# july 2025

> markdown for agents. every page and download is listed in [llms.txt](https://cvegen.art/llms.txt).

![drybrush poster for july 2025, painted from 3,774 published cves](https://media.cvegen.art/posters/2025-07/1280.jpg?v=9f2c01ae23)

what the poster shows: 31 days as bands of dry brush, the first day at the top. 7 ran above the 2025 average for their weekday and sweep fast and wide; the other 24 are slow, level strokes. two inks: the deep one for open-source packages, enterprise vendors, the linux kernel, browsers and ai software, the pale one for everything else.

the poster being painted, a 12 second film: [mp4](https://media.cvegen.art/films/2025-07.mp4?v=043cc56461)

| fact | value |
| --- | --- |
| cves | 3,774 |
| against an average 2025 month | 0.9× |
| busiest day | jul 8, 438 |
| rated critical, cvss 9 or higher | 391 |
| critical with no login and no click | 323 |
| used in real attacks | 14 |

## july 2025 in numbers

july 2025 brought 3,774 cves, close to an average 2025 month. 7 of its 31 days ran above the 2025 average for that weekday.

- 438 on jul 8, the busiest day.
- 391 rated critical, cvss 9 or higher. 323 of them can be hit over the network with no login and nothing for a user to click.
- 215 came in two single drops: the linux kernel team 114 on jul 25, zdi 101 on jul 21.

## 14 already used in real attacks

cisa kev, as of oct 24, 2026.

### by product

- 3 microsoft sharepoint, jul 8, 20
- 2 wing ftp server, jul 10
- 1 git, jul 8
- 1 google chromium, jul 15
- 1 cisco identity services engine, jul 16
- 1 fortinet fortiweb, jul 17
- 1 laravel livewire, jul 17
- 1 crushftp, jul 18
- 1 prettier eslint-config-prettier, jul 19
- 1 linux kernel, jul 22
- 1 apple products, jul 29

### every cve

- jul 8, git git, [cve-2025-48384](https://www.cve.org/CVERecord?id=CVE-2025-48384)
- jul 8, microsoft sharepoint, [cve-2025-49704](https://www.cve.org/CVERecord?id=CVE-2025-49704)
- jul 8, microsoft sharepoint, [cve-2025-49706](https://www.cve.org/CVERecord?id=CVE-2025-49706)
- jul 10, wing ftp server wing ftp server, [cve-2025-47812](https://www.cve.org/CVERecord?id=CVE-2025-47812)
- jul 10, wing ftp server wing ftp server, [cve-2025-47813](https://www.cve.org/CVERecord?id=CVE-2025-47813)
- jul 15, google chromium, [cve-2025-6558](https://www.cve.org/CVERecord?id=CVE-2025-6558)
- jul 16, cisco identity services engine, [cve-2025-20337](https://www.cve.org/CVERecord?id=CVE-2025-20337)
- jul 17, fortinet fortiweb, [cve-2025-25257](https://www.cve.org/CVERecord?id=CVE-2025-25257)
- jul 17, laravel livewire, [cve-2025-54068](https://www.cve.org/CVERecord?id=CVE-2025-54068)
- jul 18, crushftp crushftp, [cve-2025-54309](https://www.cve.org/CVERecord?id=CVE-2025-54309)
- jul 19, prettier eslint-config-prettier, [cve-2025-54313](https://www.cve.org/CVERecord?id=CVE-2025-54313)
- jul 20, microsoft sharepoint, [cve-2025-53770](https://www.cve.org/CVERecord?id=CVE-2025-53770)
- jul 22, linux kernel, [cve-2025-38352](https://www.cve.org/CVERecord?id=CVE-2025-38352)
- jul 29, apple multiple products, [cve-2025-31277](https://www.cve.org/CVERecord?id=CVE-2025-31277)

cisa keeps adding older cves when attacks come to light, so this list can still grow.

## this poster

| fact | value |
| --- | --- |
| period | july 1 to 31, 2025 |
| cves | 3,774 |
| data | cve list v5, cisa kev, drawn 2026-10-24 |
| format | 3:4, drawn for 45 × 60 cm |

[download jpg, 2000 × 2667](https://media.cvegen.art/posters/2025-07/2000.jpg?v=9f2c01ae23)

## other months

- before: [june 2025](https://cvegen.art/2025/06.md), 3,682 cves
- after: [august 2025](https://cvegen.art/2025/08.md), 3,629 cves
- [all months](https://cvegen.art/index.md)