December 2021
2,520 CVEs published, +49% on November 2021 and +56% on December 2020. CISA added 20 to KEV.
2021 month by month
| Year | Jan | Feb | Mar | Apr | May | Jun | Jul | Aug | Sep | Oct | Nov | Dec | Year total |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 2021 | January 2021: 1,970 CVEs | February 2021: 1,557 CVEs | March 2021: no snapshot | April 2021: 1,970 CVEs | May 2021: 1,580 CVEs | June 2021: 1,985 CVEs | July 2021: 1,650 CVEs | August 2021: 2,317 CVEs | September 2021: 1,933 CVEs | October 2021: 1,759 CVEs | November 2021: 1,694 CVEs291 added to CISA KEV | December 2021: 2,520 CVEs20 added to CISA KEV | 20,93511 of 12 months11/12 |
- Critical
- 35818% of the 2,037 with a CVSS score
- Added to CISA KEV
- 2013 of this month's CVEs are in KEV, listed a median 503 days after publication
- Vendors
- 7953,092 products
- Top weakness
- XSSCWE-79 · 237 CVEs
Who drove it
Vendors by distinct CVEs this month, with how many of those CVEs are now in CISA KEV and how far each moved in the ranking.
- 1NetgearRBR850 Firmware, RBK852 Firmware, RBS850 Firmware20147nonenew
- 2GoogleAndroid, Google Chrome, Chrome19772new
- 3Сообщество Свободного Программного ОбеспеченияDebian Gnu/linux, Linux, Vim117154new
- 4DebianDebian Linux108103new
- 5MicrosoftWindows Server 2016, Windows 10 Version 2004, Windows 10 20049693new
- 6Ао "нппкт"Осон Основа Оnyx9372new
- 7FedoraprojectFedora, Sssd, Extra Packages For Enterprise Linux9062new
- 8Ооо «русбитех-астра»Astra Linux Special Edition, Astra Linux Special Edition Для «эльбрус», Astra Linux Common Edition77101new
- 9UnknownUser Registration, Login Form, User Profile & Membership – Profilepress (Formerly Wp User Avatar), Get Custom Field Values, Clickbank Affiliate Ads7410nonenew
- 10Ао «концерн Вниинс»Ос Он «стрелец»7351new
- 11HuaweiHarmonyos, Emui, Magic Ui6920nonenew
- 12PackagistYetiforce/yetiforce-crm, Showdoc/showdoc, Snipe/snipe-it6310nonenew
- 13Crates.ioRusqlite, Messagepack-rs, Ckb5528nonenew
- 14SiemensJt Utilities, Jt Open Toolkit, Jttk4942new
- 15IBMCognos Analytics, Spectrum Copy Data Management, DB2 For Linux, Unix and Windows424nonenew
- 16Ооо «ред Софт»Ред Ос4162new
- 17Advantech Co., LtdR-seenet, Wise-4060, Wise-4010398nonenew
- 18FortinetFortiweb, Fortinet Fortiweb, Fortios390nonenew
- 19Red HatRed Hat Enterprise Linux, Enterprise Linux, Openshift Application Runtimes3743new
- 20ApplemacOS, Mac OS X, IOS3141new
- 21MavenIo.atomix:atomix, Org.ops4j.pax.logging:pax-logging-log4j2, Org.apache.logging.log4j:log4j-core3152new
- 22AdobePremiere Rush, Adobe Premiere Rush, Dimension290nonenew
- 23MozillaFirefox, Thunderbird, Firefox Esr282nonenew
- 24NetappOncommand Insight, H500E Firmware, H500S Firmware2741new
- 25AdvantechR-seenet260nonenew
Severity
How this month's CVEs score on CVSS; 483 have no score yet. Severity is not exploitation.
- Critical358
- High883
- Medium736
- Low60
New in the top 100
Not in the top 100 in any of the 24 months before.
What kind of weakness
Weakness classes (CWE) by distinct CVEs, with how far each moved in the ranking.
- CWE-79XSS237
- CWE-787Out-of-bounds Write184
- CWE-77Command Injection109
- CWE-89SQL Injection102
- CWE-125Out-of-bounds Read72
- CWE-22Path Traversal58
- CWE-78OS Command Injection58
- CWE-416Use After Free54
- CWE-352CSRF50
- CWE-20Improper Input Validation48
- CWE-120Buffer Overflow47
- CWE-862Missing Authorization45
- CWE-287Improper Authentication40
- CWE-200Information Exposure38
- CWE-476NULL Pointer Dereference31
- CWE-190Integer Overflow25
- CWE-502Deserialization25
- CWE-119Memory Buffer Bounds24
- CWE-20324
- CWE-269Improper Privilege Mgmt22
Where it landed
The month's CVEs by the sector of the software they affect. A CVE that touches several sectors counts in each.
- OSS Libraries36414% of sector-tagged CVEs
- Operating Systems36114% of sector-tagged CVEs
- Networking Infrastructure35013% of sector-tagged CVEs
- Mobile Apps30912% of sector-tagged CVEs
- Enterprise Software29511% of sector-tagged CVEs
- Web & CMS Plugins2269% of sector-tagged CVEs
- ICS / OT / IoT1666% of sector-tagged CVEs
- Security Products1205% of sector-tagged CVEs
- 7 smaller sectors335
- Not yet classified126
Which weakness, where
The top weakness classes against the vendors and the sectors that carried them.
The lighter the cell, the more CVEs. Point at one to read it.
| By vendor | 79XSS | 787Out-of-bounds Write | 77Command Injection | 89SQL Injection | 125Out-of-bounds Read | 22Path Traversal | 78OS Command Injection | 416Use After Free | 352CSRF | 120Buffer Overflow |
|---|---|---|---|---|---|---|---|---|---|---|
| Netgear | 17 | 8 | 97 | 1 | 2 | 12 | ||||
| 26 | 17 | 1 | 22 | |||||||
| Сообщество Свободного Программного Обеспечения | 6 | 25 | 1 | 7 | 1 | 17 | 3 | |||
| Debian | 6 | 21 | 1 | 6 | 18 | 1 | ||||
| Microsoft Corp | 6 | 3 | 7 | |||||||
| Ао «нппкт» | 2 | 17 | 1 | 3 | 1 | 15 | 1 | |||
| Fedoraproject | 4 | 15 | 2 | 6 | 1 | 15 | 1 | |||
| Ооо «русбитех-астра» | 1 | 22 | 1 | 4 | 1 | 15 | 3 | |||
| Ао «концерн Вниинс» | 2 | 13 | 1 | 17 | ||||||
| Huawei | 5 | 7 | 4 | 1 | ||||||
| Microsoft | 2 | 3 | ||||||||
| Packagist | 23 | 4 | 3 | 1 | 13 |