CVE Statistics: November 2025

🌐 Discover the key figures for vulnerabilities published in November 2025 on CVE Find.

🔎 Overview

• Total number of CVEs published : 3,115 (-29% vs the previous month)
• Vulnerabilities added to the CISA KEV catalog : 11

📂 Breakdown by main categories

• Cross-site Scripting : 427
• Authorization problems : 374
• SQL Injection : 260
• Overflow : 214
• File Inclusion : 81
• Cross-Site Request Forgery - CSRF : 81

📈 Breakdown by CVSS score

• Low : 103
• Medium : 1542
• High : 1042
• Critical : 272

🏢 Most affected vendors

1. apple : 175
2. microsoft : 145
3. google : 74
4. linux : 57
5. ibm : 40

📦 Most affected products

1. apple macos : 119
2. microsoft windows : 74
3. apple iphone_os : 71
4. apple ipados : 69
5. google chrome : 66

⚠️ Notable CVEs of the month

• CVE-2025-64126 (10 CRITICAL) : An OS command injection vulnerability exists due to improper input validation. The application accepts a parameter directly from user input without verifying it is a valid IP ...
• CVE-2025-64128 (10 CRITICAL) : An OS command injection vulnerability exists due to incomplete validation of user-supplied input. Validation fails to enforce sufficient formatting rules, which could permit a...
• CVE-2025-64127 (10 CRITICAL) : An OS command injection vulnerability exists due to insufficient sanitization of user-supplied input. The application accepts parameters that are later incorporated into OS co...
• CVE-2025-65108 (10 CRITICAL) : md-to-pdf is a CLI tool for converting Markdown files to PDF using Node.js and headless Chrome. Prior to version 5.2.5, a Markdown front-matter block that contains JavaScript de...
• CVE-2025-41115 (10 CRITICAL) : SCIM provisioning was introduced in Grafana Enterprise and Grafana Cloud in April to improve how organizations manage users and teams in Grafana by introducing automated user li...

Explore all the data in detail on CVE Find.