June 2024
3,333 CVEs published, −38% on May 2024 and +36% on June 2023. CISA added 9 to KEV.
2024 month by month
- Critical
- 31310% of the 3,093 with a CVSS score
- Added to CISA KEV
- 913 of this month's CVEs are in KEV, listed a median 58 days after publication
- Vendors
- 1,4694,485 products
- Top weakness
- XSSCWE-79 · 643 CVEs
Who drove it
Vendors by distinct CVEs this month, with how many of those CVEs are now in CISA KEV and how far each moved in the ranking.
- 1Сообщество Свободного Программного ОбеспеченияLinux, Debian Gnu/linux, Webkitgtk360162new
- 2Ооо «ред Софт»Ред Ос286112new
- 3LinuxLinux, Linux Kernel28551new
- 4Ооо «русбитех-астра»Astra Linux Special Edition, Astra Linux Common Edition, Astra Linux Special Edition Для «эльбрус»227131new
- 5Ао "нппкт"Осон Основа Оnyx21112nonenew
- 6AdobeExperience Manager, Adobe Experience Manager, Commerce Webhooks16741new
- 7PackagistTypo3/cms, Zendframework/zendframework1, Zendframework/zendframework16521new
- 8Red HatRed Hat Enterprise Linux, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 91205nonenew
- 9CanonicalUbuntu, Ubuntu Linux, Apport9441new
- 10MicrosoftMicrosoft Edge, Windows Server 2019, Windows Server 2019 (Server Core Installation)8523new
- 11PyPIMlflow, Lollms, Zenml8315nonenew
- 12GoogleAndroid, Google Chrome, Chrome8261new
- 13UnknownArforms - Premium WordPress Form Builder Plugin, Widget Bundle, Wp Logs Book823nonenew
- 14Ао «ивк»Альт Сп 10, Альт 8 Сп5371new
- 15IBMInfosphere Information Server, Security Access Manager, Security Access Manager Docker510nonenew
- 16Ао «нтц Ит Роса»Rosa Virtualization 3.0, Rosa Virtualization, Роса Хром4561new
- 17ItsourcecodePool of Bethesda Online Reservation System, Tailoring Management System, Bakery Online Ordering System442nonenew
- 18Toshiba Tec CorporationToshiba Tec E-studio Multi-function Peripheral (Mfp), Toshiba E-studio 5008lp Series, Toshiba E-studio 5018a Series436nonenew
- 19ApplemacOS, iOS and iPadOS, iPhone OS410nonenew
- 20SamsungExynos 1330 Firmware, Exynos 1280 Firmware, Exynos 1380 Firmware400nonenew
- 21DellPowerprotect Dd, Data Domain Operating System, Cpg Bios340nonenew
- 22GoGithub.com/evmos/evmos/v14, Github.com/evmos/evmos/v16, Github.com/evmos/evmos/v17333nonenew
- 23npm@janhq/core, Lunary, Tinymce336nonenew
- 24MavenCom.reposilite:reposilite-backend, Org.keycloak:keycloak-services, Org.apache.submarine:submarine-server-core318nonenew
- 25FedoraprojectFedora3011new
Severity
How this month's CVEs score on CVSS; 240 have no score yet. Severity is not exploitation.
- Critical313
- High942
- Medium1,727
- Low111
New in the top 100
Not in the top 100 in any of the 24 months before.
What kind of weakness
Weakness classes (CWE) by distinct CVEs, with how far each moved in the ranking.
- CWE-79XSS643
- CWE-862Missing Authorization311
- CWE-89SQL Injection164
- CWE-787Out-of-bounds Write118
- CWE-22Path Traversal104
- CWE-352CSRF77
- CWE-476NULL Pointer Dereference72
- CWE-125Out-of-bounds Read70
- CWE-416Use After Free69
- CWE-94Code Injection58
- CWE-200Information Exposure57
- CWE-284Improper Access Control53
- CWE-434Unrestricted File Upload47
- CWE-20Improper Input Validation46
- CWE-287Improper Authentication46
- CWE-78OS Command Injection38
- CWE-918SSRF37
- CWE-12135
- CWE-502Deserialization35
- CWE-863Incorrect Authorization35
Where it landed
The month's CVEs by the sector of the software they affect. A CVE that touches several sectors counts in each.
- Web & CMS Plugins95225% of sector-tagged CVEs
- Operating Systems59115% of sector-tagged CVEs
- OSS Libraries43711% of sector-tagged CVEs
- Enterprise Software41411% of sector-tagged CVEs
- Consumer Software2527% of sector-tagged CVEs
- Mobile Apps1775% of sector-tagged CVEs
- AI / ML1714% of sector-tagged CVEs
- 8 smaller sectors644
- Not yet classified214
Which weakness, where
The top weakness classes against the vendors and the sectors that carried them.
The lighter the cell, the more CVEs. Point at one to read it.
| By vendor | 79XSS | 862Missing Authorization | 89SQL Injection | 787Out-of-bounds Write | 22Path Traversal | 352CSRF | 476NULL Pointer Dereference | 125Out-of-bounds Read | 416Use After Free | 94Code Injection |
|---|---|---|---|---|---|---|---|---|---|---|
| Сообщество Свободного Программного Обеспечения | 4 | 2 | 18 | 3 | 60 | 22 | 38 | 5 | ||
| Ооо «ред Софт» | 3 | 1 | 15 | 3 | 1 | 44 | 16 | 38 | 1 | |
| Linux | 12 | 60 | 18 | 29 | ||||||
| Ооо «русбитех-астра» | 1 | 13 | 2 | 33 | 14 | 31 | 1 | |||
| Ао «нппкт» | 13 | 32 | 14 | 30 | 2 | |||||
| Adobe | 142 | 1 | 1 | 1 | 3 | |||||
| Adobe Systems Inc. | 142 | 1 | 1 | 1 | 3 | |||||
| Packagist | 40 | 2 | 8 | 3 | 6 | 4 | ||||
| Red Hat Inc. | 5 | 17 | 6 | 14 | 1 | |||||
| Canonical Ltd. | 3 | 8 | 14 | 6 | 8 | |||||
| PyPI | 9 | 3 | 2 | 14 | 1 | 8 | ||||
| Microsoft Corp | 5 | 3 | 19 | 1 |