May 2021
1,580 CVEs published, −20% on April 2021. CISA added 0 to KEV.
2021 month by month
| Year | Jan | Feb | Mar | Apr | May | Jun | Jul | Aug | Sep | Oct | Nov | Dec | Year total |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 2021 | January 2021: 1,970 CVEs | February 2021: 1,557 CVEs | March 2021: no snapshot | April 2021: 1,970 CVEs | May 2021: 1,580 CVEs | June 2021: 1,985 CVEs | July 2021: 1,650 CVEs | August 2021: 2,317 CVEs | September 2021: 1,933 CVEs | October 2021: 1,759 CVEs | November 2021: 1,694 CVEs291 added to CISA KEV | December 2021: 2,520 CVEs20 added to CISA KEV | 20,93511 of 12 months11/12 |
- Critical
- 19613% of the 1,516 with a CVSS score
- Added to CISA KEV
- 019 of this month's CVEs are in KEV, listed a median 180 days after publication
- Vendors
- 6783,660 products
- Top weakness
- XSSCWE-79 · 203 CVEs
Who drove it
Vendors by distinct CVEs this month, with how many of those CVEs are now in CISA KEV and how far each moved in the ranking.
- 1Сообщество Свободного Программного ОбеспеченияDebian Gnu/linux, Linux, Drupal23926nonenew
- 2PyPITensorflow-gpu, Tensorflow, Tensorflow-cpu1384nonenew
- 3Ао "нппкт"Осон Основа Оnyx12719nonenew
- 4Ооо «русбитех-астра»Astra Linux Special Edition, Astra Linux Special Edition Для «эльбрус», Astra Linux Common Edition12621nonenew
- 5GoogleTensorflow, Libwebp, Cloud IoT Device Sdk For Embedded C12010nonenew
- 6TensorflowTensorflow1080nonenew
- 7Red HatEnterprise Linux, Red Hat Enterprise Linux, Ansible Tower10516nonenew
- 8DebianDebian Linux1007nonenew
- 9FedoraprojectFedora927nonenew
- 10Ао «концерн Вниинс»Ос Он «стрелец»7617nonenew
- 11IBMQradar Siem, Cognos Analytics, Qradar Security Information and Event Manager717nonenew
- 12CiscoCisco SD-WAN, SD-WAN Vmanage, Small Business WAP3517072new
- 13MavenCom.liferay.portal:release.dxp.bom, Com.liferay.portal:release.portal.bom, Org.opennms:opennms658nonenew
- 14MicrosoftWindows 10, Windows 10 2004, Windows 10 20h25622new
- 15Ооо «ред Софт»Ред Ос5518nonenew
- 16NetappCloud Backup, H300S Firmware, H410S Firmware496nonenew
- 17CanonicalUbuntu447nonenew
- 18Ао «ивк»Альт 8 Сп, Альт Сп 10, Альт 8 Сп Рабочая Станция412nonenew
- 19npmMixme, Tinymce, Matrix-react-sdk398nonenew
- 20FoxitsoftwareReader, Phantompdf, Foxit Reader340nonenew
- 21LinuxLinux Kernel, MAC80211, Kernel340nonenew
- 22SiemensSimatic Hmi Comfort Outdoor Panels 15\" Firmware, Simatic Wincc Runtime Advanced V15, Simatic Wincc Runtime Advanced292nonenew
- 23JetbrainsTeamcity, Youtrack, Intellij Idea284nonenew
- 24Unknown404 Seo Redirection, Sina Extension For Elementor, The Plus Addons For Elementor Page Builder Lite281nonenew
- 25Ао «нтц Ит Роса»Rosa Virtualization, Rosa Virtualization 3.0, Роса Кобальт2812nonenew
Severity
How this month's CVEs score on CVSS; 64 have no score yet. Severity is not exploitation.
- Critical196
- High563
- Medium610
- Low147
New in the top 100
Not in the top 100 in any of the 24 months before.
What kind of weakness
Weakness classes (CWE) by distinct CVEs, with how far each moved in the ranking.
- CWE-79XSS203
- CWE-787Out-of-bounds Write134
- CWE-125Out-of-bounds Read65
- CWE-20Improper Input Validation49
- CWE-416Use After Free44
- CWE-36941
- CWE-476NULL Pointer Dereference41
- CWE-89SQL Injection37
- CWE-352CSRF35
- CWE-119Memory Buffer Bounds33
- CWE-78OS Command Injection32
- CWE-22Path Traversal31
- CWE-200Information Exposure28
- CWE-400Resource Consumption27
- CWE-120Buffer Overflow25
- CWE-287Improper Authentication25
- CWE-434Unrestricted File Upload25
- CWE-77Command Injection25
- CWE-863Incorrect Authorization25
- CWE-190Integer Overflow24
Where it landed
The month's CVEs by the sector of the software they affect. A CVE that touches several sectors counts in each.
- OSS Libraries49821% of sector-tagged CVEs
- Operating Systems42518% of sector-tagged CVEs
- Enterprise Software25211% of sector-tagged CVEs
- Web & CMS Plugins2099% of sector-tagged CVEs
- Mobile Apps1436% of sector-tagged CVEs
- Networking Infrastructure1416% of sector-tagged CVEs
- AI / ML1105% of sector-tagged CVEs
- ICS / OT / IoT984% of sector-tagged CVEs
- 7 smaller sectors444
- Not yet classified74
Which weakness, where
The top weakness classes against the vendors and the sectors that carried them.
The lighter the cell, the more CVEs. Point at one to read it.
| By vendor | 79XSS | 787Out-of-bounds Write | 125Out-of-bounds Read | 20Improper Input Validation | 416Use After Free | 369 | 476NULL Pointer Dereference | 89SQL Injection | 352CSRF | 119Memory Buffer Bounds |
|---|---|---|---|---|---|---|---|---|---|---|
| Сообщество Свободного Программного Обеспечения | 8 | 34 | 13 | 17 | 18 | 6 | 9 | 1 | 10 | |
| PyPI | 9 | 22 | 14 | 1 | 32 | 15 | 5 | |||
| Ао «нппкт» | 1 | 27 | 13 | 8 | 12 | 3 | 5 | 4 | ||
| Ооо «русбитех-астра» | 1 | 28 | 14 | 9 | 10 | 5 | 7 | 6 | ||
| 22 | 13 | 1 | 32 | 15 | 5 | |||||
| Tensorflow | 22 | 13 | 1 | 32 | 15 | 5 | ||||
| Debian | 22 | 10 | 7 | 11 | 4 | 6 | 6 | |||
| Fedoraproject | 1 | 9 | 8 | 9 | 13 | 4 | 6 | |||
| Red Hat | 4 | 8 | 11 | 8 | 4 | 3 | 1 | 3 | ||
| Ао «концерн Вниинс» | 15 | 14 | 5 | 2 | 4 | 1 | 1 | |||
| IBM | 13 | 3 | 1 | 1 | ||||||
| Cisco Systems Inc. | 3 | 11 | 2 | 4 |