cvegen

april 2025

cves
4,033
against an average 2025 month
1.0×
busiest day
apr 1, 429
used in real attacks
16

april 2025 brought 4,033 cves, close to an average 2025 month.

9 of its 30 days ran above the 2025 average for that weekday.

429

on apr 1, the busiest day. patchstack published 260 of them at once.

317

rated critical, cvss 9 or higher. 258 of them can be hit over the network with no login and nothing for a user to click.

617

came in three single drops: patchstack 260 on apr 1, patchstack 221 on apr 17, patchstack 136 on apr 4.

16 already used in real attacks

cisa kev, as of oct 24, 2026

  • 2
    apple products
    apr 16
  • 1
    crushftp
    apr 3
  • 1
    gladinet centrestack
    apr 3
  • 1
    ivanti connect secure, policy secure, and zta gateways
    apr 3
  • 1
    langflow
    apr 7
  • 1
    microsoft windows
    apr 8
  • 1
    yiiframework yii
    apr 10
  • 1
    erlang/otp
    apr 16
  • 1
    qualitia active! mail
    apr 18
  • 1
    commvault command center
    apr 22
and 5 more productsall 16 with cve ids

cisa keeps adding older cves when attacks come to light, so this list can still grow.

this poster

period
april 1 to 30, 2025
cves
4,033
data
cve list v5, cisa kev, drawn 2026-10-24
format
3:4, drawn for 45 × 60 cm
download jpg, 2000 × 2667