September 2021
1,933 CVEs published, −17% on August 2021 and −14% on September 2020. CISA added 0 to KEV.
2021 month by month
| Year | Jan | Feb | Mar | Apr | May | Jun | Jul | Aug | Sep | Oct | Nov | Dec | Year total |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 2021 | January 2021: 1,970 CVEs | February 2021: 1,557 CVEs | March 2021: no snapshot | April 2021: 1,970 CVEs | May 2021: 1,580 CVEs | June 2021: 1,985 CVEs | July 2021: 1,650 CVEs | August 2021: 2,317 CVEs | September 2021: 1,933 CVEs | October 2021: 1,759 CVEs | November 2021: 1,694 CVEs291 added to CISA KEV | December 2021: 2,520 CVEs20 added to CISA KEV | 20,93511 of 12 months11/12 |
- Critical
- 21411% of the 1,902 with a CVSS score
- Added to CISA KEV
- 030 of this month's CVEs are in KEV, listed a median 56.5 days after publication
- Vendors
- 7893,326 products
- Top weakness
- XSSCWE-79 · 269 CVEs
Who drove it
Vendors by distinct CVEs this month, with how many of those CVEs are now in CISA KEV and how far each moved in the ranking.
- 1ApplemacOS, iPhone OS, iPadOS218118new
- 2Сообщество Свободного Программного ОбеспеченияDebian Gnu/linux, Gpac, Webkitgtk188109new
- 3AdobeAcrobat Dc, Acrobat Reader Dc, Acrobat Reader149111new
- 4Ооо «русбитех-астра»Astra Linux Special Edition, Astra Linux Special Edition Для «эльбрус», Astra Linux Common Edition10523new
- 5Ао "нппкт"Осон Основа Оnyx10126new
- 6DebianDebian Linux8931new
- 7MicrosoftWindows Server Version 2004, Windows 10 Version 21h1, Windows Server 20168717new
- 8UnknownTimetable and Event Schedule By Motopress, Postx – Gutenberg Blocks For Post Grid, Availability Calendar854nonenew
- 9FedoraprojectFedora, Extra Packages For Enterprise Linux5931new
- 10IBMJazz For Service Management, Tivoli Netcool\/omnibus Webgui, Tivoli Netcool/omnibus582nonenew
- 11SiemensScalance W1750D Firmware, Solid Edge SE2021, Solid Edge5891new
- 12Ао «концерн Вниинс»Ос Он «стрелец»5421new
- 13CiscoIOS XE, Cisco IOS XE, Cisco IOS XE Software514nonenew
- 14Ао «ивк»Альт 8 Сп, Альт Сп 104821new
- 15npmGhost, Parse-server, Immer476nonenew
- 16PackagistMagento/community-edition, Magento/project-community-edition, Gilacms/gila4714nonenew
- 17GoogleAndroid, Google Chrome, Kubernetes391nonenew
- 18QualcommQCA6574AU Firmware, WCD9380 Firmware, SA8155P Firmware389nonenew
- 19Qualcomm, Inc.Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Iot, Snapdragon Industrial Iot, Snapdragon Iot, Snapdragon Voice & Music, Snapdragon Wearables, Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Iot, Snapdragon Industrial Iot, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables, Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer Iot, Snapdragon Industrial Iot, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wired Infrastructure and Networking379nonenew
- 20SapBusiness One, Contact Center, Cloud Connector3361new
- 21Sap SeSap Business One, Sap Contact Center, Sap Cloud Connector3361new
- 22SwftoolsSwftools320nonenew
- 23F5BIG-IP Application Security Manager, BIG-IP Access Policy Manager, BIG-IP Domain Name System3141new
- 24Fedora ProjectFedora2913new
- 25PyPIWasmtime, Openvpn-monitor, Parlai293nonenew
Severity
How this month's CVEs score on CVSS; 31 have no score yet. Severity is not exploitation.
- Critical214
- High812
- Medium831
- Low45
New in the top 100
Not in the top 100 in any of the 24 months before.
What kind of weakness
Weakness classes (CWE) by distinct CVEs, with how far each moved in the ranking.
- CWE-79XSS269
- CWE-787Out-of-bounds Write192
- CWE-476NULL Pointer Dereference82
- CWE-20Improper Input Validation80
- CWE-125Out-of-bounds Read78
- CWE-22Path Traversal58
- CWE-89SQL Injection57
- CWE-352CSRF51
- CWE-416Use After Free47
- CWE-78OS Command Injection43
- CWE-287Improper Authentication39
- CWE-269Improper Privilege Mgmt38
- CWE-120Buffer Overflow35
- CWE-200Information Exposure33
- CWE-78829
- CWE-119Memory Buffer Bounds28
- CWE-434Unrestricted File Upload28
- CWE-77Command Injection28
- CWE-863Incorrect Authorization24
- CWE-862Missing Authorization23
Where it landed
The month's CVEs by the sector of the software they affect. A CVE that touches several sectors counts in each.
- Operating Systems39316% of sector-tagged CVEs
- OSS Libraries35414% of sector-tagged CVEs
- Enterprise Software30112% of sector-tagged CVEs
- Mobile Apps26911% of sector-tagged CVEs
- Web & CMS Plugins26811% of sector-tagged CVEs
- Consumer Software1938% of sector-tagged CVEs
- Networking Infrastructure1345% of sector-tagged CVEs
- Security Products1084% of sector-tagged CVEs
- 7 smaller sectors336
- Not yet classified125
Which weakness, where
The top weakness classes against the vendors and the sectors that carried them.
The lighter the cell, the more CVEs. Point at one to read it.
| By vendor | 79XSS | 787Out-of-bounds Write | 476NULL Pointer Dereference | 20Improper Input Validation | 125Out-of-bounds Read | 22Path Traversal | 89SQL Injection | 352CSRF | 416Use After Free | 78OS Command Injection |
|---|---|---|---|---|---|---|---|---|---|---|
| Apple | 4 | 38 | 1 | 5 | 21 | 3 | 8 | |||
| Сообщество Свободного Программного Обеспечения | 7 | 65 | 14 | 18 | 11 | 1 | 4 | 15 | ||
| Adobe | 6 | 25 | 7 | 15 | 22 | 1 | 10 | 4 | ||
| Adobe Systems Inc. | 6 | 25 | 7 | 15 | 19 | 1 | 10 | 4 | ||
| Ооо «русбитех-астра» | 2 | 39 | 4 | 17 | 8 | 1 | 14 | |||
| Ао «нппкт» | 5 | 37 | 2 | 16 | 7 | 1 | 16 | |||
| Debian | 1 | 35 | 4 | 18 | 10 | 1 | 3 | |||
| Microsoft Corp | 1 | 4 | 1 | 14 | ||||||
| Microsoft | 1 | 4 | 1 | 14 | ||||||
| Fedoraproject | 13 | 3 | 7 | 5 | 14 | |||||
| IBM | 25 | 1 | 1 | |||||||
| Siemens | 2 | 1 | 1 | 4 | 6 | 3 | 6 | 1 |