June 2021
1,985 CVEs published, +26% on May 2021 and +5% on June 2020. CISA added 0 to KEV.
2021 month by month
| Year | Jan | Feb | Mar | Apr | May | Jun | Jul | Aug | Sep | Oct | Nov | Dec | Year total |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 2021 | January 2021: 1,970 CVEs | February 2021: 1,557 CVEs | March 2021: no snapshot | April 2021: 1,970 CVEs | May 2021: 1,580 CVEs | June 2021: 1,985 CVEs | July 2021: 1,650 CVEs | August 2021: 2,317 CVEs | September 2021: 1,933 CVEs | October 2021: 1,759 CVEs | November 2021: 1,694 CVEs291 added to CISA KEV | December 2021: 2,520 CVEs20 added to CISA KEV | 20,93511 of 12 months11/12 |
- Critical
- 17710% of the 1,741 with a CVSS score
- Added to CISA KEV
- 015 of this month's CVEs are in KEV, listed a median 148 days after publication
- Vendors
- 6763,466 products
- Top weakness
- XSSCWE-79 · 198 CVEs
Who drove it
Vendors by distinct CVEs this month, with how many of those CVEs are now in CISA KEV and how far each moved in the ranking.
- 1Сообщество Свободного Программного ОбеспеченияDebian Gnu/linux, Linux, Libslirp260245—
- 2GoogleAndroid, Chrome, Google Chrome17193+3
- 3Ао "нппкт"Осон Основа Оnyx12852—
- 4Ооо «русбитех-астра»Astra Linux Special Edition, Astra Linux Special Edition Для «эльбрус», Astra Linux Common Edition12852—
- 5FedoraprojectFedora10972+4
- 6Ао «концерн Вниинс»Ос Он «стрелец»10632+4
- 7Red HatRed Hat Enterprise Linux, Enterprise Linux, Openshift Container Platform721none—
- 8DebianDebian Linux714none—
- 9Ао «ивк»Альт 8 Сп, Альт Сп 107112+9
- 10IntelJHL7040 Thunderbolt 3 Retimer Firmware, JHL6240 Thunderbolt 3 Firmware, JHL7340 Thunderbolt 3 Firmware701none+66
- 11MicrosoftWindows 10 21h1, Windows 10 Version 21h1, Windows 10 20h25617+3
- 12IBMEngineering Lifecycle Optimization - Publishing, Rational Collaborative Lifecycle Management, Engineering Lifecycle Optimization491none−1
- 13HuaweiEmui, Magic Ui, ESE620X Vess Firmware489none+51
- 14MavenCom.xebialabs.deployit.ci:deployit-plugin, Org.jenkins-ci.plugins:requests, Org.jboss.resteasy:resteasy-bom453none−1
- 15PackagistShopware/platform, Magento/community-edition, Shopware/core447none+17
- 16CanonicalUbuntu, Apport, Ubuntu Linux430none+1
- 17Novell Inc.Opensuse Leap, Suse Linux Enterprise Server, Suse Linux Enterprise Server For Sap Applications4311+29
- 18Samsung MobileSamsung Mobile Devices, Samsung Health, Samsung Notes4352new
- 19Sap3d Visual Enterprise Viewer, Netweaver As Internet Graphics Server, Netweaver As Abap401none+47
- 20Sap SeSap 3d Visual Enterprise Viewer, Sap Internet Graphics Service, Sap Netweaver Abap Server and Abap Platform (Enqueue Server)401none+47
- 21UnknownSimple 301 Redirects By Betterlinks, The Plus Addons For Elementor Page Builder, Autoptimize402none+3
- 22MozillaFirefox, Thunderbird, Firefox Esr391nonenew
- 23NetappCloud Backup, Solidfire Bios, Hci Compute Node Bios393none−7
- 24Ооо «ред Софт»Ред Ос380none−9
- 25npmTenvoy, @backstage/techdocs-common, @auth0/nextjs-auth0366none−6
Severity
How this month's CVEs score on CVSS; 244 have no score yet. Severity is not exploitation.
- Critical177
- High772
- Medium743
- Low49
Breakouts
Vendors with at least three times their own 12-month median.
New in the top 100
Not in the top 100 in any of the 24 months before.
What kind of weakness
Weakness classes (CWE) by distinct CVEs, with how far each moved in the ranking.
- CWE-79XSS198
- CWE-787Out-of-bounds Write169
- CWE-125Out-of-bounds Read69
- CWE-20Improper Input Validation69
- CWE-416Use After Free69
- CWE-89SQL Injection65
- CWE-434Unrestricted File Upload45
- CWE-119Memory Buffer Bounds43
- CWE-400Resource Consumption38
- CWE-22Path Traversal36
- CWE-200Information Exposure33
- CWE-190Integer Overflow32
- CWE-78OS Command Injection31
- CWE-862Missing Authorization29
- CWE-863Incorrect Authorization29
- CWE-287Improper Authentication26
- CWE-120Buffer Overflow25
- CWE-352CSRF25
- CWE-362Race Condition23
- CWE-269Improper Privilege Mgmt20
Where it landed
The month's CVEs by the sector of the software they affect. A CVE that touches several sectors counts in each.
- Operating Systems53821% of sector-tagged CVEs
- OSS Libraries33013% of sector-tagged CVEs
- Enterprise Software32513% of sector-tagged CVEs
- Mobile Apps24410% of sector-tagged CVEs
- Web & CMS Plugins2209% of sector-tagged CVEs
- Hardware Firmware1687% of sector-tagged CVEs
- ICS / OT / IoT1225% of sector-tagged CVEs
- 8 smaller sectors489
- Not yet classified83
Which weakness, where
The top weakness classes against the vendors and the sectors that carried them.
The lighter the cell, the more CVEs. Point at one to read it.
| By vendor | 79XSS | 787Out-of-bounds Write | 125Out-of-bounds Read | 20Improper Input Validation | 416Use After Free | 89SQL Injection | 434Unrestricted File Upload | 119Memory Buffer Bounds | 400Resource Consumption | 22Path Traversal |
|---|---|---|---|---|---|---|---|---|---|---|
| Сообщество Свободного Программного Обеспечения | 14 | 36 | 9 | 4 | 32 | 4 | 6 | 6 | 10 | 6 |
| 31 | 13 | 9 | 39 | 5 | 1 | |||||
| Ао «нппкт» | 23 | 4 | 1 | 25 | 2 | 4 | 2 | |||
| Ооо «русбитех-астра» | 2 | 22 | 5 | 1 | 23 | 4 | 5 | 1 | ||
| Fedoraproject | 1 | 12 | 4 | 25 | 1 | 1 | 3 | 4 | ||
| Ао «концерн Вниинс» | 16 | 2 | 22 | 1 | 3 | |||||
| Debian | 1 | 13 | 1 | 3 | 2 | 3 | 3 | |||
| Ао «ивк» | 5 | 2 | 16 | 1 | 1 | |||||
| Intel | 5 | 2 | 6 | 2 | 2 | 1 | ||||
| Google Inc | 9 | 3 | 1 | 25 | 1 | |||||
| Microsoft Corp | 2 | 2 | 1 | |||||||
| Microsoft | 1 | 1 |