December 2020
1,618 CVEs published, +9% on November 2020 and −14% on December 2019. CISA added 0 to KEV.
2020 month by month
| Year | Jan | Feb | Mar | Apr | May | Jun | Jul | Aug | Sep | Oct | Nov | Dec | Year total |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 2020 | January 2020: 1,984 CVEs | February 2020: 1,491 CVEs | March 2020: 1,810 CVEs | April 2020: no snapshot | May 2020: no snapshot | June 2020: 1,894 CVEs | July 2020: no snapshot | August 2020: 1,297 CVEs | September 2020: 2,258 CVEs | October 2020: 1,621 CVEs | November 2020: 1,485 CVEs | December 2020: 1,618 CVEs | 15,4589 of 12 months9/12 |
- Critical
- 29219% of the 1,576 with a CVSS score
- Added to CISA KEV
- 09 of this month's CVEs are in KEV, listed a median 330 days after publication
- Vendors
- 6752,498 products
- Top weakness
- XSSCWE-79 · 198 CVEs
Who drove it
Vendors by distinct CVEs this month, with how many of those CVEs are now in CISA KEV and how far each moved in the ranking.
- 1Сообщество Свободного Программного ОбеспеченияDebian Gnu/linux, Linux, Mediawiki13041new
- 2GoogleAndroid, Asylo, Tensorflow1177nonenew
- 3DebianDebian Linux, Advanced Package Tool9631new
- 4Crates.ioRusqlite, Lock_api, Arr8531nonenew
- 5Ооо «русбитех-астра»Astra Linux Special Edition, Astra Linux Special Edition Для «эльбрус», Astra Linux Common Edition800nonenew
- 6ApplemacOS, iPhone OS, iPadOS6803new
- 7NetgearR7800 Firmware, R9000 Firmware, R8900 Firmware664nonenew
- 8Ао "нппкт"Осон Основа Оnyx660nonenew
- 9Ао «концерн Вниинс»Ос Он «стрелец»620nonenew
- 10MicrosoftWindows Server 2016, Windows 10, Windows Server 2004 (Server Core Installation)6121new
- 11FedoraprojectFedora, Extra Packages For Enterprise Linux5821new
- 12Red HatEnterprise Linux, Red Hat Enterprise Linux, Openshift Container Platform541nonenew
- 13MavenCom.fasterxml.jackson.core:jackson-databind, Com.thoughtworks.xstream:xstream, Io.jenkins.plugins:chaos-monkey3571new
- 14ImagemagickImagemagick340nonenew
- 15NetappCloud Backup, Ontap Select Deploy Administration Utility, Solidfire Baseboard Management Controller Firmware344nonenew
- 16npmMulti-ini, Corenlp-js-interface, Corenlp-js-prefab3314nonenew
- 17Imagemagick Studio LlcImagemagick310nonenew
- 18PyPITensorflow-cpu, Tensorflow, Tensorflow-gpu301nonenew
- 19OracleCommunications Cloud Native Core Policy, Peoplesoft Enterprise Peopletools, Zfs Storage Appliance Kit2911new
- 20SiemensLogo\! 8 Bm Firmware, Logo! 8 Bm (Incl. Siplus Variants), Xhq281nonenew
- 21Fedora ProjectFedora2701new
- 22PackagistMoodle/moodle, Opencart/opencart, Shopware/core272nonenew
- 23IBMFinancial Transaction Manager, Financial Transaction Manager For Multiplatform, Security Secret Server252nonenew
- 24GoGithub.com/dhowden/tag, Github.com/kubernetes/kubernetes, K8s.io/kubernetes244nonenew
- 25Novell Inc.Opensuse Leap, Suse Linux Enterprise Server, Suse Linux Enterprise Server For Sap Applications241nonenew
Severity
How this month's CVEs score on CVSS; 42 have no score yet. Severity is not exploitation.
- Critical292
- High573
- Medium653
- Low58
New in the top 100
Not in the top 100 in any of the 24 months before.
What kind of weakness
Weakness classes (CWE) by distinct CVEs, with how far each moved in the ranking.
- CWE-79XSS198
- CWE-787Out-of-bounds Write99
- CWE-125Out-of-bounds Read78
- CWE-89SQL Injection61
- CWE-416Use After Free54
- CWE-20Improper Input Validation51
- CWE-78OS Command Injection44
- CWE-862Missing Authorization44
- CWE-190Integer Overflow36
- CWE-306Missing Auth for Critical Function36
- CWE-352CSRF32
- CWE-22Path Traversal31
- CWE-120Buffer Overflow27
- CWE-269Improper Privilege Mgmt27
- CWE-287Improper Authentication27
- CWE-400Resource Consumption21
- CWE-200Information Exposure19
- CWE-434Unrestricted File Upload19
- CWE-40117
- CWE-362Race Condition16
Where it landed
The month's CVEs by the sector of the software they affect. A CVE that touches several sectors counts in each.
- OSS Libraries44121% of sector-tagged CVEs
- Enterprise Software28013% of sector-tagged CVEs
- Operating Systems27013% of sector-tagged CVEs
- Mobile Apps2029% of sector-tagged CVEs
- Web & CMS Plugins1597% of sector-tagged CVEs
- Networking Infrastructure1316% of sector-tagged CVEs
- Cloud & SaaS1035% of sector-tagged CVEs
- Security Products1015% of sector-tagged CVEs
- ICS / OT / IoT944% of sector-tagged CVEs
- 6 smaller sectors229
- Not yet classified117
Which weakness, where
The top weakness classes against the vendors and the sectors that carried them.
The lighter the cell, the more CVEs. Point at one to read it.
| By vendor | 79XSS | 787Out-of-bounds Write | 125Out-of-bounds Read | 89SQL Injection | 416Use After Free | 20Improper Input Validation | 78OS Command Injection | 862Missing Authorization | 190Integer Overflow | 306Missing Auth for Critical Function |
|---|---|---|---|---|---|---|---|---|---|---|
| Сообщество Свободного Программного Обеспечения | 6 | 12 | 8 | 1 | 16 | 3 | 3 | 24 | ||
| 22 | 31 | 9 | 4 | 14 | 3 | |||||
| Debian | 4 | 6 | 4 | 1 | 8 | 1 | 2 | 22 | ||
| Crates.io | 6 | 4 | 14 | 1 | ||||||
| Ооо «русбитех-астра» | 1 | 7 | 7 | 1 | 4 | 1 | 24 | |||
| Apple | 1 | 12 | 8 | 8 | 1 | 2 | 1 | |||
| Netgear | 38 | 1 | 1 | 1 | ||||||
| Ао «нппкт» | 5 | 8 | 4 | 1 | 9 | 1 | 2 | 4 | ||
| Ао «концерн Вниинс» | 3 | 5 | 3 | 1 | 2 | 1 | 21 | |||
| Microsoft | 2 | 1 | ||||||||
| Fedoraproject | 8 | 4 | 3 | 6 | 1 | 1 | 2 | 2 | ||
| Microsoft Corp | 1 | 1 |