cvegen

november 2025

cves
3,020
against an average 2025 month
0.8×
busiest day
nov 11, 323
used in real attacks
11

november 2025 brought 3,020 cves, 25% fewer than an average 2025 month.

4 of its 30 days ran above the 2025 average for that weekday.

323

on nov 11, the busiest day.

256

rated critical, cvss 9 or higher. 211 of them can be hit over the network with no login and nothing for a user to click.

348

came in three single drops: patchstack 147 on nov 6, apple 105 on nov 4, the linux kernel team 96 on nov 12.

11 already used in real attacks

cisa kev, as of oct 24, 2026

  • 2
    microsoft windows
    nov 11
  • 2
    fortinet fortiweb
    nov 14, 18
  • 1
    react native community cli
    nov 3
  • 1
    apple products
    nov 5
  • 1
    sangoma freepbx
    nov 7
  • 1
    gladinet triofox
    nov 10
  • 1
    google chromium v8
    nov 17
  • 1
    osgeo geoserver
    nov 25
  • 1
    ray-project ray
    nov 26
all 11 with cve ids

cisa keeps adding older cves when attacks come to light, so this list can still grow.

this poster

period
november 1 to 30, 2025
cves
3,020
data
cve list v5, cisa kev, drawn 2026-10-24
format
3:4, drawn for 45 × 60 cm
download jpg, 2000 × 2667