December 2022
2,862 CVEs published, +34% on November 2022 and +14% on December 2021. CISA added 9 to KEV.
2022 month by month
- Critical
- 30013% of the 2,364 with a CVSS score
- Added to CISA KEV
- 94 of this month's CVEs are in KEV, listed a median 1.5 days after publication
- Vendors
- 1,1004,630 products
- Top weakness
- XSSCWE-79 · 342 CVEs
Who drove it
Vendors by distinct CVEs this month, with how many of those CVEs are now in CISA KEV and how far each moved in the ranking.
- 1GoogleAndroid, Google Chrome, Chrome27031new
- 2Ао "нппкт"Осон Основа Оnyx243253new
- 3Сообщество Свободного Программного ОбеспеченияDebian Gnu/linux, Linux, Xrdp21026nonenew
- 4MozillaFirefox, Thunderbird, Firefox Esr175182new
- 5Ооо «русбитех-астра»Astra Linux Special Edition, Astra Linux Special Edition Для «эльбрус», Astra Linux Common Edition169222new
- 6Ао «ивк»Альт 8 Сп, Альт Сп 10144212new
- 7GoGithub.com/usememos/memos, Helm.sh/helm/v3, Github.com/alist-org/alist/v312615nonenew
- 8Ооо «ред Софт»Ред Ос122162new
- 9UnknownContest Gallery Pro, Contest Gallery, Popup Manager10310nonenew
- 10Red HatRed Hat Enterprise Linux, Red Hat Satellite, Openshift977nonenew
- 11TendaF1203 Firmware, W30E Firmware, A15 Firmware9121nonenew
- 12DebianDebian Linux7816nonenew
- 13Фссп РоссииОс Тд Аис Фссп России77122new
- 14Ао «концерн Вниинс»Ос Он «стрелец»74102new
- 15MavenCn.hutool:hutool-json, Net.mingsoft:ms-mcms, Io.apiman:apiman-manager-api-rest-impl568nonenew
- 16MicrosoftWindows 10 Version 1809, Windows 11, Windows 10 Version 22h25502new
- 17CanonicalUbuntu546nonenew
- 18Novell Inc.Opensuse Leap, Suse Linux Enterprise Server, Suse Linux Enterprise Server For Sap Applications546nonenew
- 19PackagistFeehi/feehicms, Typo3/cms, Typo3/cms-core544nonenew
- 20ApplemacOS, iPhone OS, iPadOS5131new
- 21Unisoc (Shanghai) Technologies Co., Ltd.Sc9863a/sc9832e/sc7731e/t610/t310/t606/t760/t610/t618/t606/t612/t616/t760/t770/t820/s8000, Sc9863a/sc9832e/sc7731e/t610/t310/t606/t760/t610/t618/t606/t612/t616/t760/t770/t820/s8001, Sc9863a/sc9832e/sc7731e/t610/t310/t606/t760/t610/t618/t606/t612/t616/t760/t770/t820/s8002490nonenew
- 22UnspecifiedMovie Ticket Booking System, House Rental System, Wp-ban490nonenew
- 23npmJsonwebtoken, Nadesiko3, @cubejs-backend/api-gateway487nonenew
- 24UsememosUsememos/memos, Memos473nonenew
- 25SiemensTeamcenter Visualization V13.3, Teamcenter Visualization V13.2, Teamcenter Visualization443nonenew
Severity
How this month's CVEs score on CVSS; 498 have no score yet. Severity is not exploitation.
- Critical300
- High794
- Medium1,074
- Low196
New in the top 100
Not in the top 100 in any of the 24 months before.
What kind of weakness
Weakness classes (CWE) by distinct CVEs, with how far each moved in the ranking.
- CWE-79XSS342
- CWE-787Out-of-bounds Write252
- CWE-125Out-of-bounds Read111
- CWE-70795
- CWE-89SQL Injection86
- CWE-120Buffer Overflow82
- CWE-22Path Traversal80
- CWE-416Use After Free58
- CWE-78OS Command Injection57
- CWE-352CSRF56
- CWE-20Improper Input Validation53
- CWE-284Improper Access Control53
- CWE-862Missing Authorization51
- CWE-287Improper Authentication49
- CWE-200Information Exposure45
- CWE-863Incorrect Authorization42
- CWE-476NULL Pointer Dereference36
- CWE-400Resource Consumption33
- CWE-434Unrestricted File Upload33
- CWE-269Improper Privilege Mgmt31
Where it landed
The month's CVEs by the sector of the software they affect. A CVE that touches several sectors counts in each.
- OSS Libraries51015% of sector-tagged CVEs
- Operating Systems45213% of sector-tagged CVEs
- Mobile Apps36811% of sector-tagged CVEs
- Web & CMS Plugins35010% of sector-tagged CVEs
- Enterprise Software34610% of sector-tagged CVEs
- Consumer Software3049% of sector-tagged CVEs
- Networking Infrastructure2638% of sector-tagged CVEs
- Hardware Firmware1625% of sector-tagged CVEs
- 7 smaller sectors413
- Not yet classified246
Which weakness, where
The top weakness classes against the vendors and the sectors that carried them.
The lighter the cell, the more CVEs. Point at one to read it.
| By vendor | 79XSS | 787Out-of-bounds Write | 125Out-of-bounds Read | 707 | 89SQL Injection | 120Buffer Overflow | 22Path Traversal | 416Use After Free | 78OS Command Injection | 352CSRF |
|---|---|---|---|---|---|---|---|---|---|---|
| 62 | 49 | 3 | 2 | 3 | 19 | |||||
| Ао «нппкт» | 13 | 41 | 18 | 1 | 30 | 2 | ||||
| Сообщество Свободного Программного Обеспечения | 6 | 36 | 23 | 4 | 21 | 1 | ||||
| Mozilla | 10 | 29 | 5 | 1 | 20 | |||||
| Ооо «русбитех-астра» | 5 | 32 | 18 | 4 | 1 | 23 | 1 | |||
| Mozilla Corp. | 10 | 29 | 5 | 1 | 20 | |||||
| Ао «ивк» | 7 | 23 | 12 | 4 | 20 | |||||
| Go | 17 | 1 | 1 | 1 | 12 | 1 | 8 | |||
| Ооо «ред Софт» | 7 | 15 | 10 | 4 | 15 | |||||
| Tenda | 46 | 31 | 6 | 5 | ||||||
| Red Hat Inc. | 5 | 13 | 6 | 1 | 1 | 8 | 2 | |||
| Debian | 6 | 14 | 13 | 4 | 3 | 2 |