# august 2025

> markdown for agents. every page and download is listed in [llms.txt](https://cvegen.art/llms.txt).

![drybrush poster for august 2025, painted from 3,629 published cves](https://media.cvegen.art/posters/2025-08/1280.jpg?v=02d1f3e1a6)

what the poster shows: 31 days as bands of dry brush, the first day at the top. 7 ran above the 2025 average for their weekday and sweep fast and wide; the other 24 are slow, level strokes. two inks: the deep one for open-source packages, enterprise vendors, the linux kernel, browsers and ai software, the pale one for everything else.

the poster being painted, a 12 second film: [mp4](https://media.cvegen.art/films/2025-08.mp4?v=04bd995821)

| fact | value |
| --- | --- |
| cves | 3,629 |
| against an average 2025 month | 0.9× |
| busiest day | aug 12, 353 |
| rated critical, cvss 9 or higher | 425 |
| critical with no login and no click | 351 |
| used in real attacks | 12 |

## august 2025 in numbers

august 2025 brought 3,629 cves, close to an average 2025 month. 7 of its 31 days ran above the 2025 average for that weekday.

- 353 on aug 12, the busiest day. microsoft published 106 of them at once.
- 425 rated critical, cvss 9 or higher. 351 of them can be hit over the network with no login and nothing for a user to click.
- 378 came in three single drops: patchstack 154 on aug 14, patchstack 118 on aug 20, microsoft 106 on aug 12.

## 12 already used in real attacks

cisa kev, as of oct 24, 2026.

### by product

- 2 dassault systèmes delmia apriso, aug 4
- 2 n-able n-central, aug 14
- 1 adobe experience manager forms, aug 5
- 1 trend micro apex one, aug 5
- 1 rarlab winrar, aug 8
- 1 apple ios, ipados, and macos, aug 21
- 1 citrix netscaler, aug 26
- 1 sangoma freepbx, aug 28
- 1 meta platforms whatsapp, aug 29
- 1 tp-link multiple routers, aug 29

### every cve

- aug 4, dassault systèmes delmia apriso, [cve-2025-6204](https://www.cve.org/CVERecord?id=CVE-2025-6204)
- aug 4, dassault systèmes delmia apriso, [cve-2025-6205](https://www.cve.org/CVERecord?id=CVE-2025-6205)
- aug 5, adobe experience manager (aem) forms, [cve-2025-54253](https://www.cve.org/CVERecord?id=CVE-2025-54253)
- aug 5, trend micro apex one, [cve-2025-54948](https://www.cve.org/CVERecord?id=CVE-2025-54948)
- aug 8, rarlab winrar, [cve-2025-8088](https://www.cve.org/CVERecord?id=CVE-2025-8088)
- aug 14, n-able n-central, [cve-2025-8875](https://www.cve.org/CVERecord?id=CVE-2025-8875)
- aug 14, n-able n-central, [cve-2025-8876](https://www.cve.org/CVERecord?id=CVE-2025-8876)
- aug 21, apple ios, ipados, and macos, [cve-2025-43300](https://www.cve.org/CVERecord?id=CVE-2025-43300)
- aug 26, citrix netscaler, [cve-2025-7775](https://www.cve.org/CVERecord?id=CVE-2025-7775)
- aug 28, sangoma freepbx, [cve-2025-57819](https://www.cve.org/CVERecord?id=CVE-2025-57819)
- aug 29, meta platforms whatsapp, [cve-2025-55177](https://www.cve.org/CVERecord?id=CVE-2025-55177)
- aug 29, tp-link multiple routers, [cve-2025-9377](https://www.cve.org/CVERecord?id=CVE-2025-9377)

cisa keeps adding older cves when attacks come to light, so this list can still grow.

## this poster

| fact | value |
| --- | --- |
| period | august 1 to 31, 2025 |
| cves | 3,629 |
| data | cve list v5, cisa kev, drawn 2026-10-24 |
| format | 3:4, drawn for 45 × 60 cm |

[download jpg, 2000 × 2667](https://media.cvegen.art/posters/2025-08/2000.jpg?v=02d1f3e1a6)

## other months

- before: [july 2025](https://cvegen.art/2025/07.md), 3,774 cves
- after: [september 2025](https://cvegen.art/2025/09.md), 4,319 cves
- [all months](https://cvegen.art/index.md)