September 2020
2,258 CVEs published, +74% on August 2020 and +44% on September 2019. CISA added 0 to KEV.
2020 month by month
| Year | Jan | Feb | Mar | Apr | May | Jun | Jul | Aug | Sep | Oct | Nov | Dec | Year total |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 2020 | January 2020: 1,984 CVEs | February 2020: 1,491 CVEs | March 2020: 1,810 CVEs | April 2020: no snapshot | May 2020: no snapshot | June 2020: 1,894 CVEs | July 2020: no snapshot | August 2020: 1,297 CVEs | September 2020: 2,258 CVEs | October 2020: 1,621 CVEs | November 2020: 1,485 CVEs | December 2020: 1,618 CVEs | 15,4589 of 12 months9/12 |
- Critical
- 19712% of the 1,595 with a CVSS score
- Added to CISA KEV
- 08 of this month's CVEs are in KEV, listed a median 424 days after publication
- Vendors
- 4782,993 products
- Top weakness
- CWE-506322 CVEs
Who drove it
Vendors by distinct CVEs this month, with how many of those CVEs are now in CISA KEV and how far each moved in the ranking.
- 1npmSwagger-ui, Handlebars, Serve64419nonenew
- 2GoogleAndroid, Chrome, Google Chrome23518nonenew
- 3MicrosoftWindows Server 2016, Windows Server 2019, Windows Server 2004 (Server Core Installation)13121new
- 4Сообщество Свободного Программного ОбеспеченияDebian Gnu/linux, Linux, Mediawiki11091new
- 5DebianDebian Linux, Freedombox1047nonenew
- 6CiscoCisco IOS XE, IOS XE, Cisco IOS XE Software10121new
- 7FedoraprojectFedora954nonenew
- 8OpensuseLeap, Backports Sle, Opensuse Leap 15.2887nonenew
- 9MavenOrg.jenkins-ci.plugins:elastest, Org.jenkins-ci.plugins:database, Org.keycloak:keycloak-parent783nonenew
- 10Ооо «русбитех-астра»Astra Linux Special Edition, Astra Linux Common Edition, Astra Linux Special Edition Для «эльбрус»764nonenew
- 11Ао «концерн Вниинс»Ос Он «стрелец»674nonenew
- 12Ао "нппкт"Осон Основа Оnyx674nonenew
- 13QualcommSM7150 Firmware, SM6150 Firmware, SM8150 Firmware598nonenew
- 14Qualcomm, Inc.Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer Iot, Snapdragon Industrial Iot, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables, Snapdragon Wired Infrastructure and Networking, Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer Iot, Snapdragon Industrial Iot, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables, Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer Iot, Snapdragon Industrial Iot, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wired Infrastructure and Networking588nonenew
- 15IBMData Risk Manager, Infosphere Guardium, Maximo Asset Management531nonenew
- 16Red HatRed Hat Enterprise Linux, Enterprise Linux, Jboss Enterprise Application Platform511nonenew
- 17JenkinsElastest, Liquibase Runner, Jenkins Liquibase Runner Plugin481nonenew
- 18Sap3d Visual Enterprise Viewer, Businessobjects Business Intelligence Platform, Bank Analyzer480nonenew
- 19Sap SeSap 3d Visual Enterprise Viewer, S/4hana Fin Prod Subldgr, Sap Business Objects Business Intelligence Platform (Web Intelligence Html Interface)480nonenew
- 20Novell Inc.Opensuse Leap, Suse Linux Enterprise Server, Suse Linux Enterprise Server For Sap Applications453nonenew
- 21Fedora ProjectFedora443nonenew
- 22PyPITensorflow, Tensorflow-gpu, Tensorflow-cpu414nonenew
- 23GitLabGitLab390nonenew
- 24CanonicalUbuntu Linux, Ubuntu, Ubuntu-ui-toolkit382nonenew
- 25OS4EDOpensis288nonenew
Severity
How this month's CVEs score on CVSS; 663 have no score yet. Severity is not exploitation.
- Critical197
- High634
- Medium728
- Low36
New in the top 100
Not in the top 100 in any of the 24 months before.
What kind of weakness
Weakness classes (CWE) by distinct CVEs, with how far each moved in the ranking.
- CWE-506322
- CWE-79XSS269
- CWE-787Out-of-bounds Write144
- CWE-20Improper Input Validation125
- CWE-89SQL Injection76
- CWE-125Out-of-bounds Read63
- CWE-22Path Traversal58
- CWE-416Use After Free46
- CWE-1321Prototype Pollution42
- CWE-862Missing Authorization41
- CWE-352CSRF40
- CWE-400Resource Consumption37
- CWE-434Unrestricted File Upload36
- CWE-77Command Injection32
- CWE-287Improper Authentication29
- CWE-119Memory Buffer Bounds28
- CWE-120Buffer Overflow26
- CWE-190Integer Overflow25
- CWE-78OS Command Injection20
- CWE-863Incorrect Authorization20
Where it landed
The month's CVEs by the sector of the software they affect. A CVE that touches several sectors counts in each.
- OSS Libraries89733% of sector-tagged CVEs
- Operating Systems41115% of sector-tagged CVEs
- Mobile Apps2499% of sector-tagged CVEs
- Enterprise Software2349% of sector-tagged CVEs
- Networking Infrastructure1666% of sector-tagged CVEs
- Web & CMS Plugins1184% of sector-tagged CVEs
- DevTools & CI1134% of sector-tagged CVEs
- 8 smaller sectors462
- Not yet classified78
Which weakness, where
The top weakness classes against the vendors and the sectors that carried them.
The lighter the cell, the more CVEs. Point at one to read it.
| By vendor | 506 | 79XSS | 787Out-of-bounds Write | 20Improper Input Validation | 89SQL Injection | 125Out-of-bounds Read | 22Path Traversal | 416Use After Free | 1321Prototype Pollution | 862Missing Authorization |
|---|---|---|---|---|---|---|---|---|---|---|
| npm | 322 | 70 | 1 | 5 | 6 | 3 | 18 | 41 | ||
| 2 | 62 | 24 | 2 | 28 | 26 | 25 | ||||
| Microsoft | 13 | 6 | 2 | 1 | 1 | |||||
| Microsoft Corp | 13 | 6 | 2 | 1 | 1 | |||||
| Сообщество Свободного Программного Обеспечения | 4 | 27 | 2 | 3 | 1 | 22 | ||||
| Debian | 5 | 27 | 4 | 4 | 1 | 20 | ||||
| Cisco | 3 | 2 | 43 | 1 | 3 | 2 | ||||
| Cisco Systems Inc. | 3 | 2 | 43 | 1 | 3 | 2 | ||||
| Fedoraproject | 8 | 25 | 3 | 2 | 17 | |||||
| Opensuse | 4 | 19 | 10 | 5 | 1 | 4 | ||||
| Maven | 20 | 2 | 4 | 1 | 7 | |||||
| Ооо «русбитех-астра» | 2 | 22 | 2 | 1 | 1 | 15 |