# february 2025

> markdown for agents. every page and download is listed in [llms.txt](https://cvegen.art/llms.txt).

![drybrush poster for february 2025, painted from 3,673 published cves](https://media.cvegen.art/posters/2025-02/1280.jpg?v=3e50b9fbbe)

what the poster shows: 28 days as bands of dry brush, the first day at the top. 6 ran above the 2025 average for their weekday and sweep fast and wide; the other 22 are slow, level strokes. two inks: the deep one for open-source packages, enterprise vendors, the linux kernel, browsers and ai software, the pale one for everything else.

the poster being painted, a 12 second film: [mp4](https://media.cvegen.art/films/2025-02.mp4?v=07a2c08537)

| fact | value |
| --- | --- |
| cves | 3,673 |
| against an average 2025 month | 0.9× |
| busiest day | feb 26, 790 |
| rated critical, cvss 9 or higher | 263 |
| critical with no login and no click | 213 |
| used in real attacks | 15 |

## february 2025 in numbers

february 2025 brought 3,673 cves, close to an average 2025 month. 6 of its 28 days ran above the 2025 average for that weekday.

- 790 on feb 26, the busiest day. the linux kernel team published 706 of them at once.
- 263 rated critical, cvss 9 or higher. 213 of them can be hit over the network with no login and nothing for a user to click.
- 952 came in three single drops: the linux kernel team 706 on feb 26, the linux kernel team 177 on feb 27, patchstack 69 on feb 3.

## 15 already used in real attacks

cisa kev, as of oct 24, 2026.

### by product

- 2 advantive veracore, feb 3
- 2 zyxel dsl cpe devices, feb 4
- 2 microsoft windows, feb 11
- 2 palo alto networks pan-os, feb 12
- 1 digiever ds-2105 pro, feb 3
- 1 trimble cityworks, feb 6
- 1 apple ios and ipados, feb 10
- 1 wazuh server, feb 10
- 1 fortinet fortios and fortiproxy, feb 11
- 1 microsoft power pages, feb 19
- 1 xwiki platform, feb 20

### every cve

- feb 3, digiever ds-2105 pro, [cve-2023-52163](https://www.cve.org/CVERecord?id=CVE-2023-52163)
- feb 3, advantive veracore, [cve-2024-57968](https://www.cve.org/CVERecord?id=CVE-2024-57968)
- feb 3, advantive veracore, [cve-2025-25181](https://www.cve.org/CVERecord?id=CVE-2025-25181)
- feb 4, zyxel dsl cpe devices, [cve-2024-40890](https://www.cve.org/CVERecord?id=CVE-2024-40890)
- feb 4, zyxel dsl cpe devices, [cve-2024-40891](https://www.cve.org/CVERecord?id=CVE-2024-40891)
- feb 6, trimble cityworks, [cve-2025-0994](https://www.cve.org/CVERecord?id=CVE-2025-0994)
- feb 10, wazuh wazuh server, [cve-2025-24016](https://www.cve.org/CVERecord?id=CVE-2025-24016)
- feb 10, apple ios and ipados, [cve-2025-24200](https://www.cve.org/CVERecord?id=CVE-2025-24200)
- feb 11, microsoft windows, [cve-2025-21391](https://www.cve.org/CVERecord?id=CVE-2025-21391)
- feb 11, microsoft windows, [cve-2025-21418](https://www.cve.org/CVERecord?id=CVE-2025-21418)
- feb 11, fortinet fortios and fortiproxy, [cve-2025-24472](https://www.cve.org/CVERecord?id=CVE-2025-24472)
- feb 12, palo alto networks pan-os, [cve-2025-0108](https://www.cve.org/CVERecord?id=CVE-2025-0108)
- feb 12, palo alto networks pan-os, [cve-2025-0111](https://www.cve.org/CVERecord?id=CVE-2025-0111)
- feb 19, microsoft power pages, [cve-2025-24989](https://www.cve.org/CVERecord?id=CVE-2025-24989)
- feb 20, xwiki platform, [cve-2025-24893](https://www.cve.org/CVERecord?id=CVE-2025-24893)

cisa keeps adding older cves when attacks come to light, so this list can still grow.

## this poster

| fact | value |
| --- | --- |
| period | february 1 to 28, 2025 |
| cves | 3,673 |
| data | cve list v5, cisa kev, drawn 2026-10-24 |
| format | 3:4, drawn for 45 × 60 cm |

[download jpg, 2000 × 2667](https://media.cvegen.art/posters/2025-02/2000.jpg?v=3e50b9fbbe)

## other months

- before: [january 2025](https://cvegen.art/2025/01.md), 4,273 cves
- after: [march 2025](https://cvegen.art/2025/03.md), 4,001 cves
- [all months](https://cvegen.art/index.md)