September 2024
2,594 CVEs published, −14% on August 2024 and −9% on September 2023. CISA added 25 to KEV.
2024 month by month
- Critical
- 24110% of the 2,532 with a CVSS score
- Added to CISA KEV
- 2513 of this month's CVEs are in KEV, listed a median 40 days after publication
- Vendors
- 1,1604,539 products
- Top weakness
- XSSCWE-79 · 414 CVEs
Who drove it
Vendors by distinct CVEs this month, with how many of those CVEs are now in CISA KEV and how far each moved in the ranking.
- 1Сообщество Свободного Программного ОбеспеченияLinux, Debian Gnu/linux, Mindsdb3668none—
- 2LinuxLinux, Linux Kernel2770none+1
- 3Ооо «русбитех-астра»Astra Linux Special Edition, Astra Linux Common Edition, Astra Linux Special Edition Для «эльбрус»2437none+1
- 4Ао "нппкт"Осон Основа Оnyx2405none+1
- 5Ооо «ред Софт»Ред Ос, Ред База Данных2234none−3
- 6Red HatRed Hat Enterprise Linux, Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 91708none+2
- 7CanonicalUbuntu, Anbox Cloud1300none−1
- 8MicrosoftWindows Server 2022, 23h2 Edition (Server Core Installation), Windows Server 2022, Windows Server 2022 23h210734−1
- 9ApplemacOS, iPhone OS, iOS and iPadOS912nonenew
- 10UnknownWp Multitasking, Music Request Manager, Starbox783none+9
- 11Ао «ивк»Альт Сп 10, Альт 8 Сп672none+4
- 12GoogleAndroid, Chrome, Google Chrome601none—
- 13PyPIMindsdb, Micropython-copy, Micropython-io538none+9
- 14SourcecodesterFood Ordering Management System, Best House Rental Management System, Online Railway Reservation System500none−5
- 15npmLunary, Mattermost-desktop, Agnai472none+13
- 16GoGithub.com/nvidia/nvidia-container-toolkit, Github.com/zitadel/zitadel/v2, Github.com/hashicorp/vault406none−3
- 17DraytekVigor3910 Firmware, Vigor 3910, Vigor 2766380nonenew
- 18MavenOrg.keycloak:keycloak-services, Org.keycloak:keycloak-core, Org.xwiki.platform:xwiki-platform-notifications-ui384none+16
- 19OpennetworkingLibfluid Msg370nonenew
- 20Open Networking Foundation (Onf)Libfluid370nonenew
- 21PackagistMautic/core, Mautic/core-lib, Concrete5/concrete5361none−4
- 22SamsungAndroid, Exynos 1380 Firmware, Exynos 850 Firmware360none+3
- 23CiscoCisco IOS XE Software, IOS XE, Cisco IOS XR Software3211+16
- 24AdobeIllustrator 2023, Illustrator, Media Encoder291none−14
- 25QnapQuts Hero, Qts, Qutscloud260nonenew
Severity
How this month's CVEs score on CVSS; 62 have no score yet. Severity is not exploitation.
- Critical241
- High882
- Medium1,301
- Low108
Breakouts
Vendors with at least three times their own 12-month median.
New in the top 100
Not in the top 100 in any of the 24 months before.
What kind of weakness
Weakness classes (CWE) by distinct CVEs, with how far each moved in the ranking.
- CWE-79XSS414
- CWE-89SQL Injection146
- CWE-787Out-of-bounds Write106
- CWE-476NULL Pointer Dereference89
- CWE-125Out-of-bounds Read87
- CWE-22Path Traversal80
- CWE-120Buffer Overflow70
- CWE-200Information Exposure69
- CWE-416Use After Free69
- CWE-862Missing Authorization65
- CWE-352CSRF61
- CWE-94Code Injection61
- CWE-78OS Command Injection58
- CWE-284Improper Access Control55
- CWE-20Improper Input Validation43
- CWE-77Command Injection43
- CWE-269Improper Privilege Mgmt38
- CWE-863Incorrect Authorization37
- CWE-12134
- CWE-122Heap Buffer Overflow33
Where it landed
The month's CVEs by the sector of the software they affect. A CVE that touches several sectors counts in each.
- Operating Systems65020% of sector-tagged CVEs
- Web & CMS Plugins53917% of sector-tagged CVEs
- OSS Libraries36111% of sector-tagged CVEs
- Enterprise Software32110% of sector-tagged CVEs
- Networking Infrastructure2558% of sector-tagged CVEs
- Mobile Apps2096% of sector-tagged CVEs
- Hardware Firmware1444% of sector-tagged CVEs
- 8 smaller sectors602
- Not yet classified183
Which weakness, where
The top weakness classes against the vendors and the sectors that carried them.
The lighter the cell, the more CVEs. Point at one to read it.
| By vendor | 79XSS | 89SQL Injection | 787Out-of-bounds Write | 476NULL Pointer Dereference | 125Out-of-bounds Read | 22Path Traversal | 120Buffer Overflow | 416Use After Free | 200Information Exposure | 862Missing Authorization |
|---|---|---|---|---|---|---|---|---|---|---|
| Сообщество Свободного Программного Обеспечения | 1 | 1 | 26 | 64 | 8 | 1 | 2 | 34 | 2 | 1 |
| Linux | 16 | 64 | 8 | 30 | ||||||
| Ооо «русбитех-астра» | 22 | 44 | 6 | 2 | 26 | 2 | ||||
| Ао «нппкт» | 1 | 18 | 49 | 6 | 32 | 1 | ||||
| Ооо «ред Софт» | 1 | 17 | 36 | 6 | 2 | 24 | 1 | 1 | ||
| Red Hat Inc. | 14 | 28 | 4 | 2 | 15 | 1 | 1 | |||
| Canonical Ltd. | 10 | 34 | 4 | 8 | 1 | |||||
| Microsoft Corp | 3 | 5 | 2 | 4 | 17 | |||||
| Apple | 3 | 2 | 5 | 3 | 1 | 15 | 1 | |||
| Microsoft | 2 | 1 | 2 | 4 | 11 | |||||
| Ао «ивк» | 5 | 4 | 7 | 2 | 13 | |||||
| 1 | 17 | 5 | 1 | 1 | 9 | 2 |