March 2024
3,374 CVEs published, +13% on February 2024. CISA added 10 to KEV.
2024 month by month
- Critical
- 2818% of the 3,314 with a CVSS score
- Added to CISA KEV
- 108 of this month's CVEs are in KEV, listed a median 53 days after publication
- Vendors
- 1,5455,162 products
- Top weakness
- XSSCWE-79 · 795 CVEs
Who drove it
Vendors by distinct CVEs this month, with how many of those CVEs are now in CISA KEV and how far each moved in the ranking.
- 1Сообщество Свободного Программного ОбеспеченияLinux, Debian Gnu/linux, Phpmyfaq3336nonenew
- 2LinuxLinux, Linux Kernel2350nonenew
- 3Ооо «ред Софт»Ред Ос1782nonenew
- 4Ооо «русбитех-астра»Astra Linux Special Edition, Astra Linux Special Edition Для «эльбрус», Astra Linux Common Edition1402nonenew
- 5TendaFH1202 Firmware, AC18 Firmware, FH1205 Firmware13516nonenew
- 6Ао "нппкт"Осон Основа Оnyx1073nonenew
- 7GoogleAndroid, Google Chrome, Chrome924nonenew
- 8ApplemacOS, iPhone OS, iOS and iPadOS9102new
- 9CanonicalUbuntu902nonenew
- 10Shenzhen Tenda Technology Co., Ltd.Tenda AC15, Tenda AC7, Tenda AC10U828nonenew
- 11MicrosoftWindows 11 23h2, Windows 11 22h2, Windows Server 2022 (Server Core Installation)7322new
- 12Red HatRed Hat Enterprise Linux, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9682nonenew
- 13MavenOrg.geoserver:gs-restconfig, Org.jenkins-ci.plugins:htmlpublisher, Org.open-metadata:openmetadata-service676nonenew
- 14IBMSecure Proxy, Sterling Secure Proxy, DS8900F630nonenew
- 15SourcecodesterEmployee Task Management System, Online Mobile Management Store, Petrol Pump Management Software590nonenew
- 16Oretnom23Customer Support System, Employee Task Management System, Online Mobile Store Management System582nonenew
- 17AdobeAdobe Experience Manager, Experience Manager, Bridge5601new
- 18CampcodesOnline Job Finder System, Online Marriage Registration System, Complete Online Dj Booking System550nonenew
- 19GoGithub.com/argoproj/argo-cd/v2, Github.com/zitadel/zitadel, Github.com/cilium/cilium536nonenew
- 20PyPIGradio, Paddlepaddle, Apache-airflow486nonenew
- 21DebianDebian Linux470nonenew
- 22PackagistPhpmyfaq/phpmyfaq, Getgrav/grav, Friendsofsymfony1/symfony1471nonenew
- 23npmDirectus, Katex, Rsshub437nonenew
- 24FedoraprojectFedora411nonenew
- 25Ао «нтц Ит Роса»Rosa Virtualization 3.0, Роса Хром, Rosa Virtualization411nonenew
Severity
How this month's CVEs score on CVSS; 60 have no score yet. Severity is not exploitation.
- Critical281
- High1,118
- Medium1,768
- Low147
New in the top 100
Not in the top 100 in any of the 24 months before.
What kind of weakness
Weakness classes (CWE) by distinct CVEs, with how far each moved in the ranking.
- CWE-79XSS795
- CWE-89SQL Injection258
- CWE-787Out-of-bounds Write165
- CWE-121145
- CWE-352CSRF140
- CWE-862Missing Authorization112
- CWE-125Out-of-bounds Read74
- CWE-434Unrestricted File Upload74
- CWE-200Information Exposure71
- CWE-416Use After Free68
- CWE-476NULL Pointer Dereference64
- CWE-22Path Traversal60
- CWE-20Improper Input Validation57
- CWE-284Improper Access Control48
- CWE-269Improper Privilege Mgmt45
- CWE-78OS Command Injection44
- CWE-502Deserialization41
- CWE-120Buffer Overflow40
- CWE-94Code Injection39
- CWE-400Resource Consumption35
Where it landed
The month's CVEs by the sector of the software they affect. A CVE that touches several sectors counts in each.
- Web & CMS Plugins1,11927% of sector-tagged CVEs
- Operating Systems59214% of sector-tagged CVEs
- Enterprise Software45311% of sector-tagged CVEs
- OSS Libraries44711% of sector-tagged CVEs
- Networking Infrastructure2997% of sector-tagged CVEs
- Mobile Apps2025% of sector-tagged CVEs
- 9 smaller sectors773
- Not yet classified281
Which weakness, where
The top weakness classes against the vendors and the sectors that carried them.
The lighter the cell, the more CVEs. Point at one to read it.
| By vendor | 79XSS | 89SQL Injection | 787Out-of-bounds Write | 121 | 352CSRF | 862Missing Authorization | 125Out-of-bounds Read | 434Unrestricted File Upload | 200Information Exposure | 416Use After Free |
|---|---|---|---|---|---|---|---|---|---|---|
| Сообщество Свободного Программного Обеспечения | 8 | 5 | 16 | 15 | 1 | 1 | 32 | |||
| Linux | 11 | 14 | 28 | |||||||
| Ооо «ред Софт» | 2 | 6 | 1 | 10 | 22 | |||||
| Ооо «русбитех-астра» | 9 | 9 | 20 | |||||||
| Tenda | 59 | 108 | 4 | 5 | ||||||
| Ао «нппкт» | 1 | 6 | 4 | 12 | ||||||
| Apple | 6 | 2 | 2 | 4 | 3 | |||||
| Canonical Ltd. | 6 | 9 | 12 | |||||||
| 1 | 26 | 2 | 20 | 9 | ||||||
| Shenzhen Tenda Technology Co., Ltd. | 35 | 64 | 4 | 3 | ||||||
| Microsoft Corp | 1 | 3 | 2 | 1 | 8 | |||||
| Microsoft | 1 | 1 | 2 | 1 | 7 |