# march 2025 > markdown for agents. every page and download is listed in [llms.txt](https://cvegen.art/llms.txt). ![drybrush poster for march 2025, painted from 4,001 published cves](https://media.cvegen.art/posters/2025-03/1280.jpg?v=49064e9203) what the poster shows: 31 days as bands of dry brush, the first day at the top. 6 ran above the 2025 average for their weekday and sweep fast and wide; the other 25 are slow, level strokes. two inks: the deep one for open-source packages, enterprise vendors, the linux kernel, browsers and ai software, the pale one for everything else. the poster being painted, a 12 second film: [mp4](https://media.cvegen.art/films/2025-03.mp4?v=5634403ddc) | fact | value | | --- | --- | | cves | 4,001 | | against an average 2025 month | 1.0× | | busiest day | mar 27, 377 | | rated critical, cvss 9 or higher | 396 | | critical with no login and no click | 363 | | used in real attacks | 26 | ## march 2025 in numbers march 2025 brought 4,001 cves, close to an average 2025 month. 6 of its 31 days ran above the 2025 average for that weekday. - 377 on mar 27, the busiest day. patchstack published 166 of them at once. - 396 rated critical, cvss 9 or higher. 363 of them can be hit over the network with no login and nothing for a user to click. - 634 came in three single drops: @huntr 298 on mar 20, patchstack 170 on mar 3, patchstack 166 on mar 27. ## 26 already used in real attacks cisa kev, as of oct 24, 2026. ### by product - 7 microsoft windows, mar 11 - 2 kentico xperience cms, mar 24 - 1 edimax ic-7100 ip camera, mar 4 - 1 nakivo backup and replication, mar 4 - 1 vmware esxi, mar 4 - 1 vmware esxi and workstation, mar 4 - 1 vmware esxi, workstation, and fusion, mar 4 - 1 apache tomcat, mar 10 - 1 ami megarac spx, mar 11 - 1 apple products, mar 11 - 1 freetype, mar 11 - 1 juniper junos os, mar 12 - 1 synacor zimbra collaboration suite, mar 12 - 1 tj-actions changed-files github action, mar 15 - 1 reviewdog action-setup github action, mar 19 - 1 kentico xperience, mar 24 - 1 d-link dir-823x, mar 25 - 1 google chromium mojo, mar 26 - 1 vitejs, mar 31 ### every cve - mar 4, nakivo backup and replication, [cve-2024-48248](https://www.cve.org/CVERecord?id=CVE-2024-48248) - mar 4, edimax ic-7100 ip camera, [cve-2025-1316](https://www.cve.org/CVERecord?id=CVE-2025-1316) - mar 4, vmware esxi and workstation, [cve-2025-22224](https://www.cve.org/CVERecord?id=CVE-2025-22224) - mar 4, vmware esxi, [cve-2025-22225](https://www.cve.org/CVERecord?id=CVE-2025-22225) - mar 4, vmware esxi, workstation, and fusion, [cve-2025-22226](https://www.cve.org/CVERecord?id=CVE-2025-22226) - mar 10, apache tomcat, [cve-2025-24813](https://www.cve.org/CVERecord?id=CVE-2025-24813) - mar 11, ami megarac spx, [cve-2024-54085](https://www.cve.org/CVERecord?id=CVE-2024-54085) - mar 11, microsoft windows, [cve-2025-24054](https://www.cve.org/CVERecord?id=CVE-2025-24054) - mar 11, apple multiple products, [cve-2025-24201](https://www.cve.org/CVERecord?id=CVE-2025-24201) - mar 11, microsoft windows, [cve-2025-24983](https://www.cve.org/CVERecord?id=CVE-2025-24983) - mar 11, microsoft windows, [cve-2025-24984](https://www.cve.org/CVERecord?id=CVE-2025-24984) - mar 11, microsoft windows, [cve-2025-24985](https://www.cve.org/CVERecord?id=CVE-2025-24985) - mar 11, microsoft windows, [cve-2025-24991](https://www.cve.org/CVERecord?id=CVE-2025-24991) - mar 11, microsoft windows, [cve-2025-24993](https://www.cve.org/CVERecord?id=CVE-2025-24993) - mar 11, microsoft windows, [cve-2025-26633](https://www.cve.org/CVERecord?id=CVE-2025-26633) - mar 11, freetype freetype, [cve-2025-27363](https://www.cve.org/CVERecord?id=CVE-2025-27363) - mar 12, juniper junos os, [cve-2025-21590](https://www.cve.org/CVERecord?id=CVE-2025-21590) - mar 12, synacor zimbra collaboration suite (zcs), [cve-2025-27915](https://www.cve.org/CVERecord?id=CVE-2025-27915) - mar 15, tj-actions changed-files github action, [cve-2025-30066](https://www.cve.org/CVERecord?id=CVE-2025-30066) - mar 19, reviewdog action-setup github action, [cve-2025-30154](https://www.cve.org/CVERecord?id=CVE-2025-30154) - mar 24, kentico xperience cms, [cve-2025-2746](https://www.cve.org/CVERecord?id=CVE-2025-2746) - mar 24, kentico xperience cms, [cve-2025-2747](https://www.cve.org/CVERecord?id=CVE-2025-2747) - mar 24, kentico kentico xperience, [cve-2025-2749](https://www.cve.org/CVERecord?id=CVE-2025-2749) - mar 25, d-link dir-823x, [cve-2025-29635](https://www.cve.org/CVERecord?id=CVE-2025-29635) - mar 26, google chromium mojo, [cve-2025-2783](https://www.cve.org/CVERecord?id=CVE-2025-2783) - mar 31, vite vitejs, [cve-2025-31125](https://www.cve.org/CVERecord?id=CVE-2025-31125) cisa keeps adding older cves when attacks come to light, so this list can still grow. ## this poster | fact | value | | --- | --- | | period | march 1 to 31, 2025 | | cves | 4,001 | | data | cve list v5, cisa kev, drawn 2026-10-24 | | format | 3:4, drawn for 45 × 60 cm | [download jpg, 2000 × 2667](https://media.cvegen.art/posters/2025-03/2000.jpg?v=49064e9203) ## other months - before: [february 2025](https://cvegen.art/2025/02.md), 3,673 cves - after: [april 2025](https://cvegen.art/2025/04.md), 4,033 cves - [all months](https://cvegen.art/index.md)