August 2020
1,297 CVEs published, −37% on August 2019. CISA added 0 to KEV.
2020 month by month
| Year | Jan | Feb | Mar | Apr | May | Jun | Jul | Aug | Sep | Oct | Nov | Dec | Year total |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 2020 | January 2020: 1,984 CVEs | February 2020: 1,491 CVEs | March 2020: 1,810 CVEs | April 2020: no snapshot | May 2020: no snapshot | June 2020: 1,894 CVEs | July 2020: no snapshot | August 2020: 1,297 CVEs | September 2020: 2,258 CVEs | October 2020: 1,621 CVEs | November 2020: 1,485 CVEs | December 2020: 1,618 CVEs | 15,4589 of 12 months9/12 |
- Critical
- 12911% of the 1,185 with a CVSS score
- Added to CISA KEV
- 010 of this month's CVEs are in KEV, listed a median 447 days after publication
- Vendors
- 4851,932 products
- Top weakness
- XSSCWE-79 · 153 CVEs
Who drove it
Vendors by distinct CVEs this month, with how many of those CVEs are now in CISA KEV and how far each moved in the ranking.
- 1MicrosoftWindows 10 Version 2004, Windows 10 1909, Windows 1012113new
- 2IBMSecurity Guardium Data Encryption, Guardium Data Encryption, Guardium For Cloud Key Management744nonenew
- 3Сообщество Свободного Программного ОбеспеченияDebian Gnu/linux, Linux, Net-snmp7451new
- 4Ооо «русбитех-астра»Astra Linux Special Edition, Astra Linux Special Edition Для «эльбрус», Astra Linux Common Edition7231new
- 5CanonicalUbuntu Linux, Ubuntu, Apport6611new
- 6DebianDebian Linux5951new
- 7Ао «концерн Вниинс»Ос Он «стрелец»5521new
- 8CiscoNX-OS, Cisco Webex Meetings, Data Center Network Manager5322new
- 9IntelIntel Server Board S2600ST, Intel Server Board S2600BP, Intel Server Board S2600WF520nonenew
- 10npmKeystone, Highcharts, Tinymce4811nonenew
- 11GoogleAndroid, Asylo, Go-tpm4311nonenew
- 12FedoraprojectFedora, Selinux-policy4231new
- 13OpensuseLeap, Backports Sle, Opensuse Leap 15.13431new
- 14Red HatRed Hat Enterprise Linux, Cloudforms Management Engine, Cloudforms303nonenew
- 15Novell Inc.Opensuse Leap, Suse Linux Enterprise Server, Suse Linux Enterprise Desktop2931new
- 16AdobeAcrobat Dc, Acrobat Reader Dc, Adobe Acrobat and Reader2801new
- 17ArtifexGhostscript, Mujs260nonenew
- 18Artifex Software Inc.Ghostscript250nonenew
- 19Ао «ивк»Альт 8 Сп243nonenew
- 20F5BIG-IP Application Security Manager, BIG-IP Access Policy Manager, BIG-IP Advanced Firewall Manager210nonenew
- 21MavenOrg.jenkins-ci.main:jenkins-core, Org.jenkins-ci.plugins:pipeline-maven, Net.sf.mpxj:mpxj212nonenew
- 22Fedora ProjectFedora1631new
- 23GoGo.etcd.io/etcd, Github.com/aws/aws-sdk-go, Github.com/hashicorp/vault161nonenew
- 24HuaweiFusioncompute, P30 Pro Firmware, P30 Firmware161nonenew
- 25JetbrainsYoutrack, Teamcity, Toolbox160nonenew
Severity
How this month's CVEs score on CVSS; 112 have no score yet. Severity is not exploitation.
- Critical129
- High512
- Medium510
- Low34
New in the top 100
Not in the top 100 in any of the 24 months before.
What kind of weakness
Weakness classes (CWE) by distinct CVEs, with how far each moved in the ranking.
- CWE-79XSS153
- CWE-787Out-of-bounds Write74
- CWE-20Improper Input Validation50
- CWE-125Out-of-bounds Read37
- CWE-287Improper Authentication33
- CWE-120Buffer Overflow32
- CWE-22Path Traversal32
- CWE-78OS Command Injection31
- CWE-89SQL Injection28
- CWE-269Improper Privilege Mgmt26
- CWE-352CSRF25
- CWE-200Information Exposure20
- CWE-306Missing Auth for Critical Function17
- CWE-119Memory Buffer Bounds16
- CWE-522Insufficiently Protected Credentials16
- CWE-862Missing Authorization16
- CWE-276Incorrect Default Permissions15
- CWE-400Resource Consumption15
- CWE-863Incorrect Authorization15
- CWE-918SSRF15
Where it landed
The month's CVEs by the sector of the software they affect. A CVE that touches several sectors counts in each.
- Operating Systems27819% of sector-tagged CVEs
- OSS Libraries18913% of sector-tagged CVEs
- Enterprise Software16911% of sector-tagged CVEs
- Networking Infrastructure1168% of sector-tagged CVEs
- Web & CMS Plugins1017% of sector-tagged CVEs
- Consumer Software876% of sector-tagged CVEs
- Hardware Firmware866% of sector-tagged CVEs
- Cloud & SaaS775% of sector-tagged CVEs
- Security Products705% of sector-tagged CVEs
- ICS / OT / IoT624% of sector-tagged CVEs
- Mobile Apps614% of sector-tagged CVEs
- Not yet classified65
Which weakness, where
The top weakness classes against the vendors and the sectors that carried them.
The lighter the cell, the more CVEs. Point at one to read it.
| By vendor | 79XSS | 787Out-of-bounds Write | 20Improper Input Validation | 125Out-of-bounds Read | 287Improper Authentication | 120Buffer Overflow | 22Path Traversal | 78OS Command Injection | 89SQL Injection | 269Improper Privilege Mgmt |
|---|---|---|---|---|---|---|---|---|---|---|
| Microsoft | 3 | 12 | 1 | |||||||
| Microsoft Corp | 3 | 12 | 1 | |||||||
| IBM | 10 | 7 | 3 | 2 | 1 | 1 | 1 | 2 | ||
| Сообщество Свободного Программного Обеспечения | 1 | 16 | 2 | 4 | 6 | 3 | 2 | 2 | ||
| Ооо «русбитех-астра» | 1 | 16 | 2 | 4 | 6 | 2 | 2 | 2 | ||
| Canonical | 15 | 1 | 3 | 6 | 1 | 2 | ||||
| Debian | 15 | 1 | 5 | 6 | 3 | 2 | 1 | |||
| Canonical Ltd. | 15 | 1 | 3 | 6 | 1 | 2 | ||||
| Ао «концерн Вниинс» | 16 | 1 | 4 | 6 | 2 | 1 | ||||
| Intel | 1 | 5 | 6 | 3 | 5 | 9 | ||||
| Cisco | 8 | 1 | 13 | 2 | 2 | 1 | ||||
| Cisco Systems Inc. | 8 | 1 | 13 | 2 | 2 | 1 |