January 2024
2,698 CVEs published, −3% on December 2023 and +3% on January 2023. CISA added 21 to KEV.
2024 month by month
- Critical
- 31212% of the 2,600 with a CVSS score
- Added to CISA KEV
- 2113 of this month's CVEs are in KEV, listed a median 22 days after publication
- Vendors
- 1,3874,441 products
- Top weakness
- XSSCWE-79 · 447 CVEs
Who drove it
Vendors by distinct CVEs this month, with how many of those CVEs are now in CISA KEV and how far each moved in the ranking.
- 1Сообщество Свободного Программного ОбеспеченияDebian Gnu/linux, Linux, Mediawiki152133new
- 2Ооо «ред Софт»Ред Ос14394new
- 3UnknownEventon, Essential Real Estate, Estatik Real Estate Plugin1397nonenew
- 4Ооо «русбитех-астра»Astra Linux Special Edition, Astra Linux Special Edition Для «эльбрус», Astra Linux Common Edition11144new
- 5Ао «ивк»Альт Сп 10, Альт 8 Сп8512new
- 6ApplemacOS, iOS and iPadOS, iPadOS8413new
- 7GtkwaveGtkwave820nonenew
- 8MicrosoftWindows Server 2022, Windows Server 2022, 23h2 Edition (Server Core Installation), Windows Server 2022 (Server Core Installation)8251new
- 9TonybybellGtkwave820nonenew
- 10Ао "нппкт"Осон Основа Оnyx8234new
- 11PyPIPaddlepaddle, Pyload-ng, Whoogle-search7714nonenew
- 12Red HatRed Hat Enterprise Linux, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 97732new
- 13TotolinkA3300R Firmware, N200RE, LR1200GB Firmware7335nonenew
- 14MavenDe.tum.in.ase:artemis-java-test-sandbox, Com.jfinal:jfinal, Io.jenkins.plugins:gitlab-branch-source6291new
- 15GoogleAndroid, Chrome, Google Chrome6141new
- 16FedoraprojectFedora, Extra Packages For Enterprise Linux5622new
- 17TendaAX1803 Firmware, AC10U, W9 Firmware5523nonenew
- 18GoGithub.com/cubefs/cubefs, Github.com/0xjacky/nginx-ui, Github.com/moby/buildkit465nonenew
- 19KashiparaFood Management System, Billing Software, Travel Website4617nonenew
- 20OracleMySQL Server, MySQL, E-business Suite430nonenew
- 21LinuxLinux Kernel, Linux, Kernel4202new
- 22AjaysharmaCups Easy410nonenew
- 23Cups EasyCups Easy (Purchase & Inventory)410nonenew
- 24Fedora ProjectFedora, Fedora Epel3721new
- 25PackagistGilacms/gila, Tinymce/tinymce, Wwbn/avideo363nonenew
Severity
How this month's CVEs score on CVSS; 98 have no score yet. Severity is not exploitation.
- Critical312
- High909
- Medium1,234
- Low145
New in the top 100
Not in the top 100 in any of the 24 months before.
What kind of weakness
Weakness classes (CWE) by distinct CVEs, with how far each moved in the ranking.
- CWE-79XSS447
- CWE-787Out-of-bounds Write186
- CWE-89SQL Injection185
- CWE-352CSRF103
- CWE-12176
- CWE-200Information Exposure74
- CWE-119Memory Buffer Bounds73
- CWE-20Improper Input Validation71
- CWE-284Improper Access Control71
- CWE-22Path Traversal69
- CWE-78OS Command Injection69
- CWE-416Use After Free68
- CWE-862Missing Authorization64
- CWE-434Unrestricted File Upload58
- CWE-120Buffer Overflow57
- CWE-190Integer Overflow55
- CWE-125Out-of-bounds Read53
- CWE-94Code Injection43
- CWE-77Command Injection42
- CWE-400Resource Consumption37
Where it landed
The month's CVEs by the sector of the software they affect. A CVE that touches several sectors counts in each.
- Web & CMS Plugins68719% of sector-tagged CVEs
- OSS Libraries43312% of sector-tagged CVEs
- Operating Systems40911% of sector-tagged CVEs
- Enterprise Software37210% of sector-tagged CVEs
- Networking Infrastructure2978% of sector-tagged CVEs
- Hardware Firmware2086% of sector-tagged CVEs
- Mobile Apps1865% of sector-tagged CVEs
- ICS / OT / IoT1614% of sector-tagged CVEs
- 7 smaller sectors628
- Not yet classified267
Which weakness, where
The top weakness classes against the vendors and the sectors that carried them.
The lighter the cell, the more CVEs. Point at one to read it.
| By vendor | 79XSS | 787Out-of-bounds Write | 89SQL Injection | 352CSRF | 121 | 200Information Exposure | 119Memory Buffer Bounds | 20Improper Input Validation | 284Improper Access Control | 22Path Traversal |
|---|---|---|---|---|---|---|---|---|---|---|
| Сообщество Свободного Программного Обеспечения | 8 | 16 | 1 | 2 | 1 | 3 | 6 | 5 | 3 | 6 |
| Ооо «ред Софт» | 9 | 15 | 2 | 2 | 2 | 6 | 3 | 5 | 7 | |
| Ооо «русбитех-астра» | 1 | 11 | 1 | 2 | 4 | 8 | 1 | 1 | ||
| Ао «ивк» | 1 | 9 | 1 | 1 | 3 | 6 | 1 | 1 | ||
| Apple | 6 | 11 | 5 | 2 | 3 | 2 | ||||
| Gtkwave | 19 | 3 | 23 | |||||||
| Tonybybell | 19 | 3 | 23 | |||||||
| Ао «нппкт» | 1 | 10 | 2 | 2 | 2 | 4 | ||||
| Microsoft Corp | 2 | 1 | 8 | 3 | ||||||
| PyPI | 10 | 4 | 1 | 1 | 1 | 1 | 3 | 7 | ||
| Totolink | 7 | 21 | 1 | 3 | ||||||
| Apple Inc. | 6 | 10 | 3 | 1 | 3 | 1 |