January 2021
1,970 CVEs published, +22% on December 2020 and −1% on January 2020. CISA added 0 to KEV.
2021 month by month
| Year | Jan | Feb | Mar | Apr | May | Jun | Jul | Aug | Sep | Oct | Nov | Dec | Year total |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 2021 | January 2021: 1,970 CVEs | February 2021: 1,557 CVEs | March 2021: no snapshot | April 2021: 1,970 CVEs | May 2021: 1,580 CVEs | June 2021: 1,985 CVEs | July 2021: 1,650 CVEs | August 2021: 2,317 CVEs | September 2021: 1,933 CVEs | October 2021: 1,759 CVEs | November 2021: 1,694 CVEs291 added to CISA KEV | December 2021: 2,520 CVEs20 added to CISA KEV | 20,93511 of 12 months11/12 |
- Critical
- 20213% of the 1,537 with a CVSS score
- Added to CISA KEV
- 09 of this month's CVEs are in KEV, listed a median 361 days after publication
- Vendors
- 5663,119 products
- Top weakness
- XSSCWE-79 · 190 CVEs
Who drove it
Vendors by distinct CVEs this month, with how many of those CVEs are now in CISA KEV and how far each moved in the ranking.
- 1OracleMySQL, MySQL Server, Vm VirtualBox169111new
- 2CiscoCisco RV130, Cisco Small Business RV Series Router Firmware, RV110W Firmware15610nonenew
- 3Сообщество Свободного Программного ОбеспеченияDebian Gnu/linux, Linux, Openjpeg120154new
- 4Ао "нппкт"Осон Основа Оnyx112144new
- 5Ао «концерн Вниинс»Ос Он «стрелец»99144new
- 6Ооо «русбитех-астра»Astra Linux Special Edition, Astra Linux Special Edition Для «эльбрус», Astra Linux Common Edition96144new
- 7MicrosoftWindows 10 Version 2004, Windows 10, Windows 10 20048601new
- 8IBMRhapsody Model Manager, Engineering Lifecycle Optimization, Engineering Lifecycle Management844nonenew
- 9DebianDebian Linux8292new
- 10GoogleChrome, Google Chrome, Android78163new
- 11Ао «ивк»Альт 8 Сп, Альт 8 Сп Сервер, Альт Сп 1076111new
- 12FedoraprojectFedora, Extra Packages For Enterprise Linux7292new
- 13NetappOncommand Workflow Automation, Oncommand Insight, Snapcenter7241new
- 14Red HatRed Hat Enterprise Linux, Red Hat Software Collections, Enterprise Linux5783new
- 15MavenCom.fasterxml.jackson.core:jackson-databind, Org.jenkins-ci.main:jenkins-core, Com.mikesamuel:json-sanitizer5261new
- 16Novell Inc.Opensuse Leap, Suse Linux Enterprise Server, Suse Linux Enterprise Server For Sap Applications4382new
- 17npmJointjs, Asciitable.js, Async-git364nonenew
- 18SiemensJT2GO, Teamcenter Visualization, Solid Edge SE2021362nonenew
- 19CanonicalUbuntu, Linux Kernel, Remote-login-service3473new
- 20Crates.ioRaw-cpuid, Abi_stable, Late-static344nonenew
- 21QualcommQET5100, WCD9341, QCA6574A3415nonenew
- 22Qualcomm, Inc.Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Iot, Snapdragon Industrial Iot, Snapdragon Iot, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables, Snapdragon Wired Infrastructure and Networking, Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Iot, Snapdragon Industrial Iot, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables, Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer Iot, Snapdragon Industrial Iot, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wired Infrastructure and Networking3415nonenew
- 23Ао «нтц Ит Роса»Rosa Virtualization, Роса Хром, Роса Кобальт3211new
- 24PackagistMoodle/moodle, Mautic/core, Wp-premium/gravityforms3062new
- 25Sap3d Visual Enterprise Viewer, Business Warehouse, Commerce Cloud271nonenew
Severity
How this month's CVEs score on CVSS; 433 have no score yet. Severity is not exploitation.
- Critical202
- High695
- Medium616
- Low24
New in the top 100
Not in the top 100 in any of the 24 months before.
What kind of weakness
Weakness classes (CWE) by distinct CVEs, with how far each moved in the ranking.
- CWE-79XSS190
- CWE-787Out-of-bounds Write186
- CWE-12171
- CWE-20Improper Input Validation59
- CWE-269Improper Privilege Mgmt53
- CWE-22Path Traversal45
- CWE-125Out-of-bounds Read42
- CWE-502Deserialization39
- CWE-78OS Command Injection39
- CWE-89SQL Injection37
- CWE-416Use After Free33
- CWE-120Buffer Overflow28
- CWE-352CSRF28
- CWE-119Memory Buffer Bounds26
- CWE-400Resource Consumption24
- CWE-863Incorrect Authorization20
- CWE-362Race Condition18
- CWE-476NULL Pointer Dereference18
- CWE-122Heap Buffer Overflow17
- CWE-434Unrestricted File Upload17
Where it landed
The month's CVEs by the sector of the software they affect. A CVE that touches several sectors counts in each.
- Operating Systems34416% of sector-tagged CVEs
- Enterprise Software33716% of sector-tagged CVEs
- OSS Libraries28814% of sector-tagged CVEs
- Networking Infrastructure23011% of sector-tagged CVEs
- Databases1758% of sector-tagged CVEs
- Web & CMS Plugins1356% of sector-tagged CVEs
- Mobile Apps1005% of sector-tagged CVEs
- Hardware Firmware944% of sector-tagged CVEs
- Security Products824% of sector-tagged CVEs
- 6 smaller sectors255
- Not yet classified90
Which weakness, where
The top weakness classes against the vendors and the sectors that carried them.
The lighter the cell, the more CVEs. Point at one to read it.
| By vendor | 79XSS | 787Out-of-bounds Write | 121 | 20Improper Input Validation | 269Improper Privilege Mgmt | 22Path Traversal | 125Out-of-bounds Read | 502Deserialization | 78OS Command Injection | 89SQL Injection |
|---|---|---|---|---|---|---|---|---|---|---|
| Oracle | 2 | 1 | 3 | 12 | ||||||
| Cisco | 18 | 61 | 61 | 26 | 1 | 2 | 12 | 7 | ||
| Cisco Systems Inc. | 18 | 61 | 61 | 26 | 1 | 2 | 12 | 7 | ||
| Oracle Corp. | 1 | |||||||||
| Oracle Corporation | ||||||||||
| Сообщество Свободного Программного Обеспечения | 3 | 18 | 1 | 5 | 1 | 3 | 8 | 12 | 1 | |
| Ао «нппкт» | 2 | 21 | 4 | 1 | 3 | 8 | 12 | |||
| Ао «концерн Вниинс» | 2 | 22 | 4 | 1 | 8 | 11 | ||||
| Ооо «русбитех-астра» | 2 | 16 | 4 | 1 | 3 | 8 | 1 | |||
| IBM | 17 | 2 | 1 | 4 | 1 | |||||
| Microsoft | 1 | 33 | 1 | 1 | ||||||
| Microsoft Corp | 1 | 33 | 1 |