# november 2025

> markdown for agents. every page and download is listed in [llms.txt](https://cvegen.art/llms.txt).

![drybrush poster for november 2025, painted from 3,020 published cves](https://media.cvegen.art/posters/2025-11/1280.jpg?v=c6eccd01d8)

what the poster shows: 30 days as bands of dry brush, the first day at the top. 4 ran above the 2025 average for their weekday and sweep fast and wide; the other 26 are slow, level strokes. two inks: the deep one for open-source packages, enterprise vendors, the linux kernel, browsers and ai software, the pale one for everything else.

the poster being painted, a 12 second film: [mp4](https://media.cvegen.art/films/2025-11.mp4?v=b2dff0582e)

| fact | value |
| --- | --- |
| cves | 3,020 |
| against an average 2025 month | 0.8× |
| busiest day | nov 11, 323 |
| rated critical, cvss 9 or higher | 256 |
| critical with no login and no click | 211 |
| used in real attacks | 11 |

## november 2025 in numbers

november 2025 brought 3,020 cves, 25% fewer than an average 2025 month. 4 of its 30 days ran above the 2025 average for that weekday.

- 323 on nov 11, the busiest day.
- 256 rated critical, cvss 9 or higher. 211 of them can be hit over the network with no login and nothing for a user to click.
- 348 came in three single drops: patchstack 147 on nov 6, apple 105 on nov 4, the linux kernel team 96 on nov 12.

## 11 already used in real attacks

cisa kev, as of oct 24, 2026.

### by product

- 2 microsoft windows, nov 11
- 2 fortinet fortiweb, nov 14, 18
- 1 react native community cli, nov 3
- 1 apple products, nov 5
- 1 sangoma freepbx, nov 7
- 1 gladinet triofox, nov 10
- 1 google chromium v8, nov 17
- 1 osgeo geoserver, nov 25
- 1 ray-project ray, nov 26

### every cve

- nov 3, react native community cli, [cve-2025-11953](https://www.cve.org/CVERecord?id=CVE-2025-11953)
- nov 5, apple multiple products, [cve-2023-43000](https://www.cve.org/CVERecord?id=CVE-2023-43000)
- nov 7, sangoma freepbx, [cve-2025-64328](https://www.cve.org/CVERecord?id=CVE-2025-64328)
- nov 10, gladinet triofox, [cve-2025-12480](https://www.cve.org/CVERecord?id=CVE-2025-12480)
- nov 11, microsoft windows, [cve-2025-60710](https://www.cve.org/CVERecord?id=CVE-2025-60710)
- nov 11, microsoft windows, [cve-2025-62215](https://www.cve.org/CVERecord?id=CVE-2025-62215)
- nov 14, fortinet fortiweb, [cve-2025-64446](https://www.cve.org/CVERecord?id=CVE-2025-64446)
- nov 17, google chromium v8, [cve-2025-13223](https://www.cve.org/CVERecord?id=CVE-2025-13223)
- nov 18, fortinet fortiweb, [cve-2025-58034](https://www.cve.org/CVERecord?id=CVE-2025-58034)
- nov 25, osgeo geoserver, [cve-2025-58360](https://www.cve.org/CVERecord?id=CVE-2025-58360)
- nov 26, ray-project ray, [cve-2025-62593](https://www.cve.org/CVERecord?id=CVE-2025-62593)

cisa keeps adding older cves when attacks come to light, so this list can still grow.

## this poster

| fact | value |
| --- | --- |
| period | november 1 to 30, 2025 |
| cves | 3,020 |
| data | cve list v5, cisa kev, drawn 2026-10-24 |
| format | 3:4, drawn for 45 × 60 cm |

[download jpg, 2000 × 2667](https://media.cvegen.art/posters/2025-11/2000.jpg?v=c6eccd01d8)

## other months

- before: [october 2025](https://cvegen.art/2025/10.md), 4,274 cves
- after: [december 2025](https://cvegen.art/2025/12.md), 5,493 cves
- [all months](https://cvegen.art/index.md)