January 2023
2,619 CVEs published, −8% on December 2022 and +19% on January 2022. CISA added 5 to KEV.
2023 month by month
| Year | Jan | Feb | Mar | Apr | May | Jun | Jul | Aug | Sep | Oct | Nov | Dec | Year total |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 2023 | January 2023: 2,619 CVEs5 added to CISA KEV | February 2023: 2,562 CVEs14 added to CISA KEV | March 2023: no snapshot | April 2023: 2,356 CVEs17 added to CISA KEV | May 2023: 2,766 CVEs19 added to CISA KEV | June 2023: 2,448 CVEs24 added to CISA KEV | July 2023: 2,380 CVEs16 added to CISA KEV | August 2023: 2,549 CVEs8 added to CISA KEV | September 2023: 2,863 CVEs19 added to CISA KEV | October 2023: 2,764 CVEs18 added to CISA KEV | November 2023: 2,560 CVEs18 added to CISA KEV | December 2023: 2,769 CVEs11 added to CISA KEV | 28,63611 of 12 months11/12 |
- Critical
- 33814% of the 2,359 with a CVSS score
- Added to CISA KEV
- 57 of this month's CVEs are in KEV, listed a median 22 days after publication
- Vendors
- 1,3465,964 products
- Top weakness
- XSSCWE-79 · 268 CVEs
Who drove it
Vendors by distinct CVEs this month, with how many of those CVEs are now in CISA KEV and how far each moved in the ranking.
- 1UnknownWelcart E-commerce, Letsrecover, Wp Rss By Publishers18615nonenew
- 2GoogleAndroid, Chrome, Google Chrome1120nonenew
- 3MicrosoftWindows 11 Version 22h2, Windows 11 22h2, Windows 11 Version 21h210901new
- 4Сообщество Свободного Программного ОбеспеченияDebian Gnu/linux, Linux, Vim102101new
- 5InsteonHub, Hub Firmware, Insteon Hub Firmware8280nonenew
- 6OracleMySQL Server, E-business Suite, MySQL8212new
- 7MavenOrg.jenkins-ci.plugins:jira-steps, Io.jenkins.plugins:macstadium-orka, Org.jenkins-ci.plugins:testquality-updater7815nonenew
- 8Ао "нппкт"Осон Основа Оnyx7661new
- 9Ооо «русбитех-астра»Astra Linux Special Edition, Astra Linux Common Edition, Astra Linux Special Edition Для «эльбрус»6661new
- 10PackagistThorsten/phpmyfaq, Cakephp/cakephp, Froxlor/froxlor656nonenew
- 11Pdf-xchangePdf-xchange Editor650nonenew
- 12Red HatRed Hat Enterprise Linux, Red Hat Software Collections, Red Hat Openstack Platform658nonenew
- 13SirettaQuartz-gold, Quartz-gold Firmware6443nonenew
- 14Ооо «ред Софт»Ред Ос5871new
- 15Ао «ивк»Альт 8 Сп, Альт Сп 10, Альт Рабочая Станция К5631new
- 16npmPapaparse, Serve-lite, @builder.io/qwik472nonenew
- 17Unisoc (Shanghai) Technologies Co., Ltd.Sc9863a/sc9832e/sc7731e/t610/t310/t606/t760/t610/t618/t606/t612/t616/t760/t770/t820/s8000390nonenew
- 18JenkinsJenkins Jira Pipeline Steps Plugin, Jira Pipeline Steps, Jenkins Orka By Macstadium Plugin387nonenew
- 19PyPIPyload-ng, Apache-superset, Modoboa383nonenew
- 20GoGithub.com/usememos/memos, Github.com/kubeoperator/kubepi, Www.velocidex.com/golang/velociraptor332nonenew
- 21AdobeAcrobat Reader Dc, Acrobat, Acrobat Dc3101new
- 22Lenovo Group LimitedSR645, SR665, SR635310nonenew
- 23QualcommQCA6574AU Firmware, WSA8815 Firmware, QCA6696 Firmware302nonenew
- 24Qualcomm, Inc.Snapdragon302nonenew
- 25Amd3rd Gen Epyc, Epyc 75f3 Firmware, Epyc 7003 Firmware280nonenew
Severity
How this month's CVEs score on CVSS; 260 have no score yet. Severity is not exploitation.
- Critical338
- High799
- Medium1,094
- Low128
New in the top 100
Not in the top 100 in any of the 24 months before.
What kind of weakness
Weakness classes (CWE) by distinct CVEs, with how far each moved in the ranking.
- CWE-79XSS268
- CWE-89SQL Injection227
- CWE-787Out-of-bounds Write166
- CWE-120Buffer Overflow99
- CWE-12198
- CWE-125Out-of-bounds Read91
- CWE-22Path Traversal87
- CWE-78OS Command Injection67
- CWE-20Improper Input Validation65
- CWE-284Improper Access Control51
- CWE-416Use After Free51
- CWE-862Missing Authorization51
- CWE-200Information Exposure45
- CWE-269Improper Privilege Mgmt41
- CWE-352CSRF39
- CWE-287Improper Authentication38
- CWE-77Command Injection37
- CWE-122Heap Buffer Overflow36
- CWE-190Integer Overflow30
- CWE-400Resource Consumption27
Where it landed
The month's CVEs by the sector of the software they affect. A CVE that touches several sectors counts in each.
- Web & CMS Plugins45014% of sector-tagged CVEs
- OSS Libraries40313% of sector-tagged CVEs
- Operating Systems35711% of sector-tagged CVEs
- Hardware Firmware2588% of sector-tagged CVEs
- ICS / OT / IoT2538% of sector-tagged CVEs
- Enterprise Software2498% of sector-tagged CVEs
- Networking Infrastructure2087% of sector-tagged CVEs
- Consumer Software1404% of sector-tagged CVEs
- Mobile Apps1224% of sector-tagged CVEs
- 6 smaller sectors436
- Not yet classified263
Which weakness, where
The top weakness classes against the vendors and the sectors that carried them.
The lighter the cell, the more CVEs. Point at one to read it.
| By vendor | 79XSS | 89SQL Injection | 787Out-of-bounds Write | 120Buffer Overflow | 121 | 125Out-of-bounds Read | 22Path Traversal | 78OS Command Injection | 20Improper Input Validation | 284Improper Access Control |
|---|---|---|---|---|---|---|---|---|---|---|
| 1 | 19 | 1 | 1 | 9 | 3 | |||||
| Microsoft Corp | 1 | 1 | 1 | 6 | 7 | 4 | ||||
| Microsoft | 1 | 6 | 1 | 6 | 4 | |||||
| Сообщество Свободного Программного Обеспечения | 3 | 9 | 6 | 1 | 5 | 1 | 1 | |||
| Insteon | 23 | 1 | 81 | |||||||
| Oracle Corp. | 1 | 14 | ||||||||
| Maven | 3 | 2 | 1 | 7 | 1 | 3 | 1 | |||
| Ао «нппкт» | 1 | 8 | 1 | 4 | 1 | 2 | ||||
| Oracle | 14 | |||||||||
| Oracle Corporation | 14 | |||||||||
| Ооо «русбитех-астра» | 1 | 9 | 2 | 1 | 4 | 1 | ||||
| Packagist | 16 | 7 | 2 | 2 | 1 |