November 2020
1,485 CVEs published, −8% on October 2020 and −18% on November 2019. CISA added 0 to KEV.
2020 month by month
| Year | Jan | Feb | Mar | Apr | May | Jun | Jul | Aug | Sep | Oct | Nov | Dec | Year total |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 2020 | January 2020: 1,984 CVEs | February 2020: 1,491 CVEs | March 2020: 1,810 CVEs | April 2020: no snapshot | May 2020: no snapshot | June 2020: 1,894 CVEs | July 2020: no snapshot | August 2020: 1,297 CVEs | September 2020: 2,258 CVEs | October 2020: 1,621 CVEs | November 2020: 1,485 CVEs | December 2020: 1,618 CVEs | 15,4589 of 12 months9/12 |
- Critical
- 16713% of the 1,256 with a CVSS score
- Added to CISA KEV
- 010 of this month's CVEs are in KEV, listed a median 365 days after publication
- Vendors
- 4892,638 products
- Top weakness
- XSSCWE-79 · 120 CVEs
Who drove it
Vendors by distinct CVEs this month, with how many of those CVEs are now in CISA KEV and how far each moved in the ranking.
- 1MicrosoftWindows 10, Windows 10 1909, Windows 10 190311412new
- 2Сообщество Свободного Программного ОбеспеченияDebian Gnu/linux, Linux, Drupal101115new
- 3Intel2nd Generation Intel Xeon Scalable Processor, Active Management Technology Firmware, Active Management Technology964nonenew
- 4DebianDebian Linux95104new
- 5FedoraprojectFedora8245new
- 6GoogleChrome, Google Chrome, Android7293new
- 7Ао "нппкт"Осон Основа Оnyx6754new
- 8Ао «концерн Вниинс»Ос Он «стрелец»6243new
- 9Ооо «русбитех-астра»Astra Linux Special Edition, Astra Linux Common Edition, Astra Linux Special Edition Для «эльбрус»5923new
- 10CiscoCisco SD-WAN, Cisco IoT Field Network Director (Iot-fnd), IoT Field Network Director505nonenew
- 11Red HatRed Hat Enterprise Linux, Enterprise Linux, Openshift Container Platform5041new
- 12QualcommSDX55 Firmware, SM8150 Firmware, SM8250 Firmware4814nonenew
- 13Qualcomm, Inc.Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer Iot, Snapdragon Industrial Iot, Snapdragon Mobile, Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer Iot, Snapdragon Industrial Iot, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wired Infrastructure and Networking, Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer Iot, Snapdragon Industrial Iot, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables4814nonenew
- 14MavenOrg.jenkins-ci.plugins:active-directory, Org.craftercms:crafter-studio, Org.csanchez.jenkins.plugins:kubernetes476nonenew
- 15IBMSterling B2B Integrator, Cloud Pak For Security, Sterling File Gateway422nonenew
- 16OpensuseBackports Sle, Leap4233new
- 17Fedora ProjectFedora4142new
- 18PackagistMagento/community-edition, Moodle/moodle, Magento/project-community-edition3512new
- 19Novell Inc.Opensuse Leap, Suse Openstack Cloud Crowbar, Suse Enterprise Storage3443new
- 20npmSysteminformation, Axios, Browserless-chrome324nonenew
- 21NetappCloud Backup, Hci Compute Node Bios, Solidfire Bios3131new
- 22Schneider-electricInteractive Graphical Scada System, Ecostruxure Control Expert, Webreports302nonenew
- 23AdobeAcrobat Reader, Adobe Acrobat Reader 2017, Adobe Acrobat Reader 2020251nonenew
- 24Ао «ивк»Альт 8 Сп, Альт Сп 102442new
- 25Schneider ElectricWebreports, Ecostruxure Control Expert, Modicon M100232nonenew
Severity
How this month's CVEs score on CVSS; 229 have no score yet. Severity is not exploitation.
- Critical167
- High548
- Medium503
- Low38
New in the top 100
Not in the top 100 in any of the 24 months before.
What kind of weakness
Weakness classes (CWE) by distinct CVEs, with how far each moved in the ranking.
- CWE-79XSS120
- CWE-787Out-of-bounds Write74
- CWE-20Improper Input Validation59
- CWE-416Use After Free38
- CWE-125Out-of-bounds Read32
- CWE-22Path Traversal30
- CWE-287Improper Authentication28
- CWE-120Buffer Overflow27
- CWE-89SQL Injection27
- CWE-78OS Command Injection25
- CWE-434Unrestricted File Upload22
- CWE-269Improper Privilege Mgmt20
- CWE-190Integer Overflow18
- CWE-200Information Exposure18
- CWE-352CSRF18
- CWE-522Insufficiently Protected Credentials18
- CWE-798Hard-coded Credentials18
- CWE-918SSRF18
- CWE-276Incorrect Default Permissions17
- CWE-862Missing Authorization17
Where it landed
The month's CVEs by the sector of the software they affect. A CVE that touches several sectors counts in each.
- Operating Systems33420% of sector-tagged CVEs
- OSS Libraries22413% of sector-tagged CVEs
- Hardware Firmware21112% of sector-tagged CVEs
- Enterprise Software17811% of sector-tagged CVEs
- Web & CMS Plugins1137% of sector-tagged CVEs
- Networking Infrastructure1076% of sector-tagged CVEs
- ICS / OT / IoT915% of sector-tagged CVEs
- Security Products845% of sector-tagged CVEs
- Mobile Apps835% of sector-tagged CVEs
- DevTools & CI694% of sector-tagged CVEs
- Not yet classified42
Which weakness, where
The top weakness classes against the vendors and the sectors that carried them.
The lighter the cell, the more CVEs. Point at one to read it.
| By vendor | 79XSS | 787Out-of-bounds Write | 20Improper Input Validation | 416Use After Free | 125Out-of-bounds Read | 22Path Traversal | 287Improper Authentication | 120Buffer Overflow | 89SQL Injection | 78OS Command Injection |
|---|---|---|---|---|---|---|---|---|---|---|
| Microsoft | 5 | 6 | 1 | 1 | 1 | |||||
| Microsoft Corp | 5 | 6 | 1 | 1 | 1 | |||||
| Сообщество Свободного Программного Обеспечения | 1 | 19 | 4 | 17 | 6 | 2 | 5 | 3 | 1 | 2 |
| Intel | 4 | 9 | 2 | 7 | 1 | 1 | ||||
| Debian | 1 | 24 | 3 | 16 | 6 | 1 | 4 | 3 | 1 | 2 |
| Intel Corp. | 3 | 9 | 2 | 7 | 1 | 1 | ||||
| Fedoraproject | 1 | 20 | 4 | 16 | 4 | 1 | 1 | 1 | ||
| 26 | 4 | 21 | 3 | 2 | ||||||
| Ао «нппкт» | 18 | 4 | 15 | 2 | 3 | 1 | 1 | 2 | ||
| Ао «концерн Вниинс» | 21 | 3 | 15 | 2 | 2 | 1 | 1 | 1 | ||
| Ооо «русбитех-астра» | 17 | 1 | 10 | 3 | 1 | 2 | 1 | 1 | ||
| Cisco | 7 | 2 | 7 | 3 | 1 | 3 |