May 2022
2,205 CVEs published, +5% on April 2022 and +40% on May 2021. CISA added 83 to KEV.
2022 month by month
- Critical
- 40519% of the 2,177 with a CVSS score
- Added to CISA KEV
- 836 of this month's CVEs are in KEV, listed a median 72 days after publication
- Vendors
- 9734,590 products
- Top weakness
- XSSCWE-79 · 298 CVEs
Who drove it
Vendors by distinct CVEs this month, with how many of those CVEs are now in CISA KEV and how far each moved in the ranking.
- 1Сообщество Свободного Программного ОбеспеченияDebian Gnu/linux, Vim, Linux115101new
- 2UnknownVikbooking Hotel Booking Engine & Pms, Wpqa Builder Plugin, Adrotate – Ad Manager & Adsense Ads10516nonenew
- 3AdobeAcrobat Reader Dc, Acrobat, Acrobat Dc970nonenew
- 4ApplemacOS, Mac OS X, iPhone OS9272new
- 5GoogleAndroid, Tensorflow, Fuchsia882nonenew
- 6MavenOrg.jenkins-ci.plugins:autocomplete-parameter, Org.jenkins-ci.plugins:ssh, Org.jenkins-ci.plugins:mercurial778nonenew
- 7MicrosoftWindows Server Version 20h2, Windows Server 20h2 (Server Core Installation), Windows Server 20197632new
- 8DebianDebian Linux, Dpkg7381new
- 9Ооо «русбитех-астра»Astra Linux Special Edition, Astra Linux Special Edition Для «эльбрус», Astra Linux Common Edition7351new
- 10FedoraprojectFedora7111nonenew
- 11Ооо «ред Софт»Ред Ос, Ред База Данных6891new
- 12Ао "нппкт"Осон Основа Оnyx5461new
- 13Ао «ивк»Альт 8 Сп, Альт Сп 10505nonenew
- 14Red HatRed Hat Enterprise Linux, Enterprise Linux, Jboss Enterprise Application Platform497nonenew
- 15CiscoFirepower Threat Defense, Cisco Common Services Platform Collector, Common Services Platform Collector4831new
- 16F5BIG-IP Access Policy Manager, BIG-IP Application Security Manager, BIG-IP Advanced Firewall Manager4521new
- 17PyPITensorflow-gpu, Tensorflow, Tensorflow-cpu456nonenew
- 18GoGithub.com/hashicorp/go-getter/gcs/v2, Github.com/hashicorp/go-getter, Github.com/rancher/rancher446nonenew
- 19npmStrapi, @strapi/strapi, Convict445nonenew
- 20TotolinkN600R Firmware, A3100R Firmware, A7100RU Firmware4031nonenew
- 21IntelOptane Memory H20 With Solid State Storage, Optane Memory H20 With Solid State Storage Firmware, Optane Ssd 900p Firmware380nonenew
- 22IBMRobotic Process Automation, Guardium Data Encryption, Robotic Process Automation As A Service373nonenew
- 23NetappH700S Firmware, H300S Firmware, H410S Firmware375nonenew
- 24PackagistMoodle/moodle, Facturascripts/facturascripts, Microweber/microweber345nonenew
- 25Siemens7kg8500-0aa10-2aa0 Firmware, 7kg8500-0aa30-0aa0 Firmware, 7kg8500-0aa10-0aa0 Firmware333nonenew
Severity
How this month's CVEs score on CVSS; 28 have no score yet. Severity is not exploitation.
- Critical405
- High864
- Medium866
- Low42
New in the top 100
Not in the top 100 in any of the 24 months before.
What kind of weakness
Weakness classes (CWE) by distinct CVEs, with how far each moved in the ranking.
- CWE-79XSS298
- CWE-89SQL Injection256
- CWE-787Out-of-bounds Write161
- CWE-78OS Command Injection81
- CWE-20Improper Input Validation77
- CWE-125Out-of-bounds Read68
- CWE-416Use After Free65
- CWE-434Unrestricted File Upload49
- CWE-22Path Traversal45
- CWE-190Integer Overflow39
- CWE-120Buffer Overflow36
- CWE-352CSRF36
- CWE-287Improper Authentication33
- CWE-476NULL Pointer Dereference32
- CWE-862Missing Authorization30
- CWE-918SSRF28
- CWE-863Incorrect Authorization26
- CWE-400Resource Consumption25
- CWE-77Command Injection25
- CWE-200Information Exposure23
Where it landed
The month's CVEs by the sector of the software they affect. A CVE that touches several sectors counts in each.
- OSS Libraries41214% of sector-tagged CVEs
- Enterprise Software35112% of sector-tagged CVEs
- Web & CMS Plugins34212% of sector-tagged CVEs
- Operating Systems29310% of sector-tagged CVEs
- Networking Infrastructure2499% of sector-tagged CVEs
- Mobile Apps2027% of sector-tagged CVEs
- Hardware Firmware1766% of sector-tagged CVEs
- Consumer Software1616% of sector-tagged CVEs
- Security Products1455% of sector-tagged CVEs
- 6 smaller sectors362
- Not yet classified209
Which weakness, where
The top weakness classes against the vendors and the sectors that carried them.
The lighter the cell, the more CVEs. Point at one to read it.
| By vendor | 79XSS | 89SQL Injection | 787Out-of-bounds Write | 78OS Command Injection | 20Improper Input Validation | 125Out-of-bounds Read | 416Use After Free | 434Unrestricted File Upload | 22Path Traversal | 190Integer Overflow |
|---|---|---|---|---|---|---|---|---|---|---|
| Сообщество Свободного Программного Обеспечения | 1 | 19 | 1 | 4 | 15 | 12 | 1 | 3 | 4 | |
| Adobe | 1 | 30 | 1 | 28 | 32 | |||||
| Apple | 28 | 12 | 4 | 2 | ||||||
| 10 | 20 | 6 | 3 | 2 | 4 | |||||
| Maven | 15 | 2 | 1 | 5 | 1 | |||||
| Microsoft | ||||||||||
| Microsoft Corp | ||||||||||
| Debian | 2 | 1 | 14 | 1 | 4 | 8 | 7 | 3 | 2 | |
| Ооо «русбитех-астра» | 1 | 15 | 1 | 4 | 13 | 10 | 3 | 2 | ||
| Fedoraproject | 2 | 1 | 13 | 1 | 5 | 9 | 4 | 1 | ||
| Ооо «ред Софт» | 1 | 2 | 14 | 1 | 4 | 7 | 5 | 2 | 1 | |
| Ао «нппкт» | 1 | 1 | 11 | 1 | 4 | 4 | 7 | 3 | 1 |