July 2024
3,248 CVEs published, −3% on June 2024 and +36% on July 2023. CISA added 14 to KEV.
2024 month by month
- Critical
- 2759% of the 3,133 with a CVSS score
- Added to CISA KEV
- 1412 of this month's CVEs are in KEV, listed a median 19 days after publication
- Vendors
- 1,3125,448 products
- Top weakness
- XSSCWE-79 · 528 CVEs
Who drove it
Vendors by distinct CVEs this month, with how many of those CVEs are now in CISA KEV and how far each moved in the ranking.
- 1Сообщество Свободного Программного ОбеспеченияLinux, Debian Gnu/linux, Openvpn53719nonenew
- 2LinuxLinux Kernel, Linux4400nonenew
- 3Ооо «ред Софт»Ред Ос41011nonenew
- 4Ооо «русбитех-астра»Astra Linux Special Edition, Astra Linux Common Edition, Astra Linux Special Edition Для «эльбрус»37081new
- 5Ао "нппкт"Осон Основа Оnyx33471new
- 6Red HatRed Hat Enterprise Linux, Red Hat Enterprise Linux 9, Red Hat Enterprise Linux 82200nonenew
- 7CanonicalUbuntu, Snapd, Snap1791nonenew
- 8MicrosoftWindows Server 2022, 23h2 Edition (Server Core Installation), Windows Server 2022 (Server Core Installation), Windows Server 202215993new
- 9UnknownWp-affiliate-platform, Wp-emember, Himer1318nonenew
- 10Ао «ивк»Альт Сп 10, Альт 8 Сп12851new
- 11Novell Inc.Opensuse Leap, Suse Linux Enterprise Desktop, Suse Linux Enterprise Server For Sap Applications1273nonenew
- 12Ао «нтц Ит Роса»Rosa Virtualization 3.0, Rosa Virtualization, Роса Кобальт9841new
- 13ApplemacOS, iOS and iPadOS, iPadOS800nonenew
- 14GoogleAndroid, Chrome, Google Chrome756nonenew
- 15SourcecodesterRecord Management System, Lot Reservation Management System, Establishment Billing Management System690nonenew
- 16OracleMySQL Server, MySQL, E-business Suite6311new
- 17PyPIDjango, Anki, Roundup593nonenew
- 18Oretnom23Establishment Billing Management System, Lot Reservation Management System, School Fees Payment System512nonenew
- 19GoGithub.com/gogs/gogs, Gogs.io/gogs, Github.com/snapcore/snapd499nonenew
- 20MavenOrg.apache.streampark:streampark, Org.geoserver.web:gs-web-app, Org.apache.linkis:linkis-datasource4881new
- 21npmFlowise, Bootstrap, Directus477nonenew
- 22SamsungAndroid, Exynos 1380 Firmware, Exynos 2200 Firmware471nonenew
- 23ApacheHTTP Server, Streampark, Streampipes4691new
- 24Apache Software FoundationApache HTTP Server, HTTP Server, Apache Streampark4691new
- 25JuniperJunos OS Evolved, Junos, J-web460nonenew
Severity
How this month's CVEs score on CVSS; 115 have no score yet. Severity is not exploitation.
- Critical275
- High1,082
- Medium1,650
- Low126
New in the top 100
Not in the top 100 in any of the 24 months before.
What kind of weakness
Weakness classes (CWE) by distinct CVEs, with how far each moved in the ranking.
- CWE-79XSS528
- CWE-89SQL Injection179
- CWE-787Out-of-bounds Write115
- CWE-352CSRF95
- CWE-416Use After Free95
- CWE-200Information Exposure94
- CWE-22Path Traversal83
- CWE-476NULL Pointer Dereference77
- CWE-125Out-of-bounds Read61
- CWE-20Improper Input Validation60
- CWE-12159
- CWE-94Code Injection59
- CWE-434Unrestricted File Upload58
- CWE-122Heap Buffer Overflow57
- CWE-400Resource Consumption54
- CWE-862Missing Authorization53
- CWE-78OS Command Injection52
- CWE-269Improper Privilege Mgmt51
- CWE-120Buffer Overflow49
- CWE-284Improper Access Control48
Where it landed
The month's CVEs by the sector of the software they affect. A CVE that touches several sectors counts in each.
- Operating Systems90322% of sector-tagged CVEs
- Web & CMS Plugins84421% of sector-tagged CVEs
- Enterprise Software43411% of sector-tagged CVEs
- OSS Libraries39410% of sector-tagged CVEs
- Networking Infrastructure2867% of sector-tagged CVEs
- Mobile Apps2145% of sector-tagged CVEs
- 9 smaller sectors792
- Not yet classified167
Which weakness, where
The top weakness classes against the vendors and the sectors that carried them.
The lighter the cell, the more CVEs. Point at one to read it.
| By vendor | 79XSS | 89SQL Injection | 787Out-of-bounds Write | 352CSRF | 416Use After Free | 200Information Exposure | 22Path Traversal | 476NULL Pointer Dereference | 125Out-of-bounds Read | 20Improper Input Validation |
|---|---|---|---|---|---|---|---|---|---|---|
| Сообщество Свободного Программного Обеспечения | 6 | 3 | 16 | 70 | 4 | 1 | 67 | 22 | 2 | |
| Linux | 11 | 63 | 65 | 16 | ||||||
| Ооо «ред Софт» | 4 | 1 | 17 | 1 | 54 | 3 | 2 | 38 | 15 | 7 |
| Ооо «русбитех-астра» | 1 | 17 | 45 | 1 | 3 | 49 | 18 | 2 | ||
| Ао «нппкт» | 1 | 13 | 40 | 3 | 2 | 43 | 14 | 1 | ||
| Red Hat Inc. | 6 | 28 | 1 | 2 | 33 | 7 | 2 | |||
| Canonical Ltd. | 9 | 22 | 1 | 27 | 5 | 2 | ||||
| Microsoft | 3 | 6 | 10 | 5 | 1 | 8 | 8 | |||
| Microsoft Corp | 3 | 9 | 12 | 5 | 1 | 1 | 11 | 8 | ||
| Ао «ивк» | 7 | 10 | 2 | 10 | 5 | 1 | ||||
| Novell Inc. | 5 | 14 | 1 | 12 | 8 | 1 | ||||
| Ао «нтц Ит Роса» | 9 | 8 | 2 | 10 | 8 | 1 |