Jerry Gamblin has published a blog post summarising the year of 2025 in the CVE program. Some facts from his excellent blog post:
- Number of CVEs: 48185 – a 20% growth from the year before
- Total number of CVEs since start: 308 920
- Active CVE Numbering Authorities (CNAs): 365
- Busiest day: February 26 with 793 registred CVEs
The largest number of CVEs is registered for the Linux Kernel. Second in place is the WordPress eco system, which is an important change.
But the matching part is missing. Jerry notices that only 57% of the CVEs has a CPE. This is a huge problem for all vulnerability management systems, with or without a Software Bill of Materials. With almost 50 thousand CVEs – with an average of 132 per calendar day – automation is needed and it will not work without proper identifiers.
Read Jerry’s blog to get the full report!
