December 2023
2,769 CVEs published, +8% on November 2023 and −3% on December 2022. CISA added 11 to KEV.
2023 month by month
| Year | Jan | Feb | Mar | Apr | May | Jun | Jul | Aug | Sep | Oct | Nov | Dec | Year total |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 2023 | January 2023: 2,619 CVEs5 added to CISA KEV | February 2023: 2,562 CVEs14 added to CISA KEV | March 2023: no snapshot | April 2023: 2,356 CVEs17 added to CISA KEV | May 2023: 2,766 CVEs19 added to CISA KEV | June 2023: 2,448 CVEs24 added to CISA KEV | July 2023: 2,380 CVEs16 added to CISA KEV | August 2023: 2,549 CVEs8 added to CISA KEV | September 2023: 2,863 CVEs19 added to CISA KEV | October 2023: 2,764 CVEs18 added to CISA KEV | November 2023: 2,560 CVEs18 added to CISA KEV | December 2023: 2,769 CVEs11 added to CISA KEV | 28,63611 of 12 months11/12 |
- Critical
- 38314% of the 2,701 with a CVSS score
- Added to CISA KEV
- 119 of this month's CVEs are in KEV, listed a median 9 days after publication
- Vendors
- 1,4255,345 products
- Top weakness
- XSSCWE-79 · 566 CVEs
Who drove it
Vendors by distinct CVEs this month, with how many of those CVEs are now in CISA KEV and how far each moved in the ranking.
- 1AdobeAdobe Experience Manager, Experience Manager, Experience Manager Cloud Service2200nonenew
- 2GoogleAndroid, Google Chrome, Chrome198221new
- 3MavenCom.jfinal:jfinal, Org.silverpeas.core:silverpeas-core-web, Com.cloudtp.jenkins:paaslane-estimate11718nonenew
- 4Ооо «ред Софт»Ред Ос10661new
- 5Сообщество Свободного Программного ОбеспеченияDebian Gnu/linux, Linux, Xwiki Platform103102new
- 6Unisoc (Shanghai) Technologies Co., Ltd.Sc7731e/sc9832e/sc9863a/t310/t606/t612/t616/t610/t618/t760/t770/t820/s8000, Sc9863a/t310/t606/t612/t616/t610/t618/t760/t770/t820/s8000, T606/t612/t616830nonenew
- 7Ооо «русбитех-астра»Astra Linux Special Edition, Astra Linux Common Edition, Astra Linux Special Edition Для «эльбрус»8231new
- 8Ао "нппкт"Осон Основа Оnyx6821new
- 9Ао «ивк»Альт Сп 10, Альт 8 Сп572nonenew
- 10Red HatRed Hat Enterprise Linux, Red Hat Enterprise Linux 9, Red Hat Enterprise Linux 8560nonenew
- 11IBMDB2 For Linux, Unix and Windows, Infosphere Information Server, DB2540nonenew
- 12MicrosoftWindows Server 2022, 23h2 Edition (Server Core Installation), Windows Server 2022, Windows Server 20195441new
- 13PyPIMlflow, Apache-airflow, Apache-superset525nonenew
- 14UnknownWp Mail Log, Wp All Export Pro, Export Any WordPress Data To Xml/csv523nonenew
- 15TendaW30E Firmware, I29 Firmware, AX9 Firmware4747nonenew
- 16PackagistConcrete5/concrete5, Automad/automad, Microweber/microweber431nonenew
- 17TotolinkEX1800T Firmware, X6000R Firmware, X2000R Firmware4037nonenew
- 18DebianDebian Linux3912new
- 19QualcommWCD9380 Firmware, QCA6391 Firmware, WSA8835 Firmware3833new
- 20Qualcomm, Inc.Snapdragon3833new
- 21npm@evershop/evershop, Uptime-kuma, Nuxt-api-party373nonenew
- 22ApplemacOS, iPadOS, iPhone OS350nonenew
- 23DellPowerprotect Data Domain Management Center, Powerprotect Data Protection, Emc Data Domain OS350nonenew
- 24code-projectsClient Details System, E-commerce Website, Faculty Management System320nonenew
- 25GoGithub.com/traefik/traefik/v3, Github.com/mattermost/mattermost/server/v8, Github.com/traefik/traefik/v2321nonenew
Severity
How this month's CVEs score on CVSS; 68 have no score yet. Severity is not exploitation.
- Critical383
- High867
- Medium1,343
- Low108
New in the top 100
Not in the top 100 in any of the 24 months before.
What kind of weakness
Weakness classes (CWE) by distinct CVEs, with how far each moved in the ranking.
- CWE-79XSS566
- CWE-89SQL Injection237
- CWE-787Out-of-bounds Write181
- CWE-352CSRF113
- CWE-862Missing Authorization95
- CWE-434Unrestricted File Upload72
- CWE-22Path Traversal65
- CWE-125Out-of-bounds Read61
- CWE-78OS Command Injection59
- CWE-20Improper Input Validation57
- CWE-200Information Exposure53
- CWE-94Code Injection51
- CWE-502Deserialization43
- CWE-863Incorrect Authorization41
- CWE-120Buffer Overflow40
- CWE-601Open Redirect40
- CWE-284Improper Access Control36
- CWE-77Command Injection35
- CWE-287Improper Authentication34
- CWE-416Use After Free34
Where it landed
The month's CVEs by the sector of the software they affect. A CVE that touches several sectors counts in each.
- Web & CMS Plugins74020% of sector-tagged CVEs
- Enterprise Software45712% of sector-tagged CVEs
- OSS Libraries43812% of sector-tagged CVEs
- Operating Systems37410% of sector-tagged CVEs
- Mobile Apps3068% of sector-tagged CVEs
- Consumer Software2837% of sector-tagged CVEs
- Hardware Firmware2196% of sector-tagged CVEs
- Networking Infrastructure2106% of sector-tagged CVEs
- 7 smaller sectors542
- Not yet classified212
Which weakness, where
The top weakness classes against the vendors and the sectors that carried them.
The lighter the cell, the more CVEs. Point at one to read it.
| By vendor | 79XSS | 89SQL Injection | 787Out-of-bounds Write | 352CSRF | 862Missing Authorization | 434Unrestricted File Upload | 22Path Traversal | 125Out-of-bounds Read | 78OS Command Injection | 20Improper Input Validation |
|---|---|---|---|---|---|---|---|---|---|---|
| Adobe | 191 | 9 | 12 | 3 | ||||||
| Adobe Systems Inc. | 190 | 9 | 12 | 3 | ||||||
| 32 | 63 | 30 | 2 | |||||||
| Maven | 13 | 5 | 3 | 27 | 5 | 2 | 2 | |||
| Ооо «ред Софт» | 1 | 18 | 2 | 4 | 1 | 3 | ||||
| Сообщество Свободного Программного Обеспечения | 2 | 16 | 1 | 1 | 2 | 4 | 2 | |||
| Unisoc (Shanghai) Technologies Co., Ltd. | 8 | 58 | 11 | |||||||
| Ооо «русбитех-астра» | 11 | 1 | 4 | 1 | 2 | |||||
| Ао «нппкт» | 13 | 1 | 3 | 1 | ||||||
| Ао «ивк» | 10 | 4 | 1 | 2 | ||||||
| IBM | 7 | 3 | 1 | 2 | 2 | 1 | 12 | |||
| PyPI | 4 | 1 | 1 | 1 | 5 | 2 |