Top 10 CVEs of 2025
2025
Six data-derived top-10 lists for CVEs published or KEV-added in 2025. No editorial scoring; everything below is computed directly from the ingested corpus.
Top 10 most severe CVEs of 2025
Ranked by CVSS v3 base score, descending. Ties broken by KEV status, then EPSS score, then publish date.
| # | CVE | Severity | CVSS | KEV | Summary |
|---|---|---|---|---|---|
| 1 | CVE-2025-32432 | Critical | 10.0 | KEV | Craft is a flexible, user-friendly CMS for creating custom digital experiences on the web and beyond. |
| 2 | CVE-2025-10035 | Critical | 10.0 | KEV | A deserialization vulnerability in the License Servlet of Fortra's GoAnywhere MFT allows an actor with a validly forged license response signature to deserialize an arbitrary actor-controlled object, possibly leading to command injection. |
| 3 | CVE-2025-55182 | Critical | 10.0 | KEV | A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1.1, and 19.2.0 including the following packages: react-server-dom-parcel, react-server-dom-turbopack, and react-server-… |
| 4 | CVE-2025-31324 | Critical | 10.0 | KEV | SAP NetWeaver Visual Composer Metadata Uploader is not protected with a proper authorization, allowing unauthenticated agent to upload potentially malicious executable binaries that could severely harm the host system. |
| 5 | CVE-2025-32433 | Critical | 10.0 | KEV | Erlang/OTP is a set of libraries for the Erlang programming language. |
| 6 | CVE-2025-34028 | Critical | 10.0 | KEV | The Commvault Command Center Innovation Release allows an unauthenticated actor to upload ZIP files that represent install packages that, when expanded by the target server, are vulnerable to path traversal vulnerability that can result in… |
| 7 | CVE-2025-20281 | Critical | 10.0 | KEV | A vulnerability in a specific API of Cisco ISE and Cisco ISE-PIC could allow an unauthenticated, remote attacker to execute arbitrary code on the underlying operating system as root. |
| 8 | CVE-2025-47812 | Critical | 10.0 | KEV | In Wing FTP Server before 7.4.4. |
| 9 | CVE-2025-37164 | Critical | 10.0 | KEV | A remote code execution issue exists in HPE OneView. |
| 10 | CVE-2025-54253 | Critical | 10.0 | KEV | Adobe Experience Manager versions 6.5.23 and earlier are affected by a Misconfiguration vulnerability that could result in arbitrary code execution. |
Top 10 actively exploited CVEs of 2025
CVEs added to the CISA Known Exploited Vulnerabilities catalog during the year, newest first. Empty for pre-2021 years.
| # | CVE | Severity | CVSS | KEV | Added | Summary |
|---|---|---|---|---|---|---|
| 1 | CVE-2025-14847 | High | 7.5 | KEV | 2025-12-29 | Mismatched length fields in Zlib compressed protocol headers may allow a read of uninitialized heap memory by an unauthenticated client. |
| 2 | CVE-2023-52163 | High | 8.8 | KEV | 2025-12-22 | Digiever DS-2105 Pro 3.1.0.71-11 devices allow time_tzsetup.cgi Command Injection. |
| 3 | CVE-2025-14733 | Critical | 9.8 | KEV | 2025-12-19 | An Out-of-bounds Write vulnerability in the WatchGuard Fireware OS iked process may allow a remote unauthenticated attacker to execute arbitrary code. |
| 4 | CVE-2025-40602 | Medium | 6.6 | KEV | 2025-12-17 | A local privilege escalation vulnerability due to insufficient authorization in the SonicWall SMA1000 appliance management console (AMC). |
| 5 | CVE-2025-20393 | Critical | 10.0 | KEV | 2025-12-17 | A vulnerability in the Spam Quarantine feature of Cisco AsyncOS Software for Cisco Secure Email Gateway and Cisco Secure Email and Web Manager could allow an unauthenticated, remote attacker to execute arbitrary system commands on an affec… |
| 6 | CVE-2025-59374 | Critical | 9.8 | KEV | 2025-12-17 | "UNSUPPORTED WHEN ASSIGNED" Certain versions of the ASUS Live Update client were distributed with unauthorized modifications introduced through a supply chain compromise. The modified builds could cause devices meeting specific targeting c… |
| 7 | CVE-2025-59718 | Critical | 9.8 | KEV | 2025-12-16 | A improper verification of cryptographic signature vulnerability in Fortinet FortiOS 7.6.0 through 7.6.3, FortiOS 7.4.0 through 7.4.8, FortiOS 7.2.0 through 7.2.11, FortiOS 7.0.0 through 7.0.17, FortiProxy 7.6.0 through 7.6.3, FortiProxy 7… |
| 8 | CVE-2025-43529 | High | 8.8 | KEV | 2025-12-15 | A use-after-free issue was addressed with improved memory management. |
| 9 | CVE-2025-14611 | Critical | 9.8 | KEV | 2025-12-15 | Gladinet CentreStack and Triofox prior to version 16.12.10420.56791 used hardcoded values for their implementation of the AES cryptoscheme. |
| 10 | CVE-2025-14174 | High | 8.8 | KEV | 2025-12-12 | Out of bounds memory access in ANGLE in Google Chrome on Mac prior to 143.0.7499.110 allowed a remote attacker to perform out of bounds memory access via a crafted HTML page. |
Top 10 highest-EPSS CVEs of 2025
FIRST.org Exploit Prediction Scoring System scores, descending. EPSS estimates the probability a CVE will be exploited in the next 30 days.
| # | CVE | Severity | CVSS | KEV | EPSS | Summary |
|---|---|---|---|---|---|---|
| 1 | CVE-2025-3248 | Critical | 9.8 | KEV | 1.000 | Langflow versions prior to 1.3.0 are susceptible to code injection in the /api/v1/validate/code endpoint. |
| 2 | CVE-2025-0282 | Critical | 9.0 | KEV | 1.000 | A stack-based buffer overflow in Ivanti Connect Secure before version 22.7R2.5, Ivanti Policy Secure before version 22.7R1.2, and Ivanti Neurons for ZTA gateways before version 22.7R2.3 allows a remote unauthenticated attacker to achieve r… |
| 3 | CVE-2025-5777 | High | 7.5 | KEV | 0.999 | Insufficient input validation leading to memory overread when the NetScaler is configured as a Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) OR AAA virtual server |
| 4 | CVE-2025-31161 | Critical | 9.8 | KEV | 0.999 | CrushFTP 10 before 10.8.4 and 11 before 11.3.1 allows authentication bypass and takeover of the crushadmin account (unless a DMZ proxy instance is used), as exploited in the wild in March and April 2025, aka "Unauthenticated HTTP(S) port a… |
| 5 | CVE-2025-24813 | Critical | 9.8 | KEV | 0.999 | Path Equivalence: 'file.Name' (Internal Dot) leading to Remote Code Execution and/or Information disclosure and/or malicious content added to uploaded files via write enabled Default Servlet in Apache Tomcat. |
| 6 | CVE-2025-53770 | Critical | 9.8 | KEV | 0.999 | Deserialization of untrusted data in on-premises Microsoft SharePoint Server allows an unauthorized attacker to execute code over a network. |
| 7 | CVE-2025-22457 | Critical | 9.0 | KEV | 0.999 | A stack-based buffer overflow in Ivanti Connect Secure before version 22.7R2.6, Ivanti Policy Secure before version 22.7R1.4, and Ivanti ZTA Gateways before version 22.8R2.2 allows a remote unauthenticated attacker to achieve remote code e… |
| 8 | CVE-2025-4427 | Medium | 5.3 | KEV | 0.999 | An authentication bypass in the API component of Ivanti Endpoint Manager Mobile 12.5.0.0 and prior allows attackers to access protected resources without proper credentials via the API. |
| 9 | CVE-2025-49706 | Medium | 6.5 | KEV | 0.999 | Improper authentication in Microsoft Office SharePoint allows an unauthorized attacker to perform spoofing over a network. |
| 10 | CVE-2025-24893 | Critical | 9.8 | KEV | 0.999 | XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. |
Top 10 most PoC-covered CVEs of 2025
Ranked by the count of indexed public proof-of-concept repositories. Higher counts correlate with weaponisation effort.
| # | CVE | Severity | CVSS | KEV | PoCs | Summary |
|---|---|---|---|---|---|---|
| 1 | CVE-2025-29927 | Critical | 9.1 | — | 779 | Next.js is a React framework for building full-stack web applications. |
| 2 | CVE-2025-55182 | Critical | 10.0 | KEV | 500 | A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1.1, and 19.2.0 including the following packages: react-server-dom-parcel, react-server-dom-turbopack, and react-server-… |
| 3 | CVE-2025-32463 | Critical | 9.3 | KEV | 154 | Sudo before 1.9.17p1 allows local users to obtain root access because /etc/nsswitch.conf from a user-controlled directory is used with the --chroot option. |
| 4 | CVE-2025-24813 | Critical | 9.8 | KEV | 114 | Path Equivalence: 'file.Name' (Internal Dot) leading to Remote Code Execution and/or Information disclosure and/or malicious content added to uploaded files via write enabled Default Servlet in Apache Tomcat. |
| 5 | CVE-2025-53770 | Critical | 9.8 | KEV | 111 | Deserialization of untrusted data in on-premises Microsoft SharePoint Server allows an unauthorized attacker to execute code over a network. |
| 6 | CVE-2025-32433 | Critical | 10.0 | KEV | 94 | Erlang/OTP is a set of libraries for the Erlang programming language. |
| 7 | CVE-2025-3248 | Critical | 9.8 | KEV | 84 | Langflow versions prior to 1.3.0 are susceptible to code injection in the /api/v1/validate/code endpoint. |
| 8 | CVE-2025-48384 | High | 8.0 | KEV | 70 | Git is a fast, scalable, distributed revision control system with an unusually rich command set that provides both high-level operations and full access to internals. |
| 9 | CVE-2025-1974 | Critical | 9.8 | — | 69 | A security issue was discovered in Kubernetes where under certain conditions, an unauthenticated attacker with access to the pod network can achieve arbitrary code execution in the context of the ingress-nginx controller. |
| 10 | CVE-2025-24893 | Critical | 9.8 | KEV | 66 | XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. |
Top 10 most-vulnerable vendors of 2025
Vendors ranked by distinct CVE count for the year. Counts include every CVE attached to any product the vendor ships in our CPE map.
| # | Vendor | CVE count |
|---|---|---|
| 1 | Linux | 3008 |
| 2 | Microsoft | 1915 |
| 3 | Apple | 1078 |
| 4 | Adobe | 819 |
| 5 | Code-Projects | 774 |
| 6 | Debian | 665 |
| 7 | 659 | |
| 8 | Phpgurukul | 608 |
| 9 | IBM | 492 |
Top 10 most-common CWEs of 2025
CWE classification ids ranked by the count of CVEs published in the year that carry them. Each CVE typically lists 1–3 CWE ids; counts reflect the union of those lists across the year's corpus.
| # | CWE | Name | CVE count |
|---|---|---|---|
| 1 | CWE-79 | Cross-site Scripting | 7640 |
| 2 | CWE-89 | SQL Injection | 3861 |
| 3 | CWE-74 | Improper Neutralization of Special Elements in Output Used by a Downstream Component (Injection) | 2568 |
| 4 | CWE-862 | Missing Authorization | 2362 |
| 5 | CWE-352 | Cross-Site Request Forgery (CSRF) | 1738 |
| 6 | CWE-94 | Code Injection | 1311 |
| 7 | CWE-284 | Improper Access Control | 1214 |
| 8 | CWE-119 | Improper Restriction of Operations within the Bounds of a Memory Buffer | 1163 |
| 9 | CWE-22 | Path Traversal | 1075 |
| 10 | CWE-787 | Out-of-bounds Write | 1053 |