July 2021
1,650 CVEs published, −17% on June 2021. CISA added 0 to KEV.
2021 month by month
| Year | Jan | Feb | Mar | Apr | May | Jun | Jul | Aug | Sep | Oct | Nov | Dec | Year total |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 2021 | January 2021: 1,970 CVEs | February 2021: 1,557 CVEs | March 2021: no snapshot | April 2021: 1,970 CVEs | May 2021: 1,580 CVEs | June 2021: 1,985 CVEs | July 2021: 1,650 CVEs | August 2021: 2,317 CVEs | September 2021: 1,933 CVEs | October 2021: 1,759 CVEs | November 2021: 1,694 CVEs291 added to CISA KEV | December 2021: 2,520 CVEs20 added to CISA KEV | 20,93511 of 12 months11/12 |
- Critical
- 18712% of the 1,619 with a CVSS score
- Added to CISA KEV
- 016 of this month's CVEs are in KEV, listed a median 112 days after publication
- Vendors
- 6493,978 products
- Top weakness
- XSSCWE-79 · 263 CVEs
Who drove it
Vendors by distinct CVEs this month, with how many of those CVEs are now in CISA KEV and how far each moved in the ranking.
- 1OracleMySQL Server, MySQL, E-business Suite1568nonenew
- 2Сообщество Свободного Программного ОбеспеченияDebian Gnu/linux, Linux, Phplist13681new
- 3MicrosoftWindows Server 2016, Windows Server 2019, Windows Server 2004 (Server Core Installation)124310new
- 4IBMSecurity Verify Access Docker, Security Verify Access, Cloud Pak For Applications743nonenew
- 5Ооо «русбитех-астра»Astra Linux Special Edition, Astra Linux Special Edition Для «эльбрус», Astra-openvpn-server6912new
- 6FedoraprojectFedora6321new
- 7SiemensTeamcenter Visualization, JT2GO, Solid Edge580nonenew
- 8NetappOncommand Insight, Active Iq Unified Manager, Oncommand Workflow Automation5011new
- 9Red HatRed Hat Enterprise Linux, Red Hat Software Collections, Enterprise Linux5021new
- 10Ао «ивк»Альт 8 Сп, Альт Сп 105021new
- 11Ао "нппкт"Осон Основа Оnyx4821new
- 12DebianDebian Linux472nonenew
- 13GoogleAndroid, Chrome, Google Chrome3311new
- 14QsanStorage Manager, Xevo, Sanos3014nonenew
- 15Ао «концерн Вниинс»Ос Он «стрелец»2911new
- 16MavenOrg.apache.commons:commons-compress, Org.webjars.npm:xlsx, Org.apache.tomcat:tomcat281nonenew
- 17Fedora ProjectFedora2711new
- 18Ооо «ред Софт»Ред Ос2711new
- 19NchsoftwareAxon Pbx, Quorum, Ivm Attendant260nonenew
- 20CiscoCisco Identity Services Engine Software, Cisco Identity Services Engine, Identity Services Engine250nonenew
- 21DellEmc Openmanage Enterprise, Emc Openmanage Enterprise-modular, Emc Unityvsa Operating Environment245nonenew
- 22npmXlsx, Curly-bracket-parser, Deepmergefn244nonenew
- 23PackagistLavalite/cms, Typo3/cms, Typo3/cms-core234nonenew
- 24QualcommWCN3998 Firmware, SDX55 Firmware, WCN3991 Firmware232nonenew
- 25Qualcomm, Inc.Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Iot, Snapdragon Industrial Iot, Snapdragon Iot, Snapdragon Voice & Music, Snapdragon Wearables, Snapdragon Consumer Iot, Snapdragon Industrial Iot, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables, Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Iot, Snapdragon Industrial Iot, Snapdragon Mobile, Snapdragon Wired Infrastructure and Networking232nonenew
Severity
How this month's CVEs score on CVSS; 31 have no score yet. Severity is not exploitation.
- Critical187
- High612
- Medium767
- Low53
New in the top 100
Not in the top 100 in any of the 24 months before.
What kind of weakness
Weakness classes (CWE) by distinct CVEs, with how far each moved in the ranking.
- CWE-79XSS263
- CWE-787Out-of-bounds Write99
- CWE-20Improper Input Validation64
- CWE-89SQL Injection63
- CWE-125Out-of-bounds Read45
- CWE-22Path Traversal45
- CWE-78OS Command Injection37
- CWE-200Information Exposure36
- CWE-120Buffer Overflow33
- CWE-269Improper Privilege Mgmt29
- CWE-416Use After Free28
- CWE-476NULL Pointer Dereference25
- CWE-352CSRF23
- CWE-798Hard-coded Credentials23
- CWE-287Improper Authentication21
- CWE-190Integer Overflow20
- CWE-434Unrestricted File Upload19
- CWE-284Improper Access Control18
- CWE-918SSRF18
- CWE-862Missing Authorization16
Where it landed
The month's CVEs by the sector of the software they affect. A CVE that touches several sectors counts in each.
- Operating Systems42420% of sector-tagged CVEs
- Enterprise Software34116% of sector-tagged CVEs
- Web & CMS Plugins24312% of sector-tagged CVEs
- OSS Libraries21410% of sector-tagged CVEs
- Databases1658% of sector-tagged CVEs
- Networking Infrastructure1407% of sector-tagged CVEs
- Hardware Firmware934% of sector-tagged CVEs
- Security Products884% of sector-tagged CVEs
- 7 smaller sectors313
- Not yet classified85
Which weakness, where
The top weakness classes against the vendors and the sectors that carried them.
The lighter the cell, the more CVEs. Point at one to read it.
| By vendor | 79XSS | 787Out-of-bounds Write | 20Improper Input Validation | 89SQL Injection | 125Out-of-bounds Read | 22Path Traversal | 78OS Command Injection | 200Information Exposure | 120Buffer Overflow | 269Improper Privilege Mgmt |
|---|---|---|---|---|---|---|---|---|---|---|
| Oracle | 1 | 2 | 1 | 1 | 2 | |||||
| Сообщество Свободного Программного Обеспечения | 8 | 18 | 3 | 4 | 9 | 1 | 3 | 4 | 7 | 1 |
| Oracle Corp. | ||||||||||
| Oracle Corporation | ||||||||||
| Microsoft Corp | 1 | 1 | 13 | |||||||
| Microsoft | 1 | 1 | 13 | |||||||
| IBM | 18 | 3 | 2 | 1 | 1 | 1 | ||||
| Ооо «русбитех-астра» | 9 | 7 | 1 | 1 | 3 | 1 | ||||
| Fedoraproject | 2 | 9 | 1 | 1 | 3 | 1 | 1 | |||
| Siemens | 1 | 24 | 24 | 15 | 1 | 2 | ||||
| Netapp | 1 | 3 | 1 | 1 | ||||||
| Ао «ивк» | 2 | 1 | 1 | 1 |