August 2023
2,549 CVEs published, +7% on July 2023 and +5% on August 2022. CISA added 8 to KEV.
2023 month by month
| Year | Jan | Feb | Mar | Apr | May | Jun | Jul | Aug | Sep | Oct | Nov | Dec | Year total |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 2023 | January 2023: 2,619 CVEs5 added to CISA KEV | February 2023: 2,562 CVEs14 added to CISA KEV | March 2023: no snapshot | April 2023: 2,356 CVEs17 added to CISA KEV | May 2023: 2,766 CVEs19 added to CISA KEV | June 2023: 2,448 CVEs24 added to CISA KEV | July 2023: 2,380 CVEs16 added to CISA KEV | August 2023: 2,549 CVEs8 added to CISA KEV | September 2023: 2,863 CVEs19 added to CISA KEV | October 2023: 2,764 CVEs18 added to CISA KEV | November 2023: 2,560 CVEs18 added to CISA KEV | December 2023: 2,769 CVEs11 added to CISA KEV | 28,63611 of 12 months11/12 |
- Critical
- 35214% of the 2,490 with a CVSS score
- Added to CISA KEV
- 812 of this month's CVEs are in KEV, listed a median 88 days after publication
- Vendors
- 1,2768,146 products
- Top weakness
- XSSCWE-79 · 410 CVEs
Who drove it
Vendors by distinct CVEs this month, with how many of those CVEs are now in CISA KEV and how far each moved in the ranking.
- 1Сообщество Свободного Программного ОбеспеченияDebian Gnu/linux, Linux, Poppler20123nonenew
- 2Ооо «русбитех-астра»Astra Linux Special Edition, Astra Linux Special Edition Для «эльбрус», Astra Linux Common Edition15310nonenew
- 3GoogleAndroid, Chrome, Google Chrome1444nonenew
- 4Ао "нппкт"Осон Основа Оnyx1367nonenew
- 5DebianDebian Linux986nonenew
- 6IntelRaid Web Console 3 (RWC3), Realsense 450 Fa Firmware, Proset\/wireless Wifi9611nonenew
- 7Ооо «ред Софт»Ред Ос9613nonenew
- 8MicrosoftWindows 11 22h2, Windows 11 21h2, Windows 10 22h28941new
- 9FedoraprojectFedora, Fedora Linux Kernel8241new
- 10Ао «ивк»Альт Сп 10, Альт 8 Сп7210nonenew
- 11Red HatRed Hat Enterprise Linux, Red Hat Enterprise Linux 9, Red Hat Enterprise Linux 67051new
- 12TendaAC6 Firmware, AC8 Firmware, AC9 Firmware6553nonenew
- 13MavenOrg.jenkins-ci.plugins:fortify, Org.jenkins-ci.plugins:cloudbees-folder, Org.graylog2:graylog2-server588nonenew
- 14PhpjabbersDocument Creator, Callback Widget, Time Slots Booking Calendar5623nonenew
- 15Ао «нтц Ит Роса»Роса Хром, Роса Кобальт, Rosa Virtualization 3.0513nonenew
- 16UnknownMultiparcels Shipping For Woocommerce, Tiempo.com, Simple Blog Card501nonenew
- 17PyPILangchain, Apache-airflow, Gitpython4712nonenew
- 18Fedora ProjectFedora454nonenew
- 19PackagistCockpit-hq/cockpit, Prestashop/prestashop, Wallabag/wallabag454nonenew
- 20BroadcomRaid Controller Web Interface, Lsi Storage Authority (Lsa), Brocade Fabric Operating System3911nonenew
- 21Camunda Services GmbhCamunda Modeler391nonenew
- 22AdobeAcrobat, Acrobat Dc, Acrobat Reader371nonenew
- 23CiscoPrime Infrastructure, Cisco Evolved Programmable Network Manager, Cisco Prime Infrastructure371nonenew
- 24GoGithub.com/answerdev/answer, Github.com/mattermost/mattermost-server/v6, Github.com/gravitl/netmaker370nonenew
- 25npm@excalidraw/excalidraw, Matrix-appservice-irc, Find-exec364nonenew
Severity
How this month's CVEs score on CVSS; 59 have no score yet. Severity is not exploitation.
- Critical352
- High909
- Medium1,152
- Low77
New in the top 100
Not in the top 100 in any of the 24 months before.
What kind of weakness
Weakness classes (CWE) by distinct CVEs, with how far each moved in the ranking.
- CWE-79XSS410
- CWE-787Out-of-bounds Write224
- CWE-89SQL Injection159
- CWE-20Improper Input Validation89
- CWE-22Path Traversal83
- CWE-120Buffer Overflow81
- CWE-125Out-of-bounds Read79
- CWE-78OS Command Injection77
- CWE-416Use After Free71
- CWE-77Command Injection55
- CWE-284Improper Access Control46
- CWE-862Missing Authorization37
- CWE-200Information Exposure36
- CWE-434Unrestricted File Upload35
- CWE-400Resource Consumption34
- CWE-287Improper Authentication32
- CWE-863Incorrect Authorization30
- CWE-269Improper Privilege Mgmt27
- CWE-94Code Injection26
- CWE-476NULL Pointer Dereference25
Where it landed
The month's CVEs by the sector of the software they affect. A CVE that touches several sectors counts in each.
- Operating Systems49314% of sector-tagged CVEs
- Web & CMS Plugins46713% of sector-tagged CVEs
- OSS Libraries44813% of sector-tagged CVEs
- Enterprise Software36710% of sector-tagged CVEs
- Networking Infrastructure2868% of sector-tagged CVEs
- Hardware Firmware2647% of sector-tagged CVEs
- Mobile Apps2326% of sector-tagged CVEs
- ICS / OT / IoT1895% of sector-tagged CVEs
- Security Products1494% of sector-tagged CVEs
- 6 smaller sectors449
- Not yet classified228
Which weakness, where
The top weakness classes against the vendors and the sectors that carried them.
The lighter the cell, the more CVEs. Point at one to read it.
| By vendor | 79XSS | 787Out-of-bounds Write | 89SQL Injection | 20Improper Input Validation | 22Path Traversal | 120Buffer Overflow | 125Out-of-bounds Read | 78OS Command Injection | 416Use After Free | 77Command Injection |
|---|---|---|---|---|---|---|---|---|---|---|
| Сообщество Свободного Программного Обеспечения | 5 | 30 | 3 | 3 | 6 | 8 | 10 | 22 | 4 | |
| Ооо «русбитех-астра» | 31 | 1 | 2 | 8 | 13 | 22 | ||||
| 1 | 34 | 3 | 1 | 11 | 20 | 1 | ||||
| Ао «нппкт» | 1 | 25 | 1 | 1 | 1 | 5 | 12 | 23 | ||
| Debian | 1 | 16 | 1 | 3 | 5 | 12 | 13 | |||
| Intel | 2 | 1 | 12 | 2 | ||||||
| Ооо «ред Софт» | 2 | 10 | 1 | 1 | 4 | 4 | 7 | |||
| Fedoraproject | 12 | 3 | 3 | 2 | 13 | 12 | ||||
| Microsoft | 8 | 9 | 1 | 2 | 11 | 1 | ||||
| Microsoft Corp | 2 | 1 | 9 | 2 | 11 | 1 | ||||
| Ао «ивк» | 15 | 1 | 5 | 9 | 4 | |||||
| Tenda | 55 | 4 | 3 | 3 |