May 2023
2,766 CVEs published, +17% on April 2023 and +25% on May 2022. CISA added 19 to KEV.
2023 month by month
| Year | Jan | Feb | Mar | Apr | May | Jun | Jul | Aug | Sep | Oct | Nov | Dec | Year total |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 2023 | January 2023: 2,619 CVEs5 added to CISA KEV | February 2023: 2,562 CVEs14 added to CISA KEV | March 2023: no snapshot | April 2023: 2,356 CVEs17 added to CISA KEV | May 2023: 2,766 CVEs19 added to CISA KEV | June 2023: 2,448 CVEs24 added to CISA KEV | July 2023: 2,380 CVEs16 added to CISA KEV | August 2023: 2,549 CVEs8 added to CISA KEV | September 2023: 2,863 CVEs19 added to CISA KEV | October 2023: 2,764 CVEs18 added to CISA KEV | November 2023: 2,560 CVEs18 added to CISA KEV | December 2023: 2,769 CVEs11 added to CISA KEV | 28,63611 of 12 months11/12 |
- Critical
- 25911% of the 2,438 with a CVSS score
- Added to CISA KEV
- 198 of this month's CVEs are in KEV, listed a median 13.5 days after publication
- Vendors
- 1,3845,903 products
- Top weakness
- XSSCWE-79 · 462 CVEs
Who drove it
Vendors by distinct CVEs this month, with how many of those CVEs are now in CISA KEV and how far each moved in the ranking.
- 1Сообщество Свободного Программного ОбеспеченияDebian Gnu/linux, Linux, Openemr14911nonenew
- 2GoogleAndroid, Google Chrome, Chrome1391nonenew
- 3MavenCom.liferay.portal:release.portal.bom, Org.apache.inlong:manager-service, Org.apache.inlong:manager-pojo99152new
- 4IntelServer System M50CYP1UR212 Firmware, Server System M50CYP2UR208 Firmware, Server System D50TNP1MHCRAC Firmware940nonenew
- 5Ооо «ред Софт»Ред Ос9251new
- 6Ао "нппкт"Осон Основа Оnyx883nonenew
- 7UnknownAI Chatbot, Clock In Portal- Staff & Attendance Management, Product Catalog Feed By Pixelyoursite857nonenew
- 8Ооо «русбитех-астра»Astra Linux Special Edition, Astra Linux Special Edition Для «эльбрус», Astra Linux Common Edition801nonenew
- 9ApplemacOS, iPadOS, iPhone OS714nonenew
- 10Unisoc (Shanghai) Technologies Co., Ltd.Sc9863a/sc9832e/sc7731e/t610/t310/t606/t760/t610/t618/t606/t612/t616/t760/t770/t820/s8000660nonenew
- 11MicrosoftWindows 11 21h2, Windows 10 20h2, Windows 10 21h26132new
- 12SourcecodesterLost and Found Information System, Online Exam System, Online Computer and Laptop Store570nonenew
- 13PackagistPimcore/pimcore, Craftcms/cms, Thorsten/phpmyfaq513nonenew
- 14DebianDebian Linux480nonenew
- 15FedoraprojectFedora, Extra Packages For Enterprise Linux452nonenew
- 16Red HatRed Hat Enterprise Linux, Enterprise Linux, Red Hat Jboss Core Services385nonenew
- 17Ао «ивк»Альт 8 Сп, Альт Сп 10381nonenew
- 18JenkinsJenkins Saml Single Sign On(Sso) Plugin, Saml Single Sign On, Code Dx360nonenew
- 19GoGithub.com/kyverno/kyverno, Github.com/sigstore/rekor, Github.com/pydio/cells354nonenew
- 20IBMMq, Infosphere Information Server, Mq Appliance321nonenew
- 21SamsungAndroid, Samsung Blockchain Keystore, Galaxy Store3201new
- 22ApacheInlong, Streampark, Openmeetings31101new
- 23Apache Software FoundationApache Inlong, Inlong, Apache Streampark (Incubating)31101new
- 24PyPIVyper, Mlflow, Matrix-synapse315nonenew
- 25Samsung MobileSamsung Mobile Devices, Samsung Blockchain Keystore, Galaxy Store3101new
Severity
How this month's CVEs score on CVSS; 328 have no score yet. Severity is not exploitation.
- Critical259
- High796
- Medium1,274
- Low109
New in the top 100
Not in the top 100 in any of the 24 months before.
What kind of weakness
Weakness classes (CWE) by distinct CVEs, with how far each moved in the ranking.
- CWE-79XSS462
- CWE-787Out-of-bounds Write154
- CWE-89SQL Injection144
- CWE-352CSRF143
- CWE-20Improper Input Validation89
- CWE-22Path Traversal74
- CWE-120Buffer Overflow69
- CWE-125Out-of-bounds Read63
- CWE-77Command Injection55
- CWE-862Missing Authorization53
- CWE-863Incorrect Authorization51
- CWE-284Improper Access Control45
- CWE-78OS Command Injection41
- CWE-416Use After Free40
- CWE-434Unrestricted File Upload39
- CWE-276Incorrect Default Permissions35
- CWE-287Improper Authentication34
- CWE-400Resource Consumption34
- CWE-200Information Exposure29
- CWE-732Incorrect Permissions28
Where it landed
The month's CVEs by the sector of the software they affect. A CVE that touches several sectors counts in each.
- Web & CMS Plugins59117% of sector-tagged CVEs
- OSS Libraries38111% of sector-tagged CVEs
- Enterprise Software34010% of sector-tagged CVEs
- Operating Systems33210% of sector-tagged CVEs
- Hardware Firmware32710% of sector-tagged CVEs
- Mobile Apps2728% of sector-tagged CVEs
- Networking Infrastructure1815% of sector-tagged CVEs
- ICS / OT / IoT1545% of sector-tagged CVEs
- 7 smaller sectors516
- Not yet classified287
Which weakness, where
The top weakness classes against the vendors and the sectors that carried them.
The lighter the cell, the more CVEs. Point at one to read it.
| By vendor | 79XSS | 787Out-of-bounds Write | 89SQL Injection | 352CSRF | 20Improper Input Validation | 22Path Traversal | 120Buffer Overflow | 125Out-of-bounds Read | 77Command Injection | 862Missing Authorization |
|---|---|---|---|---|---|---|---|---|---|---|
| Сообщество Свободного Программного Обеспечения | 5 | 11 | 27 | 4 | 1 | 10 | 4 | 2 | ||
| 33 | 12 | 8 | 11 | 27 | ||||||
| Maven | 20 | 2 | 1 | 11 | 3 | 3 | 1 | 2 | ||
| Intel | 7 | 13 | 1 | 2 | 3 | |||||
| Ооо «ред Софт» | 6 | 26 | 2 | 1 | 1 | 6 | 3 | 1 | ||
| Ао «нппкт» | 7 | 1 | 1 | 3 | 1 | 1 | ||||
| Ооо «русбитех-астра» | 7 | 1 | 2 | 7 | 1 | 1 | ||||
| Apple | 8 | 2 | 8 | 6 | 1 | |||||
| Unisoc (Shanghai) Technologies Co., Ltd. | 22 | 8 | 3 | 26 | ||||||
| Microsoft Corp | 1 | 2 | 2 | |||||||
| Sourcecodester | 16 | 39 | ||||||||
| Microsoft | 2 | 2 |