# april 2025

> markdown for agents. every page and download is listed in [llms.txt](https://cvegen.art/llms.txt).

![drybrush poster for april 2025, painted from 4,033 published cves](https://media.cvegen.art/posters/2025-04/1280.jpg?v=c94d82deb5)

what the poster shows: 30 days as bands of dry brush, the first day at the top. 9 ran above the 2025 average for their weekday and sweep fast and wide; the other 21 are slow, level strokes. two inks: the deep one for open-source packages, enterprise vendors, the linux kernel, browsers and ai software, the pale one for everything else.

the poster being painted, a 12 second film: [mp4](https://media.cvegen.art/films/2025-04.mp4?v=07e07a4eac)

| fact | value |
| --- | --- |
| cves | 4,033 |
| against an average 2025 month | 1.0× |
| busiest day | apr 1, 429 |
| rated critical, cvss 9 or higher | 317 |
| critical with no login and no click | 258 |
| used in real attacks | 16 |

## april 2025 in numbers

april 2025 brought 4,033 cves, close to an average 2025 month. 9 of its 30 days ran above the 2025 average for that weekday.

- 429 on apr 1, the busiest day. patchstack published 260 of them at once.
- 317 rated critical, cvss 9 or higher. 258 of them can be hit over the network with no login and nothing for a user to click.
- 617 came in three single drops: patchstack 260 on apr 1, patchstack 221 on apr 17, patchstack 136 on apr 4.

## 16 already used in real attacks

cisa kev, as of oct 24, 2026.

### by product

- 2 apple products, apr 16
- 1 crushftp, apr 3
- 1 gladinet centrestack, apr 3
- 1 ivanti connect secure, policy secure, and zta gateways, apr 3
- 1 langflow, apr 7
- 1 microsoft windows, apr 8
- 1 yiiframework yii, apr 10
- 1 erlang/otp, apr 16
- 1 qualitia active! mail, apr 18
- 1 commvault command center, apr 22
- 1 broadcom brocade fabric os, apr 24
- 1 sap netweaver, apr 24
- 1 commvault web server, apr 25
- 1 connectwise screenconnect, apr 25
- 1 craft cms, apr 25

### every cve

- apr 3, ivanti connect secure, policy secure, and zta gateways, [cve-2025-22457](https://www.cve.org/CVERecord?id=CVE-2025-22457)
- apr 3, gladinet centrestack, [cve-2025-30406](https://www.cve.org/CVERecord?id=CVE-2025-30406)
- apr 3, crushftp crushftp, [cve-2025-31161](https://www.cve.org/CVERecord?id=CVE-2025-31161)
- apr 7, langflow langflow, [cve-2025-3248](https://www.cve.org/CVERecord?id=CVE-2025-3248)
- apr 8, microsoft windows, [cve-2025-29824](https://www.cve.org/CVERecord?id=CVE-2025-29824)
- apr 10, yiiframework yii, [cve-2024-58136](https://www.cve.org/CVERecord?id=CVE-2024-58136)
- apr 16, apple multiple products, [cve-2025-31200](https://www.cve.org/CVERecord?id=CVE-2025-31200)
- apr 16, apple multiple products, [cve-2025-31201](https://www.cve.org/CVERecord?id=CVE-2025-31201)
- apr 16, erlang erlang/otp, [cve-2025-32433](https://www.cve.org/CVERecord?id=CVE-2025-32433)
- apr 18, qualitia active! mail, [cve-2025-42599](https://www.cve.org/CVERecord?id=CVE-2025-42599)
- apr 22, commvault command center, [cve-2025-34028](https://www.cve.org/CVERecord?id=CVE-2025-34028)
- apr 24, broadcom brocade fabric os, [cve-2025-1976](https://www.cve.org/CVERecord?id=CVE-2025-1976)
- apr 24, sap netweaver, [cve-2025-31324](https://www.cve.org/CVERecord?id=CVE-2025-31324)
- apr 25, craft cms craft cms, [cve-2025-32432](https://www.cve.org/CVERecord?id=CVE-2025-32432)
- apr 25, commvault web server, [cve-2025-3928](https://www.cve.org/CVERecord?id=CVE-2025-3928)
- apr 25, connectwise screenconnect, [cve-2025-3935](https://www.cve.org/CVERecord?id=CVE-2025-3935)

cisa keeps adding older cves when attacks come to light, so this list can still grow.

## this poster

| fact | value |
| --- | --- |
| period | april 1 to 30, 2025 |
| cves | 4,033 |
| data | cve list v5, cisa kev, drawn 2026-10-24 |
| format | 3:4, drawn for 45 × 60 cm |

[download jpg, 2000 × 2667](https://media.cvegen.art/posters/2025-04/2000.jpg?v=c94d82deb5)

## other months

- before: [march 2025](https://cvegen.art/2025/03.md), 4,001 cves
- after: [may 2025](https://cvegen.art/2025/05.md), 3,980 cves
- [all months](https://cvegen.art/index.md)