October 2021
1,759 CVEs published, −9% on September 2021 and +9% on October 2020. CISA added 0 to KEV.
2021 month by month
| Year | Jan | Feb | Mar | Apr | May | Jun | Jul | Aug | Sep | Oct | Nov | Dec | Year total |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 2021 | January 2021: 1,970 CVEs | February 2021: 1,557 CVEs | March 2021: no snapshot | April 2021: 1,970 CVEs | May 2021: 1,580 CVEs | June 2021: 1,985 CVEs | July 2021: 1,650 CVEs | August 2021: 2,317 CVEs | September 2021: 1,933 CVEs | October 2021: 1,759 CVEs | November 2021: 1,694 CVEs291 added to CISA KEV | December 2021: 2,520 CVEs20 added to CISA KEV | 20,93511 of 12 months11/12 |
- Critical
- 19511% of the 1,737 with a CVSS score
- Added to CISA KEV
- 018 of this month's CVEs are in KEV, listed a median 28 days after publication
- Vendors
- 7042,557 products
- Top weakness
- XSSCWE-79 · 293 CVEs
Who drove it
Vendors by distinct CVEs this month, with how many of those CVEs are now in CISA KEV and how far each moved in the ranking.
- 1OracleMySQL Server, MySQL, Openjdk16152new
- 2GoogleAndroid, Google Chrome, Chrome11125new
- 3NetappOncommand Insight, Snapcenter, Active Iq Unified Manager10232new
- 4FedoraprojectFedora10078new
- 5MicrosoftWindows Server 2004 (Server Core Installation), Windows Server 2022, Windows Server Version 20049436new
- 6Ао "нппкт"Осон Основа Оnyx8257new
- 7Сообщество Свободного Программного ОбеспеченияDebian Gnu/linux, Linux, Webkitgtk7952new
- 8DebianDebian Linux7523new
- 9UnknownFormidable Form Builder – Contact Form, Survey & Quiz Forms Plugin For WordPress, Weather Effect – Christmas Santa Snow Falling, Appointment Hour Booking – WordPress Booking Plugin681nonenew
- 10HuaweiEmui, Magic Ui, Harmonyos678nonenew
- 11Ооо «русбитех-астра»Astra Linux Special Edition, Astra Linux Special Edition Для «эльбрус», Astra Linux Common Edition6145new
- 12Ао «концерн Вниинс»Ос Он «стрелец»5547new
- 13CiscoFirepower Threat Defense, Cisco Adaptive Security Appliance (ASA) Software, ASA 5505 Firmware520nonenew
- 14ApplemacOS, iPadOS, iPhone OS4711new
- 15IBMSterling B2B Integrator, Sterling File Gateway, Rational Collaborative Lifecycle Management444nonenew
- 16JuniperJunos, Junos OS Evolved, Session and Resource Control421nonenew
- 17Juniper NetworksJunos OS, Junos OS Evolved, Junos421nonenew
- 18Fedora ProjectFedora3944new
- 19GitLabGitLab360nonenew
- 20Ао «ивк»Альт 8 Сп, Альт Сп 103433new
- 21Samsung MobileSamsung Mobile Devices, Samsung Notes, Galaxy Store3302new
- 22PackagistGrumpydictator/firefly-iii, Snipe/snipe-it, Typo3/cms-core324nonenew
- 23QualcommWCD9380 Firmware, WCD9370 Firmware, WCD9375 Firmware310nonenew
- 24Qualcomm, Inc.Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Iot, Snapdragon Industrial Iot, Snapdragon Wearables, Snapdragon Auto, Snapdragon Connectivity, Snapdragon Industrial Iot, Snapdragon Mobile, Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer Iot, Snapdragon Industrial Iot, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables310nonenew
- 25SiemensSinec Nms, Scalance W1750D Firmware, Sinec Infrastructure Network Services315nonenew
Severity
How this month's CVEs score on CVSS; 22 have no score yet. Severity is not exploitation.
- Critical195
- High662
- Medium830
- Low50
New in the top 100
Not in the top 100 in any of the 24 months before.
What kind of weakness
Weakness classes (CWE) by distinct CVEs, with how far each moved in the ranking.
- CWE-79XSS293
- CWE-787Out-of-bounds Write93
- CWE-89SQL Injection72
- CWE-22Path Traversal67
- CWE-125Out-of-bounds Read61
- CWE-20Improper Input Validation47
- CWE-434Unrestricted File Upload46
- CWE-416Use After Free38
- CWE-78OS Command Injection37
- CWE-352CSRF36
- CWE-269Improper Privilege Mgmt35
- CWE-120Buffer Overflow33
- CWE-200Information Exposure31
- CWE-400Resource Consumption25
- CWE-862Missing Authorization24
- CWE-287Improper Authentication21
- CWE-190Integer Overflow20
- CWE-77Command Injection20
- CWE-28518
- CWE-770Allocation Without Limits18
Where it landed
The month's CVEs by the sector of the software they affect. A CVE that touches several sectors counts in each.
- Enterprise Software36916% of sector-tagged CVEs
- Operating Systems33514% of sector-tagged CVEs
- Web & CMS Plugins24210% of sector-tagged CVEs
- OSS Libraries24110% of sector-tagged CVEs
- Mobile Apps23610% of sector-tagged CVEs
- Networking Infrastructure1948% of sector-tagged CVEs
- Databases1757% of sector-tagged CVEs
- 8 smaller sectors434
- Not yet classified112
Which weakness, where
The top weakness classes against the vendors and the sectors that carried them.
The lighter the cell, the more CVEs. Point at one to read it.
| By vendor | 79XSS | 787Out-of-bounds Write | 89SQL Injection | 22Path Traversal | 125Out-of-bounds Read | 20Improper Input Validation | 434Unrestricted File Upload | 416Use After Free | 78OS Command Injection | 352CSRF |
|---|---|---|---|---|---|---|---|---|---|---|
| Oracle | 3 | 5 | 2 | 1 | 2 | |||||
| Oracle Corporation | 2 | 1 | ||||||||
| 14 | 1 | 1 | 20 | 4 | 19 | 1 | ||||
| Netapp | 3 | 7 | 2 | 2 | 2 | 2 | ||||
| Fedoraproject | 4 | 15 | 3 | 2 | 1 | 12 | ||||
| Microsoft Corp | 2 | 3 | 11 | |||||||
| Ао «нппкт» | 1 | 9 | 3 | 4 | 2 | 14 | ||||
| Сообщество Свободного Программного Обеспечения | 1 | 12 | 5 | 4 | 1 | 10 | ||||
| Debian | 2 | 8 | 2 | 2 | 1 | 10 | 1 | |||
| Microsoft | 2 | 1 | ||||||||
| Huawei | 2 | 3 | 6 | 4 | 3 | |||||
| Ооо «русбитех-астра» | 14 | 1 | 3 | 2 | 11 |