June 2023
2,448 CVEs published, −11% on May 2023 and +6% on June 2022. CISA added 24 to KEV.
2023 month by month
| Year | Jan | Feb | Mar | Apr | May | Jun | Jul | Aug | Sep | Oct | Nov | Dec | Year total |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 2023 | January 2023: 2,619 CVEs5 added to CISA KEV | February 2023: 2,562 CVEs14 added to CISA KEV | March 2023: no snapshot | April 2023: 2,356 CVEs17 added to CISA KEV | May 2023: 2,766 CVEs19 added to CISA KEV | June 2023: 2,448 CVEs24 added to CISA KEV | July 2023: 2,380 CVEs16 added to CISA KEV | August 2023: 2,549 CVEs8 added to CISA KEV | September 2023: 2,863 CVEs19 added to CISA KEV | October 2023: 2,764 CVEs18 added to CISA KEV | November 2023: 2,560 CVEs18 added to CISA KEV | December 2023: 2,769 CVEs11 added to CISA KEV | 28,63611 of 12 months11/12 |
- Critical
- 29712% of the 2,408 with a CVSS score
- Added to CISA KEV
- 2414 of this month's CVEs are in KEV, listed a median 7 days after publication
- Vendors
- 1,3217,481 products
- Top weakness
- XSSCWE-79 · 363 CVEs
Who drove it
Vendors by distinct CVEs this month, with how many of those CVEs are now in CISA KEV and how far each moved in the ranking.
- 1Сообщество Свободного Программного ОбеспеченияDebian Gnu/linux, Linux, Xwiki Platform171211new
- 2GoogleAndroid, Google Chrome, Chrome16942new
- 3Ооо «русбитех-астра»Astra Linux Special Edition, Astra Linux Special Edition Для «эльбрус»13067new
- 4Ао "нппкт"Осон Основа Оnyx12952new
- 5MicrosoftWindows Server 2022, Windows Server 2022 (Server Core Installation), Windows Server 2019 (Server Core Installation)9743new
- 6Ао «ивк»Альт 8 Сп, Альт Сп 109341new
- 7MozillaFirefox, Firefox Esr, Thunderbird878nonenew
- 8MavenOrg.jeecgframework.boot:jeecg-boot-parent, Io.grpc:grpc-protobuf, Org.xerial.snappy:snappy-java8625nonenew
- 9Ооо «ред Софт»Ред Ос867nonenew
- 10ApplemacOS, iPhone OS, iPadOS7347new
- 11Red HatRed Hat Enterprise Linux, Enterprise Linux, Red Hat Enterprise Linux 96532new
- 12UnknownKivicare, Qubot, Wpbrutalai653nonenew
- 13PackagistMagento/community-edition, Magento/project-community-edition, Nilsteampassnet/teampass569nonenew
- 14GoGithub.com/grafana/grafana, Github.com/rancher/rancher, Github.com/cosmos/cosmos-sdk424nonenew
- 15CanonicalUbuntu, Landscape, Ubuntu Linux401nonenew
- 16DellCpg Bios, Inspiron 15 5510 Firmware, Latitude 5530 Firmware380nonenew
- 17Ао «нтц Ит Роса»Rosa Virtualization 3.0, Роса Хром, Роса Кобальт3751new
- 18DebianDebian Linux3402new
- 19HuaweiEmui, Harmonyos, Bisheng-wnm343nonenew
- 20LinuxLinux Kernel, Kernel3401new
- 21FedoraprojectFedora, Extra Packages For Enterprise Linux3342new
- 22TrendmicroApex One, Apex Central, Apex One As A Service332nonenew
- 23Trend Micro, Inc.Trend Micro Apex One, Trend Micro Apex Central, Trend Micro Moibile Security For Enterprise332nonenew
- 24HPZhan 66 Pro 13 G2 Firmware, Elitebook 840 G6 Firmware, Zbook Firefly 14 G7 Firmware325nonenew
- 25QualcommWCD9380 Firmware, WSA8810 Firmware, WCN685X-5 Firmware320nonenew
Severity
How this month's CVEs score on CVSS; 40 have no score yet. Severity is not exploitation.
- Critical297
- High872
- Medium1,130
- Low109
New in the top 100
Not in the top 100 in any of the 24 months before.
What kind of weakness
Weakness classes (CWE) by distinct CVEs, with how far each moved in the ranking.
- CWE-79XSS363
- CWE-787Out-of-bounds Write161
- CWE-125Out-of-bounds Read112
- CWE-862Missing Authorization109
- CWE-89SQL Injection102
- CWE-20Improper Input Validation67
- CWE-416Use After Free61
- CWE-863Incorrect Authorization61
- CWE-434Unrestricted File Upload59
- CWE-22Path Traversal57
- CWE-352CSRF49
- CWE-77Command Injection47
- CWE-120Buffer Overflow46
- CWE-200Information Exposure40
- CWE-94Code Injection39
- CWE-78OS Command Injection37
- CWE-400Resource Consumption31
- CWE-287Improper Authentication29
- CWE-770Allocation Without Limits29
- CWE-276Incorrect Default Permissions25
Where it landed
The month's CVEs by the sector of the software they affect. A CVE that touches several sectors counts in each.
- Web & CMS Plugins66320% of sector-tagged CVEs
- Operating Systems44213% of sector-tagged CVEs
- OSS Libraries41312% of sector-tagged CVEs
- Enterprise Software33210% of sector-tagged CVEs
- Mobile Apps2979% of sector-tagged CVEs
- Hardware Firmware1705% of sector-tagged CVEs
- Security Products1595% of sector-tagged CVEs
- Networking Infrastructure1434% of sector-tagged CVEs
- Consumer Software1434% of sector-tagged CVEs
- ICS / OT / IoT1424% of sector-tagged CVEs
- Not yet classified169
Which weakness, where
The top weakness classes against the vendors and the sectors that carried them.
The lighter the cell, the more CVEs. Point at one to read it.
| By vendor | 79XSS | 787Out-of-bounds Write | 125Out-of-bounds Read | 862Missing Authorization | 89SQL Injection | 20Improper Input Validation | 416Use After Free | 863Incorrect Authorization | 434Unrestricted File Upload | 22Path Traversal |
|---|---|---|---|---|---|---|---|---|---|---|
| Сообщество Свободного Программного Обеспечения | 12 | 19 | 4 | 2 | 5 | 27 | 4 | 5 | ||
| 25 | 49 | 25 | 6 | 11 | 1 | |||||
| Ооо «русбитех-астра» | 23 | 5 | 2 | 24 | 2 | 1 | ||||
| Ао «нппкт» | 1 | 23 | 3 | 2 | 24 | 2 | 1 | |||
| Microsoft Corp | 5 | 5 | 6 | 9 | ||||||
| Microsoft | 5 | 5 | 6 | 7 | ||||||
| Ао «ивк» | 18 | 4 | 2 | 13 | 1 | 1 | ||||
| Maven | 18 | 11 | 2 | 4 | 1 | 1 | 2 | |||
| Mozilla | 16 | 2 | 5 | 3 | 2 | |||||
| Ооо «ред Софт» | 2 | 12 | 2 | 3 | 13 | 1 | 2 | |||
| Mozilla Corp. | 16 | 2 | 6 | 3 | 2 | |||||
| Apple | 5 | 17 | 6 | 1 |