CVE Tools
Track your stack

November 2014

505 CVEs published, −64% on October 2014 and +27% on November 2013. CISA added 0 to KEV.

2014 month by month

2014, month by month. Point at another month to read it.
2014: CVEs published per month
YearJanFebMarAprMayJunJulAugSepOctNovDecYear total
2014January 2014: 579 CVEsFebruary 2014: 445 CVEsMarch 2014: 545 CVEsApril 2014: 676 CVEsMay 2014: 555 CVEsJune 2014: 448 CVEsJuly 2014: 656 CVEsAugust 2014: 407 CVEsSeptember 2014: 1,156 CVEsOctober 2014: 1,418 CVEsNovember 2014: 505 CVEsDecember 2014: 618 CVEs8,008+50%
Critical
5611% of the 501 with a CVSS score
Added to CISA KEV
04 of this month's CVEs are in KEV, listed a median 2714.5 days after publication
Vendors
206478 products
Top weakness
XSSCWE-79 · 60 CVEs

Who drove it

Vendors by distinct CVEs this month, with how many of those CVEs are now in CISA KEV and how far each moved in the ranking.

  1. 1DebianDebian Linux, Advanced Package Tool360nonenew
  2. 2CanonicalUbuntu Linux, Ubuntu340nonenew
  3. 3MicrosoftInternet Explorer, Windows 7, Windows Server 200833163new
  4. 4Red HatRed Hat Enterprise Linux, Enterprise Linux Desktop, Enterprise Linux Workstation321nonenew
  5. 5OpensuseOpensuse, Evergreen280nonenew
  6. 6QemuQemu270nonenew
  7. 7LinuxLinux Kernel240nonenew
  8. 8IBMSecurity Identity Manager, Qradar Risk Manager, Qradar Vulnerability Manager230nonenew
  9. 9PackagistMoodle/moodle, Zendframework/zendservice-windowsazure, Zendframework/zendservice-slideshare221nonenew
  10. 10AdobeAir Sdk, Air, Air Sdk \& Compiler20151new
  11. 11SapNetweaver, Business Intelligence Development Workbench, Hana193nonenew
  12. 12CiscoIOS, RV220W Firmware, RV220W171nonenew
  13. 13AppleMac OS X, iPhone OS, tvOS161nonenew
  14. 14MoodleMoodle150nonenew
  15. 15SuseSuse Linux Enterprise Server, Linux Enterprise Software Development Kit, Linux Enterprise Real Time Extension130nonenew
  16. 16GoogleChrome120nonenew
  17. 17Aruba NetworksClearpass, Airwave, Clearpass Policy Manager115nonenew
  18. 18FfmpegFfmpeg110nonenew
  19. 19OracleLinux, Solaris, Hyperion100nonenew
  20. 20DigiumAsterisk, Certified Asterisk91nonenew
  21. 21WordPressWordPress90nonenew
  22. 22MavenOrg.webjars.npm:jquery-ui, Org.directwebremoting:dwr, Org.jboss.resteasy:resteasy-jaxrs70nonenew
  23. 23ApacheCordova, Drill, Hive60nonenew
  24. 24MantisbtMantisbt60nonenew
  25. 25PhpmyadminPhpmyadmin60nonenew

Severity

How this month's CVEs score on CVSS; 4 have no score yet. Severity is not exploitation.

  • Critical5611%
  • High12325%
  • Medium28557%
  • Low377%

Breakouts

Vendors with at least three times their own 12-month median.

  1. Oracle1010.0×
  2. Packagist227.3×
  3. Rubygems66.0×
  4. Adobe205.0×
  5. Suse134.3×
  6. Apple164.0×
  7. Debian363.0×
  8. Apache63.0×
  9. Haxx33.0×
  10. Moodle153.0×

New in the top 100

Not in the top 100 in any of the 24 months before.

  1. Compal Broadband Networks5#27
  2. Go4#33
  3. Zend4#34
  4. Arris3#35
  5. Check Point Software Technologies Ltd.3#37
  6. Gogits3#39
  7. Mageia Project3#41
  8. Zte3#48
  9. Accuenergy2#49
  10. Directwebremoting2#53

What kind of weakness

Weakness classes (CWE) by distinct CVEs, with how far each moved in the ranking.

  1. CWE-79XSS60new
  2. CWE-26452new
  3. CWE-200Information Exposure48new
  4. CWE-119Memory Buffer Bounds46new
  5. CWE-20Improper Input Validation39new
  6. CWE-39933new
  7. CWE-89SQL Injection29new
  8. CWE-94Code Injection26new
  9. CWE-352CSRF20new
  10. CWE-22Path Traversal15new
  11. CWE-18914new
  12. CWE-31011new
  13. CWE-1710new
  14. CWE-1910new
  15. CWE-284Improper Access Control6new
  16. CWE-362Race Condition6new
  17. CWE-2555new
  18. CWE-287Improper Authentication5new
  19. CWE-400Resource Consumption4new
  20. CWE-125Out-of-bounds Read2new

Where it landed

The month's CVEs by the sector of the software they affect. A CVE that touches several sectors counts in each.

Area is CVEs this month. Point at a sector to read it.

Which weakness, where

The top weakness classes against the vendors and the sectors that carried them.

The lighter the cell, the more CVEs. Point at one to read it.

November 2014: weakness classes by vendor and by sector: By vendor
By vendor79XSS264200Information Exposure119Memory Buffer Bounds20Improper Input Validation39989SQL Injection94Code Injection352CSRF22Path Traversal
Debian31231011
Canonical22581
Microsoft16412105
Opensuse22244
Red Hat2222521
Qemu11613
Linux11224
IBM4253211
Packagist5431122
Adobe1145
Sap121431
Cisco2223212

Snapshot v1, computed Jun 11, 2026, 06:04 UTC. MethodologyAll months on record

Nuclei coverage and the detection gap are held back while the template mirror is repaired.

We use analytics cookies to see which pages and articles actually help people. Decline and none of them run — the site works the same. What we store