November 2021
1,694 CVEs published, −4% on October 2021 and +14% on November 2020. CISA added 291 to KEV.
2021 month by month
| Year | Jan | Feb | Mar | Apr | May | Jun | Jul | Aug | Sep | Oct | Nov | Dec | Year total |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 2021 | January 2021: 1,970 CVEs | February 2021: 1,557 CVEs | March 2021: no snapshot | April 2021: 1,970 CVEs | May 2021: 1,580 CVEs | June 2021: 1,985 CVEs | July 2021: 1,650 CVEs | August 2021: 2,317 CVEs | September 2021: 1,933 CVEs | October 2021: 1,759 CVEs | November 2021: 1,694 CVEs291 added to CISA KEV | December 2021: 2,520 CVEs20 added to CISA KEV | 20,93511 of 12 months11/12 |
- Critical
- 19913% of the 1,545 with a CVSS score
- Added to CISA KEV
- 2919 of this month's CVEs are in KEV, listed a median 140 days after publication
- Vendors
- 7165,095 products
- Top weakness
- XSSCWE-79 · 227 CVEs
Who drove it
Vendors by distinct CVEs this month, with how many of those CVEs are now in CISA KEV and how far each moved in the ranking.
- 1UnknownSimple Download Monitor, Accept Donations With Paypal, Qr Redirector1274nonenew
- 2GoogleTensorflow, Google Chrome, Chrome9532new
- 3DebianDebian Linux8883new
- 4MicrosoftWindows Server 2016, Windows Server 2019, Microsoft Edge8735new
- 5Сообщество Свободного Программного ОбеспеченияDebian Gnu/linux, Busybox, Linux87131new
- 6FedoraprojectFedora, Extra Packages For Enterprise Linux7993new
- 7Ао "нппкт"Осон Основа Оnyx7462new
- 8Ооо «русбитех-астра»Astra Linux Special Edition, Astra Linux Special Edition Для «эльбрус»5841new
- 9PyPITensorflow-cpu, Tensorflow-gpu, Tensorflow562nonenew
- 10Ао «концерн Вниинс»Ос Он «стрелец»5222new
- 11IntelAc 3165 Firmware, AX210 Firmware, AX201 Firmware500nonenew
- 12MavenOrg.jenkins-ci.main:jenkins-core, Org.apache.ozone:ozone-main, Software.amazon.awssdk.iotdevicesdk:aws-iot-device-sdk4618nonenew
- 13PackagistConcrete5/core, Moodle/moodle, Symfony/symfony467nonenew
- 14AdobeAfter Effects, Adobe After Effects, Adobe Prelude450nonenew
- 15npmAws-iot-device-sdk-v2, Nodebb, Apostrophe447nonenew
- 16IBMSecurity Guardium Key Lifecycle Manager, Security Key Lifecycle Manager, Infosphere Information Server431nonenew
- 17AmdEpyc 7443p Firmware, Epyc 7313 Firmware, Epyc 75f3 Firmware400nonenew
- 18Novell Inc.Opensuse Leap, Suse Linux Enterprise Server, Suse Linux Enterprise Server For Sap Applications384nonenew
- 19Ооо «ред Софт»Ред Ос365nonenew
- 20TensorflowTensorflow340nonenew
- 21HuaweiHarmonyos, Magic Ui, Emui332nonenew
- 22DellCloudlink, Emc Cloud Link, Dell Emc Streaming Data Platform322nonenew
- 23Red HatRed Hat Enterprise Linux, Openshift Container Platform, Enterprise Linux3011nonenew
- 24SiemensTalon Tc Compact Firmware, Talon Tc Modular Firmware, Nucleus Source Code293nonenew
- 25Apache Software FoundationApache Ozone, Apache Traffic Server, Traffic Server257nonenew
Severity
How this month's CVEs score on CVSS; 149 have no score yet. Severity is not exploitation.
- Critical199
- High635
- Medium678
- Low33
New in the top 100
Not in the top 100 in any of the 24 months before.
What kind of weakness
Weakness classes (CWE) by distinct CVEs, with how far each moved in the ranking.
- CWE-79XSS227
- CWE-787Out-of-bounds Write91
- CWE-20Improper Input Validation89
- CWE-89SQL Injection69
- CWE-352CSRF65
- CWE-416Use After Free50
- CWE-125Out-of-bounds Read43
- CWE-120Buffer Overflow41
- CWE-22Path Traversal41
- CWE-119Memory Buffer Bounds35
- CWE-78OS Command Injection32
- CWE-269Improper Privilege Mgmt30
- CWE-863Incorrect Authorization27
- CWE-284Improper Access Control25
- CWE-287Improper Authentication24
- CWE-78824
- CWE-94Code Injection23
- CWE-476NULL Pointer Dereference21
- CWE-862Missing Authorization21
- CWE-200Information Exposure20
Where it landed
The month's CVEs by the sector of the software they affect. A CVE that touches several sectors counts in each.
- OSS Libraries34016% of sector-tagged CVEs
- Operating Systems30814% of sector-tagged CVEs
- Enterprise Software26012% of sector-tagged CVEs
- Web & CMS Plugins22711% of sector-tagged CVEs
- Hardware Firmware1547% of sector-tagged CVEs
- Mobile Apps1467% of sector-tagged CVEs
- Consumer Software1035% of sector-tagged CVEs
- Security Products964% of sector-tagged CVEs
- DevTools & CI934% of sector-tagged CVEs
- 6 smaller sectors307
- Not yet classified106
Which weakness, where
The top weakness classes against the vendors and the sectors that carried them.
The lighter the cell, the more CVEs. Point at one to read it.
| By vendor | 79XSS | 787Out-of-bounds Write | 20Improper Input Validation | 89SQL Injection | 352CSRF | 416Use After Free | 125Out-of-bounds Read | 120Buffer Overflow | 22Path Traversal | 119Memory Buffer Bounds |
|---|---|---|---|---|---|---|---|---|---|---|
| 1 | 12 | 4 | 18 | 18 | 2 | |||||
| Debian | 3 | 15 | 8 | 2 | 14 | 3 | 3 | 1 | 3 | |
| Сообщество Свободного Программного Обеспечения | 8 | 12 | 5 | 5 | 20 | 3 | 1 | 2 | ||
| Microsoft Corp | 2 | 6 | 2 | 1 | 9 | 1 | ||||
| Fedoraproject | 5 | 10 | 3 | 2 | 1 | 16 | 1 | 3 | 1 | 3 |
| Ао «нппкт» | 2 | 12 | 3 | 24 | 2 | 2 | ||||
| Microsoft | 2 | 1 | 1 | |||||||
| Ооо «русбитех-астра» | 2 | 10 | 3 | 1 | 21 | 3 | 1 | |||
| PyPI | 4 | 2 | 1 | 1 | 10 | 2 | 3 | |||
| Ао «концерн Вниинс» | 2 | 10 | 2 | 21 | 1 | |||||
| Intel | 3 | 12 | ||||||||
| Maven | 4 | 1 | 1 | 3 |