October 2023
2,764 CVEs published, −3% on September 2023 and +43% on October 2022. CISA added 18 to KEV.
2023 month by month
| Year | Jan | Feb | Mar | Apr | May | Jun | Jul | Aug | Sep | Oct | Nov | Dec | Year total |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 2023 | January 2023: 2,619 CVEs5 added to CISA KEV | February 2023: 2,562 CVEs14 added to CISA KEV | March 2023: no snapshot | April 2023: 2,356 CVEs17 added to CISA KEV | May 2023: 2,766 CVEs19 added to CISA KEV | June 2023: 2,448 CVEs24 added to CISA KEV | July 2023: 2,380 CVEs16 added to CISA KEV | August 2023: 2,549 CVEs8 added to CISA KEV | September 2023: 2,863 CVEs19 added to CISA KEV | October 2023: 2,764 CVEs18 added to CISA KEV | November 2023: 2,560 CVEs18 added to CISA KEV | December 2023: 2,769 CVEs11 added to CISA KEV | 28,63611 of 12 months11/12 |
- Critical
- 37214% of the 2,699 with a CVSS score
- Added to CISA KEV
- 1818 of this month's CVEs are in KEV, listed a median 5.5 days after publication
- Vendors
- 1,5645,397 products
- Top weakness
- XSSCWE-79 · 419 CVEs
Who drove it
Vendors by distinct CVEs this month, with how many of those CVEs are now in CISA KEV and how far each moved in the ranking.
- 1GoogleAndroid, Chrome, Google Chrome20541new
- 2Сообщество Свободного Программного ОбеспеченияDebian Gnu/linux, Linux, Mediawiki148133new
- 3MicrosoftWindows Server 2022, Windows Server 2019, Windows Server 2019 (Server Core Installation)11854new
- 4Ооо «ред Софт»Ред Ос11693new
- 5Ооо «русбитех-астра»Astra Linux Special Edition, Astra Linux Common Edition, Astra Linux Special Edition Для «эльбрус»9751new
- 6Ао «ивк»Альт 8 Сп, Альт Сп 10, Альт Рабочая Станция К9152new
- 7MavenCom.liferay.portal:release.dxp.bom, Org.xwiki.platform:xwiki-platform-web-templates, Org.yamcs:yamcs81262new
- 8Ао "нппкт"Осон Основа Оnyx8181new
- 9Red HatRed Hat Enterprise Linux, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 97832new
- 10OracleMySQL, MySQL Server, Weblogic Server753nonenew
- 11IBMSecurity Verify Privilege On-premises, Security Verify Privilege, DB2 For Linux, Unix and Windows620nonenew
- 12TotolinkX2000R Firmware, X6000R Firmware, Cp300\+ Firmware5956nonenew
- 13FedoraprojectFedora, Extra Packages For Enterprise Linux5733new
- 14UnknownActivitypub, Eventprime, File Manager Pro562nonenew
- 15PackagistMagento/project-community-edition, Magento/community-edition, Concrete5/concrete5552nonenew
- 16Ао «нтц Ит Роса»Роса Хром, Rosa Virtualization 3.0, Rosa Virtualization5432new
- 17PyPIApache-airflow, Vantage6, Urllib3532nonenew
- 18DebianDebian Linux4844new
- 19GoGithub.com/arduino/arduino-create-agent, K8s.io/kubernetes, Github.com/nats-io/nats-server/v24411new
- 20NetappOncommand Insight, H410C Firmware, Active Iq Unified Manager4223new
- 21ApplemacOS, iPhone OS, iOS and iPadOS4102new
- 22FortinetFortiwlm, Fortianalyzer, Fortimanager365nonenew
- 23Fortinet Inc.Fortiwlm, Fortianalyzer, Fortimanager355nonenew
- 24DlinkDir-823g Firmware, Dir-823g, Di-7200g Firmware3315nonenew
- 25IdattendIdweb3011nonenew
Severity
How this month's CVEs score on CVSS; 65 have no score yet. Severity is not exploitation.
- Critical372
- High925
- Medium1,319
- Low83
New in the top 100
Not in the top 100 in any of the 24 months before.
What kind of weakness
Weakness classes (CWE) by distinct CVEs, with how far each moved in the ranking.
- CWE-79XSS419
- CWE-352CSRF225
- CWE-787Out-of-bounds Write162
- CWE-89SQL Injection137
- CWE-862Missing Authorization82
- CWE-20Improper Input Validation71
- CWE-200Information Exposure69
- CWE-22Path Traversal67
- CWE-78OS Command Injection62
- CWE-125Out-of-bounds Read61
- CWE-416Use After Free53
- CWE-269Improper Privilege Mgmt51
- CWE-400Resource Consumption50
- CWE-77Command Injection50
- CWE-284Improper Access Control48
- CWE-94Code Injection48
- CWE-120Buffer Overflow47
- CWE-434Unrestricted File Upload46
- CWE-12141
- CWE-20341
Where it landed
The month's CVEs by the sector of the software they affect. A CVE that touches several sectors counts in each.
- Web & CMS Plugins69519% of sector-tagged CVEs
- Enterprise Software45812% of sector-tagged CVEs
- Operating Systems44512% of sector-tagged CVEs
- OSS Libraries40511% of sector-tagged CVEs
- Networking Infrastructure3118% of sector-tagged CVEs
- Mobile Apps2868% of sector-tagged CVEs
- Security Products1664% of sector-tagged CVEs
- ICS / OT / IoT1554% of sector-tagged CVEs
- Hardware Firmware1524% of sector-tagged CVEs
- 6 smaller sectors412
- Not yet classified234
Which weakness, where
The top weakness classes against the vendors and the sectors that carried them.
The lighter the cell, the more CVEs. Point at one to read it.
| By vendor | 79XSS | 352CSRF | 787Out-of-bounds Write | 89SQL Injection | 862Missing Authorization | 20Improper Input Validation | 200Information Exposure | 22Path Traversal | 78OS Command Injection | 125Out-of-bounds Read |
|---|---|---|---|---|---|---|---|---|---|---|
| 1 | 20 | 37 | 4 | 21 | ||||||
| Сообщество Свободного Программного Обеспечения | 5 | 1 | 18 | 1 | 2 | 2 | 3 | 2 | 1 | 12 |
| Ооо «ред Софт» | 5 | 1 | 11 | 1 | 2 | 3 | 5 | |||
| Microsoft Corp | 1 | 2 | 10 | 1 | 2 | |||||
| Microsoft | 1 | 1 | 8 | 1 | 2 | |||||
| Ооо «русбитех-астра» | 2 | 16 | 2 | 2 | 12 | |||||
| Ао «ивк» | 1 | 12 | 2 | 2 | 12 | |||||
| Maven | 18 | 1 | 2 | 3 | 1 | 4 | ||||
| Ао «нппкт» | 2 | 13 | 2 | 1 | 4 | |||||
| Oracle Corp. | 1 | 2 | 1 | |||||||
| Oracle | 2 | 1 | ||||||||
| Oracle Corporation | 2 | 1 |