cvegen

september 2025

cves
4,319
against an average 2025 month
1.1×
busiest day
sep 22, 414
used in real attacks
16

september 2025 brought 4,319 cves, close to an average 2025 month.

9 of its 30 days ran above the 2025 average for that weekday.

414

on sep 22, the busiest day. patchstack published 291 of them at once.

296

rated critical, cvss 9 or higher. 260 of them can be hit over the network with no login and nothing for a user to click.

622

came in three single drops: patchstack 291 on sep 22, the linux kernel team 210 on sep 15, the linux kernel team 121 on sep 18.

16 already used in real attacks

cisa kev, as of oct 24, 2026

  • 2
    samsung mobile devices
    sep 12
  • 2
    cisco secure firewall adaptive security appliance and secure firewall threat defense
    sep 25
  • 1
    sitecore products
    sep 3
  • 1
    android runtime
    sep 4
  • 1
    linux kernel
    sep 5
  • 1
    adobe commerce and magento
    sep 9
  • 1
    watchguard firebox
    sep 17
  • 1
    fortra goanywhere mft
    sep 18
  • 1
    cwp control web panel
    sep 19
  • 1
    libraesva email security gateway
    sep 19
and 4 more productsall 16 with cve ids

cisa keeps adding older cves when attacks come to light, so this list can still grow.

this poster

period
september 1 to 30, 2025
cves
4,319
data
cve list v5, cisa kev, drawn 2026-10-24
format
3:4, drawn for 45 × 60 cm
download jpg, 2000 × 2667