November 2019
1,802 CVEs published, level with October 2019. CISA added 0 to KEV.
2019 month by month
| Year | Jan | Feb | Mar | Apr | May | Jun | Jul | Aug | Sep | Oct | Nov | Dec | Year total |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 2019 | January 2019: no snapshot | February 2019: 908 CVEs | March 2019: no snapshot | April 2019: no snapshot | May 2019: 1,366 CVEs | June 2019: no snapshot | July 2019: 1,752 CVEs | August 2019: 2,064 CVEs | September 2019: 1,568 CVEs | October 2019: 1,799 CVEs | November 2019: 1,802 CVEs | December 2019: 1,881 CVEs | 13,1408 of 12 months8/12 |
- Critical
- 21012% of the 1,697 with a CVSS score
- Added to CISA KEV
- 09 of this month's CVEs are in KEV, listed a median 925 days after publication
- Vendors
- 7594,366 products
- Top weakness
- XSSCWE-79 · 182 CVEs
Who drove it
Vendors by distinct CVEs this month, with how many of those CVEs are now in CISA KEV and how far each moved in the ranking.
- 1Сообщество Свободного Программного ОбеспеченияDebian Gnu/linux, Linux, Portainer239142new
- 2Red HatRed Hat Enterprise Linux, Enterprise Linux, Red Hat Enterprise Mrg21718nonenew
- 3DebianDebian Linux, Icoutils, Advanced Package Tool18827nonenew
- 4Ао «концерн Вниинс»Ос Он «стрелец»15492new
- 5Ооо «русбитех-астра»Astra Linux Special Edition, Astra Linux Special Edition Для «эльбрус», Astra Linux Common Edition152122new
- 6Novell Inc.Opensuse Leap, Suse Package Hub For Suse Linux Enterprise, Suse Linux Enterprise Server14181new
- 7GoogleChrome, Google Chrome, Android138112new
- 8FedoraprojectFedora, 389 Directory Server10915nonenew
- 9PackagistMagento/community-edition, Typo3/cms, Symfony/symfony10715nonenew
- 10Ао «ивк»Альт 8 Сп, Альт 8 Сп Сервер, Альт 8 Сп Рабочая Станция10671new
- 11CanonicalUbuntu Linux, Ubuntu, Cloud-init978nonenew
- 12OpensuseLeap, Backports Sle, Opensuse8861new
- 13LinuxLinux Kernel, Kernel, DHCP6C808nonenew
- 14MicrosoftWindows Server, Windows, Windows 107454new
- 15Adobe Systems IncorporatedMagento 2, Magento 1, Magento 1 & 2646nonenew
- 16MagentoMagento646nonenew
- 17IntelIntel Baseboard Management Controller, Baseboard Management Controller Firmware, Ethernet Controller X710-AT2 Firmware542nonenew
- 18QualcommQCS605 Firmware, MSM8996AU Firmware, SDM660 Firmware5424nonenew
- 19Qualcomm, Inc.Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer Iot, Snapdragon Industrial Iot, Snapdragon Iot, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables, Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer Iot, Snapdragon Industrial Iot, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables, Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Iot, Snapdragon Industrial Iot, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wired Infrastructure and Networking5424nonenew
- 20Fedora ProjectFedora, 389 Directory Server477nonenew
- 21SamsungGalaxy J7 Neo Firmware, Galaxy Xcover4 Firmware, Galaxy S7 Firmware350nonenew
- 22CiscoFirepower Services Software For ASA, Firepower Threat Defense, Secure Firewall Management Center3311new
- 23HuaweiP30 Firmware, P30 Pro Firmware, P20 Firmware320nonenew
- 24MavenOrg.jenkins-ci.plugins:google-compute-engine, Org.jenkins-ci.main:jenkins-core, Org.apache.cxf:cxf324nonenew
- 25TYPO3TYPO3, TYPO3 Core, Wec_discussion293nonenew
Severity
How this month's CVEs score on CVSS; 105 have no score yet. Severity is not exploitation.
- Critical210
- High673
- Medium764
- Low50
New in the top 100
Not in the top 100 in any of the 24 months before.
What kind of weakness
Weakness classes (CWE) by distinct CVEs, with how far each moved in the ranking.
- CWE-79XSS182
- CWE-20Improper Input Validation124
- CWE-787Out-of-bounds Write98
- CWE-200Information Exposure76
- CWE-40153
- CWE-732Incorrect Permissions49
- CWE-125Out-of-bounds Read43
- CWE-416Use After Free43
- CWE-89SQL Injection40
- CWE-400Resource Consumption35
- CWE-22Path Traversal33
- CWE-352CSRF28
- CWE-476NULL Pointer Dereference28
- CWE-78OS Command Injection28
- CWE-269Improper Privilege Mgmt26
- CWE-287Improper Authentication25
- CWE-61025
- CWE-5923
- CWE-120Buffer Overflow22
- CWE-190Integer Overflow22
Where it landed
The month's CVEs by the sector of the software they affect. A CVE that touches several sectors counts in each.
- Operating Systems65326% of sector-tagged CVEs
- OSS Libraries31613% of sector-tagged CVEs
- Hardware Firmware2329% of sector-tagged CVEs
- Web & CMS Plugins2259% of sector-tagged CVEs
- Mobile Apps2108% of sector-tagged CVEs
- Enterprise Software1677% of sector-tagged CVEs
- Security Products1195% of sector-tagged CVEs
- Networking Infrastructure1175% of sector-tagged CVEs
- 7 smaller sectors333
- Not yet classified103
Which weakness, where
The top weakness classes against the vendors and the sectors that carried them.
The lighter the cell, the more CVEs. Point at one to read it.
| By vendor | 79XSS | 20Improper Input Validation | 787Out-of-bounds Write | 200Information Exposure | 401 | 732Incorrect Permissions | 125Out-of-bounds Read | 416Use After Free | 89SQL Injection | 400Resource Consumption |
|---|---|---|---|---|---|---|---|---|---|---|
| Сообщество Свободного Программного Обеспечения | 4 | 12 | 30 | 3 | 50 | 8 | 9 | 27 | 1 | 4 |
| Debian | 9 | 22 | 12 | 15 | 9 | 5 | 5 | 3 | 2 | 5 |
| Ао «концерн Вниинс» | 9 | 29 | 3 | 17 | 7 | 6 | 23 | 1 | 2 | |
| Ооо «русбитех-астра» | 1 | 6 | 29 | 3 | 9 | 7 | 8 | 22 | 1 | 3 |
| Novell Inc. | 8 | 23 | 2 | 20 | 6 | 2 | 23 | 2 | ||
| 12 | 32 | 1 | 5 | 8 | 27 | 4 | 1 | |||
| Red Hat Inc. | 2 | 8 | 18 | 2 | 8 | 8 | 2 | 17 | 2 | |
| Red Hat | 9 | 16 | 5 | 9 | 8 | 6 | 1 | 2 | 2 | |
| Fedoraproject | 3 | 10 | 6 | 13 | 21 | 4 | 6 | 1 | 1 | 5 |
| Packagist | 30 | 5 | 6 | 9 | ||||||
| Ао «ивк» | 1 | 2 | 17 | 3 | 2 | 8 | 4 | 17 | 1 | |
| Google Inc | 8 | 24 | 1 | 5 | 3 | 24 |