September 2019
1,568 CVEs published, −24% on August 2019 and +30% on September 2018. CISA added 0 to KEV.
2019 month by month
| Year | Jan | Feb | Mar | Apr | May | Jun | Jul | Aug | Sep | Oct | Nov | Dec | Year total |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 2019 | January 2019: no snapshot | February 2019: 908 CVEs | March 2019: no snapshot | April 2019: no snapshot | May 2019: 1,366 CVEs | June 2019: no snapshot | July 2019: 1,752 CVEs | August 2019: 2,064 CVEs | September 2019: 1,568 CVEs | October 2019: 1,799 CVEs | November 2019: 1,802 CVEs | December 2019: 1,881 CVEs | 13,1408 of 12 months8/12 |
- Critical
- 18812% of the 1,552 with a CVSS score
- Added to CISA KEV
- 011 of this month's CVEs are in KEV, listed a median 790 days after publication
- Vendors
- 6402,625 products
- Top weakness
- XSSCWE-79 · 226 CVEs
Who drove it
Vendors by distinct CVEs this month, with how many of those CVEs are now in CISA KEV and how far each moved in the ranking.
- 1GoogleAndroid, Chrome, Google Chrome3093nonenew
- 2Сообщество Свободного Программного ОбеспеченияDebian Gnu/linux, Linux, Phpipam127201new
- 3CanonicalUbuntu Linux, Ubuntu8291new
- 4MicrosoftWindows, Windows 10, Windows 10 18038215new
- 5DebianDebian Linux78121new
- 6Ао «концерн Вниинс»Ос Он «стрелец»7010nonenew
- 7Novell Inc.Opensuse Leap, Suse Linux Enterprise Server For Sap Applications, Suse Linux Enterprise Server685nonenew
- 8Ооо «русбитех-астра»Astra Linux Special Edition, Astra Linux Special Edition Для «эльбрус», Astra Linux Common Edition679nonenew
- 9MavenOrg.jenkins-ci.main:jenkins-core, Org.apache.jspwiki:jspwiki-war, Org.jenkins-ci.plugins:script-security596nonenew
- 10OpensuseLeap, Backports Sle, Backports576nonenew
- 11Red HatRed Hat Enterprise Linux, Enterprise Linux, Openshift Container Platform553nonenew
- 12GitLabGitLab, Omnibus502nonenew
- 13FedoraprojectFedora4591new
- 14CiscoCisco IOS XE, IOS XE, IOS401nonenew
- 15JenkinsJenkins, Script Security, Jenkins Script Security Plugin392nonenew
- 16PackagistSilverstripe/framework, Librenms/librenms, Dolibarr/dolibarr384nonenew
- 17Fedora ProjectFedora3571new
- 18LinuxLinux Kernel, Kernel342nonenew
- 19IBMWebsphere Application Server, Websphere Extreme Scale, Security Key Lifecycle Manager310nonenew
- 20Ао «ивк»Альт 8 Сп, Альт 8 Сп Рабочая Станция, Альт 8 Сп Сервер281nonenew
- 21DellBsafe Micro-edition-suite, Rsa Bsafe Mes, Rsa Via Lifecycle and Governance222nonenew
- 22MozillaFirefox, Firefox Esr, Thunderbird222nonenew
- 23ApacheJspwiki, HTTP Server, Ofbiz207nonenew
- 24NetappSteelstore Cloud Integrated Storage, Solidfire, Hci Management Node206nonenew
- 25OracleEnterprise Manager Ops Center, Retail Xstore Point of Service, Peoplesoft Enterprise Peopletools195nonenew
Severity
How this month's CVEs score on CVSS; 16 have no score yet. Severity is not exploitation.
- Critical188
- High585
- Medium750
- Low29
New in the top 100
Not in the top 100 in any of the 24 months before.
What kind of weakness
Weakness classes (CWE) by distinct CVEs, with how far each moved in the ranking.
- CWE-79XSS226
- CWE-787Out-of-bounds Write143
- CWE-125Out-of-bounds Read139
- CWE-352CSRF71
- CWE-20Improper Input Validation62
- CWE-89SQL Injection52
- CWE-200Information Exposure42
- CWE-22Path Traversal42
- CWE-416Use After Free41
- CWE-476NULL Pointer Dereference35
- CWE-190Integer Overflow30
- CWE-90830
- CWE-269Improper Privilege Mgmt23
- CWE-522Insufficiently Protected Credentials23
- CWE-434Unrestricted File Upload22
- CWE-120Buffer Overflow21
- CWE-78OS Command Injection20
- CWE-862Missing Authorization20
- CWE-863Incorrect Authorization19
- CWE-306Missing Auth for Critical Function16
Where it landed
The month's CVEs by the sector of the software they affect. A CVE that touches several sectors counts in each.
- Mobile Apps31216% of sector-tagged CVEs
- Operating Systems30016% of sector-tagged CVEs
- Web & CMS Plugins25813% of sector-tagged CVEs
- OSS Libraries24713% of sector-tagged CVEs
- Enterprise Software19410% of sector-tagged CVEs
- DevTools & CI1055% of sector-tagged CVEs
- Networking Infrastructure885% of sector-tagged CVEs
- ICS / OT / IoT834% of sector-tagged CVEs
- 7 smaller sectors262
- Not yet classified82
Which weakness, where
The top weakness classes against the vendors and the sectors that carried them.
The lighter the cell, the more CVEs. Point at one to read it.
| By vendor | 79XSS | 787Out-of-bounds Write | 125Out-of-bounds Read | 352CSRF | 20Improper Input Validation | 89SQL Injection | 22Path Traversal | 200Information Exposure | 416Use After Free | 476NULL Pointer Dereference |
|---|---|---|---|---|---|---|---|---|---|---|
| 88 | 109 | 22 | 1 | 4 | 15 | 4 | ||||
| Сообщество Свободного Программного Обеспечения | 11 | 15 | 7 | 3 | 5 | 3 | 1 | 8 | 8 | |
| Microsoft | 4 | 9 | 2 | 7 | 1 | 11 | 1 | |||
| Microsoft Corp | 4 | 9 | 2 | 7 | 1 | 11 | 1 | |||
| Debian | 11 | 10 | 8 | 1 | 2 | 3 | 1 | 1 | 1 | |
| Ао «концерн Вниинс» | 4 | 11 | 3 | 3 | 3 | 4 | 1 | |||
| Novell Inc. | 3 | 8 | 5 | 3 | 1 | 1 | 8 | 3 | ||
| Ооо «русбитех-астра» | 4 | 9 | 3 | 1 | 2 | 1 | 5 | 3 | ||
| Canonical | 4 | 9 | 10 | 3 | 3 | 6 | ||||
| Maven | 16 | 1 | 1 | 1 | ||||||
| Opensuse | 1 | 10 | 2 | 2 | 1 | 1 | 4 | 4 | ||
| GitLab | 7 | 1 | 1 | 8 |