Month report
August 2025
Rolled up 2026-09-23 02:53 from 376,502 CVE records
3,629 CVEs published, +25.3% on the same month last year. 425 rated critical, 15 listed by CISA as exploited. linux led with 185; the most common weakness class was CWE-79 (546). nvidia climbed 70 places, the largest move. 7 vendors ranked for the first time.
Published
3,629
-3.8%on the previous month
Critical / high
425 / 1,358
of the 3,531 scored
Medium / low
1,488 / 260
the rest of the scored bands
Added to CISA KEV
15
listed as exploited this month
Public exploit
276
exploit code indexed publicly
Scanner template
40
1.1% of the month
Publication to KEV
How long before CISA listed them
12 published this month and listed since — not the 15 listed during it.
Median days to listing
4
from publication to CISA's date added
Listed within 7 days
66.7%
of the 12
Listed within 30 days
75%
of the 12
Weakness × vendor
Where the two overlap
CVEs carrying both. Each row is shaded against its own worst class.
| Vendor | CWE-79 | CWE-89 | CWE-74 | CWE-94 | CWE-121 | CWE-78 | CWE-862 | CWE-22 |
|---|---|---|---|---|---|---|---|---|
| linux | ||||||||
| microsoft | 1 | 3 | 1 | 1 | ||||
| adobe | 10 | 1 | 1 | |||||
| code projects | 2 | 43 | 43 | 2 | 1 | 2 | 1 | |
| huawei | 1 | 2 | ||||||
| itsourcecode | 51 | 51 | ||||||
| linksys | 36 | 12 | 1 | |||||
| portabilis | 33 | 9 | 9 | 33 |
Detection gap
Listed as exploited, no public template
CVEs CISA listed this month
Listed this month
15
added to the CISA KEV catalog
With a template
2
13.3% covered
No template
13
nothing in the public index
- 1n able2of 2 listed
- 2apple1of 1 listed
- 3citrix1of 1 listed
- 4citrix session recording1of 1 listed
- 5git1of 1 listed
- 6netscaler1of 1 listed
- 7trend micro1of 1 listed
- 8win rar1of 1 listed
Measured against the nuclei-templates CVE index only. No template there does not mean a CVE is undetectable by any other tool.
Vendors
Ranked by distinct CVEs this month
Δ is the move against last month's rank.
| # | Vendor | Top products | ||||||
|---|---|---|---|---|---|---|---|---|
| 1 | linux | 185 | 11 | 5 | linux (185) · simatic cn 4100 (7) · simatic s7 1500 cpu 1518 4 pn dp mfp (3) | — | ||
| 2 | microsoft | 119 | 7 | 10 | windows server 2025 (67) · windows server 2025 server core installation (67) · windows server 2022 (62) | ↑1 | ||
| 3 | adobe | 79 | 1 | 1 | 1 | indesign desktop (14) · substance3d modeler (13) · adobe experience manager (11) | ↑5 | |
| 4 | code projects | 52 | online medicine guide (12) · human resource integrated system (7) · simple grading system (6) | ↓2 | ||||
| 5 | huawei | 52 | harmonyos (49) · emui (12) · enzoh w5611t (3) | ↑19 | ||||
| 6 | itsourcecode | 52 | 1 | apartment management system (28) · online tour and travel management system (20) · sports management system (3) | ↑40 | |||
| 7 | linksys | 50 | 2 | re6250 (43) · re6300 (43) · re6350 (43) | · | |||
| 8 | portabilis | 48 | i educar (36) · i diario (12) | ↑18 | ||||
| 9 | cisco | 47 | 1 | 1 | cisco firepower threat defense software (22) · cisco adaptive security appliance asa software (18) · cisco firepower management center (8) | ↑30 | ||
| 10 | liferay | 46 | 1 | 1 | dxp (46) · portal (45) | · | ||
| 11 | 44 | 5 | 3 | android (26) · chrome (16) · angularjs (1) | ↑58 | |||
| 12 | siemens | 44 | 3 | 3 | simatic cn 4100 (10) · linux (9) · smartclient modules opcenter ql home sc (7) | ↓2 | ||
| 13 | qnap systems | 43 | 1 | qsync central (14) · file station 5 (12) · qts (11) | · | |||
| 14 | nvidia | 42 | 3 | 1 | triton inference server (17) · gpu display drivers (12) · nemo framework (4) | ↑70 | ||
| 15 | ibm | 35 | 1 | concert software (5) · websphere application server liberty (4) · cognos command center (3) | ↓4 | |||
| 16 | tenda | 30 | 3 | 1 | ac20 (9) · ac6 v5 0 (6) · ch22 (4) | ↓4 | ||
| 17 | kenwood | 29 | dmx958xr (29) | new | ||||
| 18 | dell | 28 | 2 | 1 | 1 | powerprotect data domain feature release (5) · powerprotect data domain lts2024 (5) · powerprotect data domain lts 2023 (5) | ↑16 | |
| 19 | sourcecodester | 28 | covid 19 testing management system (7) · online bank management system (5) · advanced school management system (3) | ↑33 | ||||
| 20 | qualcomm | 24 | snapdragon (24) | ↓1 | ||||
| 21 | the biosig project | 24 | 22 | libbiosig (24) | · | |||
| 22 | campcodes | 23 | 1 | 1 | online loan management system (7) · online water billing system (4) · online flight booking management system (3) | ↓13 | ||
| 23 | mattermost | 22 | mattermost confluence plugin (13) · mattermost (9) | · | ||||
| 24 | mozilla | 21 | 6 | firefox (12) · firefox for ios (7) · thunderbird (7) | ↑5 | |||
| 25 | apache | 20 | 2 | 2 | 1 | apache superset (4) · apache zeppelin (3) · apache log4cxx (2) | ↓3 | |
| 26 | cgm | 17 | 8 | cgm clininet (17) | new | |||
| 27 | redhat | 16 | 1 | red hat enterprise linux 9 (8) · red hat enterprise linux 10 (7) · red hat enterprise linux 8 (7) | ↓12 | |||
| 28 | samsung mobile | 16 | samsung mobile devices (8) · blockchain keystore (4) · galaxy wearable (1) | ↑4 | ||||
| 29 | sap se | 16 | 2 | 1 | sap netweaver application server abap bic document (2) · sap netweaver application server for abap (2) · abap platform (1) | ↓12 | ||
| 30 | crocoblock | 15 | jetengine (4) · jetelements for elementor (2) · jettabs (2) | ↑24 | ||||
| 31 | gitlab | 15 | gitlab (15) | ↑9 | ||||
| 32 | fortinet | 14 | 1 | 2 | 2 | fortios (4) · fortiweb (4) · fortipam (3) | ↑36 | |
| 33 | atjiu | 13 | 1 | pybbs (13) | new | |||
| 34 | lambertgroup | 13 | universal video player addon for wpbakery page builder (3) · multimedia playlist slider addon for wpbakery page builder (2) · apollo sticky full width html5 audio player (1) | · | ||||
| 35 | phpgurukul | 13 | online shopping portal project (3) · hospital management system (2) · online course registration (2) | ↓28 | ||||
| 36 | rockwell automation | 13 | 2 | arena simulation (3) · 5032 cfgb16m12dr (2) · 5032 cfgb16m12m12ldr (2) | · | |||
| 37 | d link | 12 | 3 | 4 | dir 600 (2) · di 500wf (1) · dir 110 (1) | ↓17 | ||
| 38 | hcl software | 11 | bigfix saas remediate (4) · bigfix service management sm (3) · aiml solutions for sx (1) | ↑7 | ||||
| 39 | labredescefetrj | 11 | 5 | 1 | wegia (11) | ↓25 | ||
| 40 | mtons | 11 | mblog (11) | new | ||||
| 41 | projectworlds | 11 | 1 | travel management system (4) · online admission system (3) · visitor management system (3) | · | |||
| 42 | emarket design | 10 | campus directory faculty staff student directory plugin for wordpress (2) · project management bug and issue tracking plugin software issue manager (2) · simple contact form plugin for wordpress wp easy contact (2) | new | ||||
| 43 | givanz | 10 | 3 | vvveb (9) · vvvebjs (1) | new | |||
| 44 | hashicorp | 10 | 1 | vault (9) · vault enterprise (9) · shared library (1) | · | |||
| 45 | jetbrains | 10 | intellij idea (4) · teamcity (3) · ide services (1) | ↓8 | ||||
| 46 | openharmony | 10 | openharmony (10) | · | ||||
| 47 | schneider electric | 10 | ecostruxure power monitoring expert pme (5) · ecostruxure power operation epo advanced reporting and dashboards module (5) · ecostruxure building operation enterprise server (2) | ↑24 | ||||
| 48 | ubiquiti | 10 | 4 | uisp application (3) · edgemax edgeswitch (2) · unifi connect display cast (2) | · | |||
| 49 | apple | 9 | 1 | 1 | 1 | macos (8) · apple music classical (1) · ios and ipados (1) | ↓44 | |
| 50 | opensolution | 9 | quickcms (6) · quick cms (2) · quick cms ext (1) | new |
One CVE is counted once per vendor, product or weakness class it lists, so a ranking column sums to more than the month's total. Only the month's top 100 keys per dimension are stored. The KEV column counts CVEs published in 2025-08 that are on the CISA KEV catalog today. The 15 in the headline is what CISA listed during the month, whenever those CVEs were published. All 50 ranked vendors are listed; a zero count renders as a dot.
Weaknesses
CWE classes by distinct CVEs
- 1CWE-795467 critical—
- 2CWE-8932239 critical—
- 3CWE-742161 critical—
- 4CWE-9418732 critical↑1
- 5CWE-12115135 critical↑1
- 6CWE-7814241 critical↑5
- 7CWE-8621088 critical↑3
- 8CWE-2210016 critical—
- 9CWE-2849812 critical—
- 10CWE-4349540 critical↓3
- 1CWE-119927 critical↓7
- 2CWE-352882 critical↑5
- 3CWE-778210 critical↑8
- 4CWE-416735 critical↑9
- 5CWE-200706 critical↑1
- 6CWE-125632 critical↓4
- 7CWE-98624 critical↑30
- 8CWE-206112 critical↓5
- 9CWE-1226013 critical↓5
- 10CWE-5025016 critical↑2
One CVE is counted once per vendor, product or weakness class it lists, so a ranking column sums to more than the month's total. Only the month's top 100 keys per dimension are stored.