January 2022
2,210 CVEs published, −12% on December 2021 and +12% on January 2021. CISA added 40 to KEV.
2022 month by month
- Critical
- 21011% of the 2,000 with a CVSS score
- Added to CISA KEV
- 4011 of this month's CVEs are in KEV, listed a median 104 days after publication
- Vendors
- 7303,331 products
- Top weakness
- XSSCWE-79 · 234 CVEs
Who drove it
Vendors by distinct CVEs this month, with how many of those CVEs are now in CISA KEV and how far each moved in the ranking.
- 1OracleMySQL, MySQL Cluster, MySQL Server186152new
- 2Ао «ивк»Альт 8 Сп, Альт Сп 10, Альт 8 Сп Сервер12381new
- 3DebianDebian Linux111182new
- 4Сообщество Свободного Программного ОбеспеченияDebian Gnu/linux, Linux, Vim106164new
- 5NetappOncommand Workflow Automation, Oncommand Insight, Active Iq Unified Manager10521new
- 6MicrosoftWindows Server 2019, Windows 10, Windows Server 2019 (Server Core Installation)10372new
- 7PackagistRemdex/livehelperchat, Pimcore/pimcore, Moodle/moodle885nonenew
- 8ReolinkRlc-410w Firmware, Reolink Rlc-410w7931new
- 9BentleyMicrostation, Bentley View, View780nonenew
- 10FedoraprojectFedora, Extra Packages For Enterprise Linux7741new
- 11MavenNet.mingsoft:ms-mcms, Org.apache.kylin:kylin, Org.jenkins-ci.plugins:publish-over-ssh7515nonenew
- 12HuaweiHarmonyos, Emui, Magic Ui7310nonenew
- 13UnknownBooster For Woocommerce, All In One Seo – Best WordPress Seo Plugin – Easily Improve Seo Rankings & Increase Traffic, Eventcalendar732nonenew
- 14Red HatRed Hat Enterprise Linux, Red Hat Software Collections, Enterprise Linux7291new
- 15Ооо «русбитех-астра»Astra Linux Special Edition, Astra Linux Special Edition Для «эльбрус», Astra Linux Common Edition71123new
- 16GoogleAndroid, Google Chrome, Android Studio6341new
- 17Ао "нппкт"Осон Основа Оnyx59132new
- 18Ооо «ред Софт»Ред Ос5381new
- 19Ао «нтц Ит Роса»Rosa Virtualization, Роса Кобальт, Роса Хром5281new
- 20AdobeAcrobat, Acrobat Dc, Acrobat Reader481nonenew
- 21Netapp Inc.Oncommand Workflow Automation, Oncommand Insight, Active Iq Unified Manager For VMware Vsphere481nonenew
- 22GpacGpac460nonenew
- 23Ао «концерн Вниинс»Ос Он «стрелец»4562new
- 24CesantaMjs440nonenew
- 25npmNode-forge, Marked, Shelljs415nonenew
Severity
How this month's CVEs score on CVSS; 210 have no score yet. Severity is not exploitation.
- Critical210
- High821
- Medium886
- Low83
New in the top 100
Not in the top 100 in any of the 24 months before.
What kind of weakness
Weakness classes (CWE) by distinct CVEs, with how far each moved in the ranking.
- CWE-79XSS234
- CWE-787Out-of-bounds Write143
- CWE-20Improper Input Validation108
- CWE-89SQL Injection92
- CWE-416Use After Free69
- CWE-476NULL Pointer Dereference67
- CWE-125Out-of-bounds Read65
- CWE-352CSRF44
- CWE-22Path Traversal43
- CWE-200Information Exposure38
- CWE-61738
- CWE-862Missing Authorization35
- CWE-400Resource Consumption33
- CWE-287Improper Authentication29
- CWE-78OS Command Injection29
- CWE-434Unrestricted File Upload28
- CWE-120Buffer Overflow25
- CWE-284Improper Access Control24
- CWE-190Integer Overflow23
- CWE-122Heap Buffer Overflow22
Where it landed
The month's CVEs by the sector of the software they affect. A CVE that touches several sectors counts in each.
- OSS Libraries54519% of sector-tagged CVEs
- Operating Systems46316% of sector-tagged CVEs
- Enterprise Software40214% of sector-tagged CVEs
- Web & CMS Plugins2709% of sector-tagged CVEs
- Databases2147% of sector-tagged CVEs
- Mobile Apps1686% of sector-tagged CVEs
- Hardware Firmware1666% of sector-tagged CVEs
- ICS / OT / IoT1646% of sector-tagged CVEs
- 7 smaller sectors434
- Not yet classified98
Which weakness, where
The top weakness classes against the vendors and the sectors that carried them.
The lighter the cell, the more CVEs. Point at one to read it.
| By vendor | 79XSS | 787Out-of-bounds Write | 20Improper Input Validation | 89SQL Injection | 416Use After Free | 476NULL Pointer Dereference | 125Out-of-bounds Read | 352CSRF | 22Path Traversal | 200Information Exposure |
|---|---|---|---|---|---|---|---|---|---|---|
| Oracle | 1 | 1 | 1 | 1 | 2 | 1 | 2 | 1 | 1 | |
| Oracle Corp. | 1 | 1 | 1 | |||||||
| Oracle Corporation | 1 | 1 | ||||||||
| Ао «ивк» | 2 | 8 | 1 | 1 | 1 | 1 | 5 | 1 | ||
| Debian | 3 | 13 | 2 | 2 | 5 | 5 | 11 | 2 | 2 | |
| Сообщество Свободного Программного Обеспечения | 3 | 15 | 1 | 2 | 8 | 5 | 13 | 1 | 1 | |
| Netapp | 1 | 2 | 2 | 1 | 1 | |||||
| Microsoft | 1 | 2 | 2 | |||||||
| Packagist | 29 | 1 | 4 | 1 | 5 | 1 | 1 | |||
| Microsoft Corp | 1 | 2 | 1 | 2 | ||||||
| Reolink | 2 | 61 | ||||||||
| Bentley | 34 | 19 | 23 |