2025 in review

All of 2025. Numbers as of 12 October 2026.

Exploited
245
up 32% from 2024
Exploited from day one
20%
49 of 245 were already under attack when they went public
down from 22% in 2024
Typical time to exploitation
26 days
from going public to confirmed attacks
up from 22 days in 2024
Used in ransomware
31
13% of the exploited ones
down 30% from 2024
New vulnerabilities
48,152
up 21% from 2024
Rated critical
6,490
up 30% from 2024

exploited each month

all exploited exploited each month

Vulnerabilities added to KEV each month in 2025. KEV (Known Exploited Vulnerabilities) is the US government agency CISA's list of flaws attackers are known to be using. Each counts in the month it was added, however old it is.

  • 2025
  • 2024

Busiest month: March, with 32. CISA usually gave US federal agencies 21 days to patch each one.

MonthExploitedUsed in ransomware2024
January14621
February2739
March32410
April15410
May24214
June2019
July20414
August15119
September16125
October31317
November11022
December20216

time to exploitation

Time from going public to being added to KEV, for each vulnerability added in 2025.

  • Critical
  • High
  • Medium
  • Low
  • No score
By the day it went public49
Within a week48
Within a month29
Within a year63
1 to 5 years later32
Over 5 years later24
Time to exploitationExploitedCriticalHighMediumLowNo score
By the day it went public491132600
Within a week482617500
Within a month291410410
Within a year632827800
1 to 5 years later32919400
Over 5 years later24914100

new vulnerabilities each month

browse new vulnerabilities each month

CVEs published each month in 2025, by severity. A CVE is the public ID given to one vulnerability; its severity comes from its CVSS score.

  • Critical
  • High
  • Medium
  • Low
  • No score
MonthCVEsCriticalHighMediumLowNo score
January4,2753941,6062,189860
February3,6733071,2282,047910
March3,9985871,4731,8271110
April4,0345551,5461,8231073
May3,9807771,2071,8931030
June3,6815791,2701,7231081
July3,7766461,4521,5761020
August3,6286371,2861,5901141
September4,3215331,4382,2201300
October4,2734661,5242,07585123
November3,0213941,0621,4238359
December5,4926151,9322,110118717

how many were confirmed exploited

All of 2025's CVEs against the ones added to KEV before the year was out, by severity.

  • Critical
  • High
  • Medium
  • Low
  • No score
All new vulnerabilities 100%48,152
Exploited within 2025 0.3%165
VulnerabilitiesCVEsCriticalHighMediumLowNo score
All new vulnerabilities48,1526,49017,02422,4961,238904
Exploited within 202516568772000

most exploited vendors

Top 10 vendors by vulnerabilities added to KEV in 2025.

  • Critical
  • High
  • Medium
  • Low
  • No score
Microsoft42
Debian17
Apple12
Google11
Cisco9
Fortinet8
Ivanti7
Linux7
Netapp7
Oracle7
VendorExploitedCriticalHighMediumLowNo score
Microsoft42532500
Debian17312200
Apple1255200
Google1118200
Cisco963000
Fortinet852100
Ivanti725000
Linux706100
Netapp733100
Oracle742100

most vulnerabilities

Top 10 vendors by new vulnerabilities in 2025.

  • Critical
  • High
  • Medium
  • Low
  • No score
Linux5,676
Microsoft1,258
Adobe829
Apple731
Debian682
Google673
Phpgurukul615
IBM609
Tenda472
Fabian353
VendorCVEsCriticalHighMediumLowNo score
Linux5,676471,4863,2415897
Microsoft1,2585486932780
Adobe82925275519100
Apple73195184409430
Debian6821424042350
Google67323361279100
Phpgurukul61531717212420
IBM60939176366280
Tenda4721122847420
Fabian3531711166600

most common weaknesses

Top 10 weaknesses behind 2025's vulnerabilities. A CWE (Common Weakness Enumeration) names the kind of mistake that caused a flaw, such as cross-site scripting or a buffer overflow.

  • Critical
  • High
  • Medium
  • Low
  • No score
Cross-site Scripting CWE-798,295
SQL Injection CWE-894,001
Injection CWE-742,569
Missing Authorization CWE-8622,354
Cross-Site Request Forgery (CSRF) CWE-3521,922
Code Injection CWE-941,412
Improper Access Control CWE-2841,253
NULL Pointer Dereference CWE-4761,219
Out-of-bounds Write CWE-7871,173
Improper Restriction of Operations within the Bounds of a Memory Buffer CWE-1191,157
WeaknessCVEsCriticalHighMediumLowNo score
Cross-site Scripting (CWE-79)8,295791,4466,5831861
SQL Injection (CWE-89)4,0012,0401,465477190
Injection (CWE-74)2,5691,62579414460
Missing Authorization (CWE-862)2,3541114361,776310
Cross-Site Request Forgery (CSRF) (CWE-352)1,922307641,111170
Code Injection (CWE-94)1,4122632857611030
Improper Access Control (CWE-284)1,253237453526370
NULL Pointer Dereference (CWE-476)1,21921451,054180
Out-of-bounds Write (CWE-787)1,173182798182101
Improper Restriction of Operations within the Bounds of a Memory Buffer (CWE-119)1,157289701135320

old flaws, newly exploited

The 10 oldest vulnerabilities added to KEV in 2025: when each went public, and when it was confirmed exploited.

  • Went public
  • Confirmed exploited
CVE-2007-0671 Microsoft Access18 years
CVE-2010-3765 Mozilla Firefox14 years
CVE-2010-3962 Microsoft Internet Explorer14 years
CVE-2011-3402 Microsoft Windows 713 years
CVE-2013-3893 Microsoft Internet Explorer11 years
CVE-2013-3918 Microsoft Windows 711 years
CVE-2014-6278 GNU Bash11 years
CVE-2015-7755 Juniper ScreenOS9 years
CVE-2016-10033 Joomla!8 years
CVE-2014-3931 Multi-Router Looking Glass Project Multi-Router Looking Glass8 years
CVEProductWent publicAttacks confirmedGap
CVE-2007-0671Microsoft Access2007-02-032025-08-1218 years
CVE-2010-3765Mozilla Firefox2010-10-282025-10-0614 years
CVE-2010-3962Microsoft Internet Explorer2010-11-052025-10-0614 years
CVE-2011-3402Microsoft Windows 72011-11-042025-10-0613 years
CVE-2013-3893Microsoft Internet Explorer2013-09-182025-08-1211 years
CVE-2013-3918Microsoft Windows 72013-11-122025-10-0611 years
CVE-2014-6278GNU Bash2014-09-302025-10-0211 years
CVE-2015-7755Juniper ScreenOS2015-12-192025-10-029 years
CVE-2016-10033Joomla!2016-12-302025-07-078 years
CVE-2014-3931Multi-Router Looking Glass Project Multi-Router Looking Glass2017-03-312025-07-078 years

About these numbers

  • Vulnerabilities are counted by the date NVD published them. Rejected ones aren't counted.
  • "Exploited" means CISA added it to its Known Exploited Vulnerabilities list that year, however old it is. The list started in late 2021 and spent 2022 mostly catching up on older flaws, so these reviews start with 2023.
  • Severity is NVD's current rating. "No score" means NVD hasn't rated it yet.
  • Everything about exploitation counts only what CISA added within the year, so it doesn't change once the year is over. The two exceptions: severity and the ransomware link are NVD's and CISA's current values, as neither keeps a history.
  • A vulnerability that affects several vendors counts once for each.
  • Late ratings and rejections can still shift these numbers a little.