# june 2025

> markdown for agents. every page and download is listed in [llms.txt](https://cvegen.art/llms.txt).

![drybrush poster for june 2025, painted from 3,682 published cves](https://media.cvegen.art/posters/2025-06/1280.jpg?v=76460f3df7)

what the poster shows: 30 days as bands of dry brush, the first day at the top. 7 ran above the 2025 average for their weekday and sweep fast and wide; the other 23 are slow, level strokes. two inks: the deep one for open-source packages, enterprise vendors, the linux kernel, browsers and ai software, the pale one for everything else.

the poster being painted, a 12 second film: [mp4](https://media.cvegen.art/films/2025-06.mp4?v=1845b5e009)

| fact | value |
| --- | --- |
| cves | 3,682 |
| against an average 2025 month | 0.9× |
| busiest day | jun 10, 488 |
| rated critical, cvss 9 or higher | 284 |
| critical with no login and no click | 237 |
| used in real attacks | 18 |

## june 2025 in numbers

june 2025 brought 3,682 cves, close to an average 2025 month. 7 of its 30 days ran above the 2025 average for that weekday.

- 488 on jun 10, the busiest day. adobe published 253 of them at once.
- 284 rated critical, cvss 9 or higher. 237 of them can be hit over the network with no login and nothing for a user to click.
- 797 came in three single drops: the linux kernel team 362 on jun 18, adobe 253 on jun 10, patchstack 182 on jun 6.

## 18 already used in real attacks

cisa kev, as of oct 24, 2026.

### by product

- 3 qualcomm multiple chipsets, jun 3
- 2 google chromium v8, jun 2, 30
- 2 microsoft windows, jun 10
- 2 citrix netscaler adc and gateway, jun 17, 25
- 1 dassault systèmes delmia apriso, jun 2
- 1 roundcube webmail, jun 2
- 1 igel os, jun 5
- 1 apple products, jun 16
- 1 rarlab winrar, jun 21
- 1 synacor zimbra collaboration suite, jun 23
- 1 quest kace systems management appliance, jun 24
- 1 cisco identity services engine, jun 25
- 1 sudo, jun 30

### every cve

- jun 2, roundcube webmail, [cve-2025-49113](https://www.cve.org/CVERecord?id=CVE-2025-49113)
- jun 2, dassault systèmes delmia apriso, [cve-2025-5086](https://www.cve.org/CVERecord?id=CVE-2025-5086)
- jun 2, google chromium v8, [cve-2025-5419](https://www.cve.org/CVERecord?id=CVE-2025-5419)
- jun 3, qualcomm multiple chipsets, [cve-2025-21479](https://www.cve.org/CVERecord?id=CVE-2025-21479)
- jun 3, qualcomm multiple chipsets, [cve-2025-21480](https://www.cve.org/CVERecord?id=CVE-2025-21480)
- jun 3, qualcomm multiple chipsets, [cve-2025-27038](https://www.cve.org/CVERecord?id=CVE-2025-27038)
- jun 5, igel igel os, [cve-2025-47827](https://www.cve.org/CVERecord?id=CVE-2025-47827)
- jun 10, microsoft windows, [cve-2025-33053](https://www.cve.org/CVERecord?id=CVE-2025-33053)
- jun 10, microsoft windows, [cve-2025-33073](https://www.cve.org/CVERecord?id=CVE-2025-33073)
- jun 16, apple multiple products, [cve-2025-43200](https://www.cve.org/CVERecord?id=CVE-2025-43200)
- jun 17, citrix netscaler adc and gateway, [cve-2025-5777](https://www.cve.org/CVERecord?id=CVE-2025-5777)
- jun 21, rarlab winrar, [cve-2025-6218](https://www.cve.org/CVERecord?id=CVE-2025-6218)
- jun 23, synacor zimbra collaboration suite (zcs), [cve-2025-48700](https://www.cve.org/CVERecord?id=CVE-2025-48700)
- jun 24, quest kace systems management appliance (sma), [cve-2025-32975](https://www.cve.org/CVERecord?id=CVE-2025-32975)
- jun 25, cisco identity services engine, [cve-2025-20281](https://www.cve.org/CVERecord?id=CVE-2025-20281)
- jun 25, citrix netscaler adc and gateway, [cve-2025-6543](https://www.cve.org/CVERecord?id=CVE-2025-6543)
- jun 30, sudo sudo, [cve-2025-32463](https://www.cve.org/CVERecord?id=CVE-2025-32463)
- jun 30, google chromium v8, [cve-2025-6554](https://www.cve.org/CVERecord?id=CVE-2025-6554)

cisa keeps adding older cves when attacks come to light, so this list can still grow.

## this poster

| fact | value |
| --- | --- |
| period | june 1 to 30, 2025 |
| cves | 3,682 |
| data | cve list v5, cisa kev, drawn 2026-10-24 |
| format | 3:4, drawn for 45 × 60 cm |

[download jpg, 2000 × 2667](https://media.cvegen.art/posters/2025-06/2000.jpg?v=76460f3df7)

## other months

- before: [may 2025](https://cvegen.art/2025/05.md), 3,980 cves
- after: [july 2025](https://cvegen.art/2025/07.md), 3,774 cves
- [all months](https://cvegen.art/index.md)