 | 1 | |||
| ibm | 6 | 1 | 1 | 1 |
Detection gap
Listed as exploited, no public template
Listed this month
20
With a template
4
No template
16
Measured against the nuclei-templates CVE index only. No template there does not mean a CVE is undetectable by any other tool.
Vendors
Ranked by distinct CVEs this month
| # | Vendor | Top products | ||||||
|---|---|---|---|---|---|---|---|---|
| 1 | linux | 375 | 2 | 2 | linux (375) · simatic s7 1500 cpu 1518 4 pn dp mfp (6) · simatic s7 1500 cpu 1518f 4 pn dp mfp (6) | — | ||
| 2 | adobe | 255 | 1 | adobe experience manager (224) · acrobat reader (10) · indesign desktop (9) | ↑9 | |||
| 3 | code projects | 149 | 1 | 1 | inventory management system (20) · simple pizza ordering system (14) · online shoe store (12) | ↑18 | ||
| 4 | phpgurukul | 114 | art gallery management system (9) · complaint management system (9) · online fire reporting system (7) | ↓2 | ||||
| 5 | totolink | 77 | 1 | 1 | x15 (20) · ex1200t (19) · a3002ru (8) | ↑12 | ||
| 6 | microsoft | 69 | 2 | 2 | 11 | windows server 2025 (41) · windows server 2025 server core installation (41) · windows server 2022 (40) | ↓3 | |
| 7 | sourcecodester | 52 | 3 | best salon management system (21) · student result management system (10) · simple company website (7) | ↑2 | |||
| 8 | ibm | 48 | 3 | 1 | cloud pak for security (5) · infosphere information server (5) · qradar suite software (5) | — | ||
| 9 | d link | 41 | 5 | dir 619l (14) · dir 816 (6) · di 7300g (4) | ↑1 | |||
| 10 | redhat | 37 | 3 | 3 | red hat enterprise linux 9 (28) · red hat enterprise linux 10 (27) · red hat enterprise linux 8 (27) | ↑10 | ||
| 11 | tenda | 36 | ac5 (5) · ac15 (4) · ac18 (4) | ↑21 | ||||
| 12 | trend micro | 28 | 6 | trend micro apex central (8) · trend micro endpoint encryption policy server (8) · trend micro apex one (5) | · | |||
| 13 | siemens | 27 | 3 | 2 | ruggedcom rst2428p (10) · red hat enterprise linux 10 (8) · red hat enterprise linux 8 (8) | ↓7 | ||
| 14 | pdf xchange | 23 | pdf xchange editor (23) | · | ||||
| 15 | apache | 21 | 5 | 4 | 1 | apache cloudstack (5) · apache tomcat (3) · apache kafka (2) | ↑13 | |
| 16 | drupal | 21 | cookies consent management (2) · quick node block (2) · simple klaro (2) | ↑10 | ||||
| 17 | qnap systems | 21 | file station 5 (14) · qsync central (2) · qts (2) | · | ||||
| 18 | campcodes | 20 | online teacher record management system (5) · sales and inventory system (5) · online recruitment management system (4) | ↓13 | ||||
| 19 | gitlab | 20 | gitlab (20) | ↑10 | ||||
| 20 | sick | 20 | sick field analytics (9) · sick media server (9) · baggage analytics (3) | · | ||||
| 21 | cisco | 18 | 4 | 1 | 3 | 2 | cisco unified contact center express (6) · cisco identity services engine software (5) · cisco socialminer (2) | ↓14 |
| 22 | dell | 18 | 1 | wyse management suite (6) · bcm5820x (5) · controlvault3 (5) | ↑9 | |||
| 23 | mozilla | 18 | 5 | firefox (15) · thunderbird (12) · mozilla vpn 2 28 0 (1) | ↑2 | |||
| 24 | qualcomm | 18 | 3 | 1 | snapdragon (18) | ↓11 | ||
| 25 | sap se | 16 | 1 | sap mdm server (3) · sap business objects business intelligence platform (1) · sap business one integration framework (1) | ↓2 | |||
| 26 | vmware | 16 | 1 | salt (11) · vmware nsx (3) · avi load balancer (1) | ↑27 | |||
| 27 | 15 | 1 | 2 | 2 | chrome (10) · chromeos (2) · angularjs (1) | ↓5 | ||
| 28 | freefloat | 14 | 1 | ftp server (14) | ↓14 | |||
| 29 | thembay | 14 | diza (2) · aora (1) · besa (1) | new | ||||
| 30 | fortinet | 13 | 1 | fortios (7) · fortiproxy (4) · ruggedcom ape1808 (3) | ↑13 | |||
| 31 | linksys | 13 | 1 | 1 | re6250 (10) · re6300 (10) · re6350 (10) | · | ||
| 32 | samsung mobile | 13 | samsung mobile devices (10) · samsung internet (2) · smart switch (1) | ↓16 | ||||
| 33 | huawei | 12 | 1 | harmonyos (11) · eg8141a5 (1) · eg8145v5 (1) | ↑5 | |||
| 34 | juzaweb | 12 | cms (12) | new | ||||
| 35 | preh car connect gmbh joynext | 12 | volkswagen mib3 infotainment system mib3 oi mqb (12) | new | ||||
| 36 | openharmony | 11 | 1 | openharmony (11) | ↑38 | |||
| 37 | snstheme | 11 | avaz (1) · bodycenter gym fitness woocommerce wordpress theme (1) · dsk (1) | new | ||||
| 38 | autel | 10 | autel maxicharger ac wallbox commercial (10) | · | ||||
| 39 | codeastro | 10 | real estate management system (6) · patient record management system (2) · expense management system (1) | · | ||||
| 40 | schneider electric | 10 | modicon controllers m241 m251 (6) · evlink wallbox (4) · modicon controllers m258 lmc058 (2) | · | ||||
| 41 | brother industries | 9 | 1 | 2 | 2 | dcp 7090dw (8) · dcp 7190dn (8) · dcp 7190dw (8) | · | |
| 42 | dmacroweb | 9 | 4 | dm corporative cms (9) | new | |||
| 43 | hewlett packard enterprise hpe | 9 | 1 | hpe storeonce software (8) · hpe aruba networking private 5g core (1) | · | |||
| 44 | konica minolta | 9 | 1 | 2 | 2 | bizhub 4000i (7) · bizhub 4020i (7) · bizhub 5000i (7) | · | |
| 45 | labredescefetrj | 9 | 2 | wegia (9) | · | |||
| 46 | versa | 9 | 2 | director (9) | new | |||
| 47 | xwiki | 9 | 1 | xwiki platform (9) | · | |||
| 48 | 70mai | 8 | m300 (5) · 1s (2) · a510 (1) | new | ||||
| 49 | advantech | 8 | 1 | 2 | advantech wireless sensing and equipment wise (8) | · | ||
| 50 | chaitak gorai | 8 | blogbook (8) | new |
One CVE is counted once per vendor, product or weakness class it lists, so a ranking column sums to more than the month's total. Only the month's top 100 keys per dimension are stored. The KEV column counts CVEs published in 2025-06 that are on the CISA KEV catalog today. The 20 in the headline is what CISA listed during the month, whenever those CVEs were published. All 50 ranked vendors are listed; a zero count renders as a dot.
Weaknesses
CWE classes by distinct CVEs
- 1CWE-797082 critical—
- 2CWE-8943242 critical—
- 3CWE-743452 critical—
- 4CWE-11919110 critical—
- 5CWE-3521601 critical↑3
- 6CWE-8621577 critical↓1
- 7CWE-1201135 critical↓1
- 8CWE-2210610 critical↑4
- 9CWE-9410214 critical↑1
- 10CWE-98752 critical↑11
- 1CWE-77706 critical↓2
- 2CWE-121686 critical↓1
- 3CWE-786720 critical↑11
- 4CWE-284626 critical↓7
- 5CWE-4345516 critical↓1
- 6CWE-125503 critical↑1
- 7CWE-5024822 critical↓4
- 8CWE-20466 critical↓3
- 9CWE-416461 critical↑1
- 10CWE-287418 critical↑3
One CVE is counted once per vendor, product or weakness class it lists, so a ranking column sums to more than the month's total. Only the month's top 100 keys per dimension are stored.