June 2020
1,894 CVEs published. CISA added 0 to KEV.
2020 month by month
| Year | Jan | Feb | Mar | Apr | May | Jun | Jul | Aug | Sep | Oct | Nov | Dec | Year total |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 2020 | January 2020: 1,984 CVEs | February 2020: 1,491 CVEs | March 2020: 1,810 CVEs | April 2020: no snapshot | May 2020: no snapshot | June 2020: 1,894 CVEs | July 2020: no snapshot | August 2020: 1,297 CVEs | September 2020: 2,258 CVEs | October 2020: 1,621 CVEs | November 2020: 1,485 CVEs | December 2020: 1,618 CVEs | 15,4589 of 12 months9/12 |
- Critical
- 21312% of the 1,820 with a CVSS score
- Added to CISA KEV
- 010 of this month's CVEs are in KEV, listed a median 629 days after publication
- Vendors
- 5554,105 products
- Top weakness
- XSSCWE-79 · 175 CVEs
Who drove it
Vendors by distinct CVEs this month, with how many of those CVEs are now in CISA KEV and how far each moved in the ranking.
- 1MattermostMattermost Server, Mattermost Desktop, Mattermost Mobile15915nonenew
- 2GoogleAndroid, Chrome, Google Chrome14115nonenew
- 3Сообщество Свободного Программного ОбеспеченияDebian Gnu/linux, Libvncserver, Linux13371new
- 4MicrosoftWindows 10, Windows 10 Version 1903 For X64-BASED Systems, Windows Server 201613001new
- 5AdobeAdobe Acrobat Document Cloud, Adobe Acrobat Reader 2015, Adobe Acrobat Reader 201711211nonenew
- 6CiscoIOS XE, Cisco IOS XE, IOS10871new
- 7DebianDebian Linux9021new
- 8GoGithub.com/mattermost/mattermost-server, Github.com/grafana/grafana, Github.com/hashicorp/consul9011nonenew
- 9CanonicalUbuntu Linux, Ubuntu872nonenew
- 10Ооо «русбитех-астра»Astra Linux Special Edition, Astra Linux Special Edition Для «эльбрус», Astra Linux Common Edition874nonenew
- 11FedoraprojectFedora8251new
- 12OpensuseLeap, Backports Sle, Opensuse Leap 15.1807nonenew
- 13Ао «концерн Вниинс»Ос Он «стрелец»663nonenew
- 14ApplemacOS, iPadOS, IOS6323new
- 15Novell Inc.Opensuse Leap, Suse Linux Enterprise Server, Suse Linux Enterprise Server For Sap Applications563nonenew
- 16IBMSecurity Guardium, Spectrum Protect Plus, Security Secret Server537nonenew
- 17Red HatRed Hat Enterprise Linux, Red Hat Satellite, Red Hat Process Automation493nonenew
- 18FoxitsoftwarePhantompdf, Reader, Foxit Studio Photo489nonenew
- 19PackagistMagento/community-edition, Magento/core, Magento/project-community-edition4712nonenew
- 20QualcommQCS605 Firmware, SM8150 Firmware, SDM845 Firmware4513nonenew
- 21Qualcomm, Inc.Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Iot, Snapdragon Industrial Iot, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables, Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Iot, Snapdragon Industrial Iot, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wired Infrastructure and Networking, Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer Iot, Snapdragon Industrial Iot, Snapdragon Iot, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables4513nonenew
- 22Ао "нппкт"Осон Основа Оnyx431nonenew
- 23Fedora ProjectFedora4121new
- 24ZyxelCloudcnm Secumanager, Cloud Cnm Secumanager, WAP6806 Firmware399nonenew
- 25Ао «ивк»Альт 8 Сп, Альт Сп 10390nonenew
Severity
How this month's CVEs score on CVSS; 74 have no score yet. Severity is not exploitation.
- Critical213
- High829
- Medium735
- Low43
New in the top 100
Not in the top 100 in any of the 24 months before.
What kind of weakness
Weakness classes (CWE) by distinct CVEs, with how far each moved in the ranking.
- CWE-79XSS175
- CWE-787Out-of-bounds Write164
- CWE-125Out-of-bounds Read125
- CWE-20Improper Input Validation107
- CWE-119Memory Buffer Bounds40
- CWE-78OS Command Injection39
- CWE-22Path Traversal38
- CWE-798Hard-coded Credentials38
- CWE-200Information Exposure36
- CWE-732Incorrect Permissions35
- CWE-276Incorrect Default Permissions34
- CWE-77Command Injection33
- CWE-416Use After Free32
- CWE-190Integer Overflow30
- CWE-352CSRF30
- CWE-862Missing Authorization30
- CWE-120Buffer Overflow28
- CWE-476NULL Pointer Dereference28
- CWE-287Improper Authentication27
- CWE-89SQL Injection27
Where it landed
The month's CVEs by the sector of the software they affect. A CVE that touches several sectors counts in each.
- Operating Systems40216% of sector-tagged CVEs
- OSS Libraries34814% of sector-tagged CVEs
- Networking Infrastructure24910% of sector-tagged CVEs
- Enterprise Software2329% of sector-tagged CVEs
- Mobile Apps2179% of sector-tagged CVEs
- Communications2149% of sector-tagged CVEs
- Consumer Software1858% of sector-tagged CVEs
- Web & CMS Plugins1255% of sector-tagged CVEs
- Hardware Firmware1215% of sector-tagged CVEs
- ICS / OT / IoT1054% of sector-tagged CVEs
- Not yet classified60
Which weakness, where
The top weakness classes against the vendors and the sectors that carried them.
The lighter the cell, the more CVEs. Point at one to read it.
| By vendor | 79XSS | 787Out-of-bounds Write | 125Out-of-bounds Read | 20Improper Input Validation | 119Memory Buffer Bounds | 78OS Command Injection | 22Path Traversal | 798Hard-coded Credentials | 200Information Exposure | 732Incorrect Permissions |
|---|---|---|---|---|---|---|---|---|---|---|
| Mattermost | 17 | 11 | 4 | 9 | 21 | |||||
| 25 | 37 | 21 | 2 | 2 | 1 | |||||
| Сообщество Свободного Программного Обеспечения | 9 | 15 | 15 | 4 | 2 | 1 | ||||
| Microsoft | 10 | 7 | 2 | 2 | 1 | |||||
| Microsoft Corp | 10 | 7 | 2 | 2 | 1 | |||||
| Adobe | 7 | 41 | 26 | 1 | 6 | |||||
| Adobe Systems Inc. | 7 | 41 | 26 | 1 | 6 | |||||
| Cisco Systems Inc. | 4 | 16 | 8 | 24 | 18 | 13 | 2 | 1 | 4 | |
| Cisco | 4 | 13 | 24 | 16 | 13 | 2 | 1 | 4 | ||
| Debian | 6 | 9 | 12 | 2 | 2 | 1 | ||||
| Go | 15 | 6 | 6 | 10 | 10 | |||||
| Ооо «русбитех-астра» | 3 | 9 | 14 | 3 | 1 | 1 |