February 2024
2,983 CVEs published, +11% on January 2024 and +16% on February 2023. CISA added 9 to KEV.
2024 month by month
- Critical
- 32211% of the 2,802 with a CVSS score
- Added to CISA KEV
- 911 of this month's CVEs are in KEV, listed a median 20 days after publication
- Vendors
- 1,4124,886 products
- Top weakness
- XSSCWE-79 · 438 CVEs
Who drove it
Vendors by distinct CVEs this month, with how many of those CVEs are now in CISA KEV and how far each moved in the ranking.
- 1Сообщество Свободного Программного ОбеспеченияLinux, Debian Gnu/linux, Envoy40510nonenew
- 2LinuxLinux Kernel, Linux2990nonenew
- 3Ооо «ред Софт»Ред Ос2054nonenew
- 4Ооо «русбитех-астра»Astra Linux Special Edition, Astra Linux Special Edition Для «эльбрус», Astra Linux Common Edition1833nonenew
- 5Ао "нппкт"Осон Основа Оnyx964nonenew
- 6Ао «ивк»Альт Сп 10, Альт 8 Сп920nonenew
- 7MicrosoftWindows Server 2022, 23h2 Edition (Server Core Installation), Windows 11 23h2, Windows 11 22h29095new
- 8MavenCom.liferay.portal:release.portal.bom, Com.liferay.portal:release.dxp.bom, Org.apache.dolphinscheduler:dolphinscheduler8920nonenew
- 9IBMPowersc, Security Verify Access Appliance, Security Verify Access Docker862nonenew
- 10Red HatRed Hat Enterprise Linux, Red Hat Enterprise Linux 7, Enterprise Linux793nonenew
- 11CanonicalUbuntu, Lxd, Ubuntu Edk Ii760nonenew
- 12IntelThunderbolt Dch Driver, Intel Proset/wireless Wifi, Intel Killer Wi-fi760nonenew
- 13Ао «нтц Ит Роса»Rosa Virtualization 3.0, Роса Хром, Роса Кобальт711nonenew
- 14FedoraprojectFedora, Unbound6911nonenew
- 15GoogleAndroid, Google Chrome, Chrome694nonenew
- 16PyPIVyper, Apache-superset, Clearml6612nonenew
- 17PackagistMoodle/moodle, Getkirby/cms, Typo3/cms-core646nonenew
- 18GoGithub.com/mattermost/mattermost/server/v8, Github.com/greenpau/caddy-security, Github.com/apache/incubator-answer522nonenew
- 19DellUnity, Unity Operating Environment, Supportassist For Home Pcs475nonenew
- 20OracleMySQL Server, E-business Suite, Graalvm Enterprise Edition4701new
- 21ApacheSuperset, Dolphinscheduler, Solr4111nonenew
- 22Apache Software FoundationApache Superset, Apache Dolphinscheduler, Apache Solr388nonenew
- 23LiferayDigital Experience Platform, Liferay Portal, Dxp3513nonenew
- 24Fedora ProjectFedora343nonenew
- 25DebianDebian Linux332nonenew
Severity
How this month's CVEs score on CVSS; 181 have no score yet. Severity is not exploitation.
- Critical322
- High892
- Medium1,462
- Low126
New in the top 100
Not in the top 100 in any of the 24 months before.
What kind of weakness
Weakness classes (CWE) by distinct CVEs, with how far each moved in the ranking.
- CWE-79XSS438
- CWE-89SQL Injection173
- CWE-787Out-of-bounds Write128
- CWE-352CSRF124
- CWE-284Improper Access Control98
- CWE-416Use After Free92
- CWE-476NULL Pointer Dereference90
- CWE-862Missing Authorization81
- CWE-22Path Traversal76
- CWE-125Out-of-bounds Read74
- CWE-434Unrestricted File Upload67
- CWE-78OS Command Injection61
- CWE-20Improper Input Validation58
- CWE-400Resource Consumption57
- CWE-200Information Exposure56
- CWE-94Code Injection53
- CWE-122Heap Buffer Overflow45
- CWE-40144
- CWE-77Command Injection43
- CWE-120Buffer Overflow34
Where it landed
The month's CVEs by the sector of the software they affect. A CVE that touches several sectors counts in each.
- Web & CMS Plugins74320% of sector-tagged CVEs
- Operating Systems70319% of sector-tagged CVEs
- OSS Libraries49413% of sector-tagged CVEs
- Enterprise Software44912% of sector-tagged CVEs
- Hardware Firmware2487% of sector-tagged CVEs
- Networking Infrastructure1534% of sector-tagged CVEs
- 9 smaller sectors783
- Not yet classified189
Which weakness, where
The top weakness classes against the vendors and the sectors that carried them.
The lighter the cell, the more CVEs. Point at one to read it.
| By vendor | 79XSS | 89SQL Injection | 787Out-of-bounds Write | 352CSRF | 284Improper Access Control | 416Use After Free | 476NULL Pointer Dereference | 862Missing Authorization | 22Path Traversal | 125Out-of-bounds Read |
|---|---|---|---|---|---|---|---|---|---|---|
| Сообщество Свободного Программного Обеспечения | 2 | 21 | 1 | 1 | 52 | 62 | 2 | 19 | ||
| Linux | 9 | 44 | 58 | 15 | ||||||
| Ооо «ред Софт» | 2 | 1 | 13 | 1 | 25 | 31 | 1 | 8 | ||
| Ооо «русбитех-астра» | 2 | 15 | 1 | 26 | 25 | 8 | ||||
| Ао «нппкт» | 1 | 1 | 8 | 1 | 9 | 5 | 4 | |||
| Ао «ивк» | 1 | 6 | 9 | 15 | 6 | |||||
| Maven | 16 | 3 | 1 | 3 | 1 | 3 | ||||
| Microsoft Corp | 8 | 1 | 1 | 5 | 7 | 3 | 3 | |||
| IBM | 8 | 1 | 1 | 2 | 1 | 2 | ||||
| Microsoft | 8 | 2 | 4 | 5 | 2 | 2 | ||||
| Canonical Ltd. | 6 | 9 | 5 | 4 | ||||||
| Intel | 1 | 24 | 1 | 1 |