April 2023
2,356 CVEs published, +12% on April 2022. CISA added 17 to KEV.
2023 month by month
| Year | Jan | Feb | Mar | Apr | May | Jun | Jul | Aug | Sep | Oct | Nov | Dec | Year total |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 2023 | January 2023: 2,619 CVEs5 added to CISA KEV | February 2023: 2,562 CVEs14 added to CISA KEV | March 2023: no snapshot | April 2023: 2,356 CVEs17 added to CISA KEV | May 2023: 2,766 CVEs19 added to CISA KEV | June 2023: 2,448 CVEs24 added to CISA KEV | July 2023: 2,380 CVEs16 added to CISA KEV | August 2023: 2,549 CVEs8 added to CISA KEV | September 2023: 2,863 CVEs19 added to CISA KEV | October 2023: 2,764 CVEs18 added to CISA KEV | November 2023: 2,560 CVEs18 added to CISA KEV | December 2023: 2,769 CVEs11 added to CISA KEV | 28,63611 of 12 months11/12 |
- Critical
- 28412% of the 2,307 with a CVSS score
- Added to CISA KEV
- 1717 of this month's CVEs are in KEV, listed a median 36 days after publication
- Vendors
- 1,0884,249 products
- Top weakness
- XSSCWE-79 · 412 CVEs
Who drove it
Vendors by distinct CVEs this month, with how many of those CVEs are now in CISA KEV and how far each moved in the ranking.
- 1MicrosoftWindows Server 2022, Windows Server 2022 (Server Core Installation), Windows Server 2019 (Server Core Installation)11244new
- 2Сообщество Свободного Программного ОбеспеченияDebian Gnu/linux, Linux, Xwiki Platform10215nonenew
- 3GoogleAndroid, Google Chrome, Chrome10122new
- 4SourcecodesterOnline Computer and Laptop Store, Vehicle Service Management System, Online Payroll System980nonenew
- 5MavenOrg.xwiki.platform:xwiki-platform-oldcore, Tech.powerjob:powerjob, Org.xwiki.platform:xwiki-platform-web-templates9440nonenew
- 6OracleMySQL Server, Vm VirtualBox, Graalvm Enterprise Edition920nonenew
- 7PackagistPimcore/pimcore, Thorsten/phpmyfaq, Concrete5/concrete5918nonenew
- 8Ао "нппкт"Осон Основа Оnyx8123new
- 9Ооо «русбитех-астра»Astra Linux Special Edition, Astra Linux Special Edition Для «эльбрус», Astra Linux Common Edition7713new
- 10Ао «ивк»Альт 8 Сп, Альт Сп 10652nonenew
- 11AdobeSubstance 3d Stager, Acrobat Dc, Acrobat Reader571nonenew
- 12FedoraprojectFedora, Extra Packages For Enterprise Linux5412new
- 13UnknownW4 Post List, Simple Giveaways, Gallery By Bestwebsoft542nonenew
- 14Ооо «ред Софт»Ред Ос545nonenew
- 15DebianDebian Linux4812new
- 16LinuxLinux Kernel430nonenew
- 17CiscoCisco Small Business RV Series Router Firmware, RV320 Firmware, Cisco Small Business RV3254201new
- 18Oretnom23Online Computer and Laptop Store, Service Provider Management System, Ac Repair and Services System400nonenew
- 19NvidiaVirtual Gpu, Nvidia Dgx Servers, Studio R530380nonenew
- 20XwikiXwiki, Xwiki-platform, Xwiki-commons3827nonenew
- 21CampcodesAdvanced Online Voting System, Coffee Shop Pos System, Online Thesis Archiving System370nonenew
- 22npmVM2, @strapi/plugin-users-permissions, @openzeppelin/contracts-upgradeable379nonenew
- 23Red HatRed Hat Enterprise Linux, Enterprise Linux, Openshift Serverless3721new
- 24PyPIApache-superset, Modoboa, Wagtail3461new
- 25Ао «нтц Ит Роса»Rosa Virtualization 3.0, Роса Кобальт, Роса Хром340nonenew
Severity
How this month's CVEs score on CVSS; 49 have no score yet. Severity is not exploitation.
- Critical284
- High711
- Medium1,184
- Low128
New in the top 100
Not in the top 100 in any of the 24 months before.
What kind of weakness
Weakness classes (CWE) by distinct CVEs, with how far each moved in the ranking.
- CWE-79XSS412
- CWE-89SQL Injection183
- CWE-787Out-of-bounds Write174
- CWE-125Out-of-bounds Read85
- CWE-20Improper Input Validation51
- CWE-22Path Traversal51
- CWE-416Use After Free48
- CWE-77Command Injection45
- CWE-400Resource Consumption44
- CWE-434Unrestricted File Upload43
- CWE-352CSRF42
- CWE-78OS Command Injection41
- CWE-284Improper Access Control37
- CWE-190Integer Overflow36
- CWE-269Improper Privilege Mgmt35
- CWE-287Improper Authentication35
- CWE-863Incorrect Authorization35
- CWE-120Buffer Overflow33
- CWE-94Code Injection33
- CWE-476NULL Pointer Dereference32
Where it landed
The month's CVEs by the sector of the software they affect. A CVE that touches several sectors counts in each.
- Web & CMS Plugins62019% of sector-tagged CVEs
- OSS Libraries44814% of sector-tagged CVEs
- Enterprise Software40713% of sector-tagged CVEs
- Operating Systems37311% of sector-tagged CVEs
- Networking Infrastructure2829% of sector-tagged CVEs
- Hardware Firmware1806% of sector-tagged CVEs
- Mobile Apps1264% of sector-tagged CVEs
- 8 smaller sectors640
- Not yet classified179
Which weakness, where
The top weakness classes against the vendors and the sectors that carried them.
The lighter the cell, the more CVEs. Point at one to read it.
| By vendor | 79XSS | 89SQL Injection | 787Out-of-bounds Write | 125Out-of-bounds Read | 20Improper Input Validation | 22Path Traversal | 416Use After Free | 77Command Injection | 400Resource Consumption | 434Unrestricted File Upload |
|---|---|---|---|---|---|---|---|---|---|---|
| Microsoft Corp | 3 | 4 | 4 | 8 | 1 | 9 | 2 | |||
| Сообщество Свободного Программного Обеспечения | 3 | 1 | 12 | 4 | 3 | 3 | 10 | 2 | 3 | |
| Microsoft | 3 | 1 | 4 | 8 | 9 | 2 | ||||
| 22 | 10 | 1 | 1 | 6 | 1 | |||||
| Sourcecodester | 23 | 66 | 1 | 3 | ||||||
| Maven | 15 | 3 | 1 | 1 | 1 | 2 | 1 | |||
| Oracle Corp. | 3 | |||||||||
| Oracle | 3 | |||||||||
| Oracle Corporation | 3 | |||||||||
| Packagist | 44 | 7 | 3 | 3 | 1 | 4 | ||||
| Ао «нппкт» | 10 | 4 | 2 | 2 | 13 | 4 | ||||
| Ооо «русбитех-астра» | 15 | 3 | 1 | 1 | 14 | 1 |