# october 2025

> markdown for agents. every page and download is listed in [llms.txt](https://cvegen.art/llms.txt).

![drybrush poster for october 2025, painted from 4,274 published cves](https://media.cvegen.art/posters/2025-10/1280.jpg?v=1d8eb28b93)

what the poster shows: 31 days as bands of dry brush, the first day at the top. 7 ran above the 2025 average for their weekday and sweep fast and wide; the other 24 are slow, level strokes. two inks: the deep one for open-source packages, enterprise vendors, the linux kernel, browsers and ai software, the pale one for everything else.

the poster being painted, a 12 second film: [mp4](https://media.cvegen.art/films/2025-10.mp4?v=d5e7d84666)

| fact | value |
| --- | --- |
| cves | 4,274 |
| against an average 2025 month | 1.1× |
| busiest day | oct 22, 389 |
| rated critical, cvss 9 or higher | 315 |
| critical with no login and no click | 245 |
| used in real attacks | 10 |

## october 2025 in numbers

october 2025 brought 4,274 cves, close to an average 2025 month. 7 of its 31 days ran above the 2025 average for that weekday.

- 389 on oct 22, the busiest day. patchstack published 210 of them at once.
- 315 rated critical, cvss 9 or higher. 245 of them can be hit over the network with no login and nothing for a user to click.
- 546 came in three single drops: patchstack 210 on oct 22, the linux kernel team 169 on oct 1, microsoft 167 on oct 14.

## 10 already used in real attacks

cisa kev, as of oct 24, 2026.

### by product

- 3 microsoft windows, oct 14
- 2 oracle e-business suite, oct 5, 12
- 1 gladinet centrestack and triofox, oct 9
- 1 linux kernel, oct 13
- 1 f5 big-ip, oct 15
- 1 motex lanscope endpoint manager, oct 20
- 1 oracle fusion middleware, oct 21

### every cve

- oct 5, oracle e-business suite, [cve-2025-61882](https://www.cve.org/CVERecord?id=CVE-2025-61882)
- oct 9, gladinet centrestack and triofox, [cve-2025-11371](https://www.cve.org/CVERecord?id=CVE-2025-11371)
- oct 12, oracle e-business suite, [cve-2025-61884](https://www.cve.org/CVERecord?id=CVE-2025-61884)
- oct 13, linux kernel, [cve-2025-39964](https://www.cve.org/CVERecord?id=CVE-2025-39964)
- oct 14, microsoft windows, [cve-2025-24990](https://www.cve.org/CVERecord?id=CVE-2025-24990)
- oct 14, microsoft windows, [cve-2025-59230](https://www.cve.org/CVERecord?id=CVE-2025-59230)
- oct 14, microsoft windows, [cve-2025-59287](https://www.cve.org/CVERecord?id=CVE-2025-59287)
- oct 15, f5 big-ip, [cve-2025-53521](https://www.cve.org/CVERecord?id=CVE-2025-53521)
- oct 20, motex lanscope endpoint manager, [cve-2025-61932](https://www.cve.org/CVERecord?id=CVE-2025-61932)
- oct 21, oracle fusion middleware, [cve-2025-61757](https://www.cve.org/CVERecord?id=CVE-2025-61757)

cisa keeps adding older cves when attacks come to light, so this list can still grow.

## this poster

| fact | value |
| --- | --- |
| period | october 1 to 31, 2025 |
| cves | 4,274 |
| data | cve list v5, cisa kev, drawn 2026-10-24 |
| format | 3:4, drawn for 45 × 60 cm |

[download jpg, 2000 × 2667](https://media.cvegen.art/posters/2025-10/2000.jpg?v=1d8eb28b93)

## other months

- before: [september 2025](https://cvegen.art/2025/09.md), 4,319 cves
- after: [november 2025](https://cvegen.art/2025/11.md), 3,020 cves
- [all months](https://cvegen.art/index.md)