October 2024
3,667 CVEs published, +41% on September 2024 and +33% on October 2023. CISA added 17 to KEV.
2024 month by month
- Critical
- 36410% of the 3,576 with a CVSS score
- Added to CISA KEV
- 1717 of this month's CVEs are in KEV, listed a median 3 days after publication
- Vendors
- 2,0245,630 products
- Top weakness
- XSSCWE-79 · 735 CVEs
Who drove it
Vendors by distinct CVEs this month, with how many of those CVEs are now in CISA KEV and how far each moved in the ranking.
- 1Сообщество Свободного Программного ОбеспеченияLinux, Debian Gnu/linux, Ollama542192new
- 2LinuxLinux, Linux Kernel4151nonenew
- 3Ооо «русбитех-астра»Astra Linux Special Edition, Astra Linux Common Edition, Astra Linux Special Edition Для «эльбрус»31271new
- 4Ао "нппкт"Осон Основа Оnyx30671new
- 5Ооо «ред Софт»Ред Ос30261new
- 6CanonicalUbuntu, Juju, Authd2340nonenew
- 7Red HatRed Hat Enterprise Linux, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 92125nonenew
- 8MicrosoftWindows Server 2022, 23h2 Edition (Server Core Installation), Windows Server 2022 23h2, Windows Server 2019 (Server Core Installation)15223new
- 9Ао «ивк»Альт 8 Сп, Альт Сп 1013021new
- 10Novell Inc.Opensuse Leap, Suse Linux Enterprise Desktop, Suse Linux Enterprise Server For Sap Applications1001nonenew
- 11CiscoCisco Firepower Threat Defense Software, Secure Firewall Management Center, Firepower Threat Defense9441new
- 12OracleMySQL, MySQL Server, E-business Suite882nonenew
- 13ApplemacOS, iOS and iPadOS, iPhone OS843nonenew
- 14GoogleAndroid, Google Chrome, Chrome785nonenew
- 15PackagistMagento/community-edition, Funadmin/funadmin, Librenms/librenms724nonenew
- 16GoGithub.com/rancher/rancher, Github.com/juju/juju, Github.com/mattermost/mattermost/server/v8654nonenew
- 17DlinkDir-605l, Dir-605l Firmware, Dir-619l552nonenew
- 18AdobeMagento, Commerce, Adobe Commerce541nonenew
- 19npm@saltcorn/server, Dompurify, @openc3/tool-common539nonenew
- 20PyPIGradio, Lollms, Open-webui458nonenew
- 21MavenCom.liferay.portal:release.dxp.bom, Com.liferay.portal:release.portal.bom, Org.openrefine:openrefine447nonenew
- 22code-projectsPharmacy Management System, Blood Bank Management System, Blood Bank System420nonenew
- 23D-LinkDir-605l, Dir-619l B1, Dsl-2750u400nonenew
- 24PhpgurukulBoat Booking System, Medical Card Generation System, User Registration \& Login and User Management System404nonenew
- 25SiemensTecnomatix Plant Simulation, Teamcenter Visualization V14.3, Teamcenter Visualization V14.2353nonenew
Severity
How this month's CVEs score on CVSS; 91 have no score yet. Severity is not exploitation.
- Critical364
- High1,290
- Medium1,795
- Low127
Breakouts
Vendors with at least three times their own 12-month median.
New in the top 100
Not in the top 100 in any of the 24 months before.
What kind of weakness
Weakness classes (CWE) by distinct CVEs, with how far each moved in the ranking.
- CWE-79XSS735
- CWE-89SQL Injection273
- CWE-416Use After Free121
- CWE-862Missing Authorization120
- CWE-476NULL Pointer Dereference118
- CWE-787Out-of-bounds Write117
- CWE-22Path Traversal107
- CWE-434Unrestricted File Upload96
- CWE-863Incorrect Authorization90
- CWE-125Out-of-bounds Read89
- CWE-352CSRF88
- CWE-120Buffer Overflow83
- CWE-94Code Injection68
- CWE-200Information Exposure67
- CWE-78OS Command Injection67
- CWE-77Command Injection59
- CWE-306Missing Auth for Critical Function49
- CWE-20Improper Input Validation46
- CWE-284Improper Access Control44
- CWE-122Heap Buffer Overflow41
Where it landed
The month's CVEs by the sector of the software they affect. A CVE that touches several sectors counts in each.
- Web & CMS Plugins97823% of sector-tagged CVEs
- Operating Systems89121% of sector-tagged CVEs
- OSS Libraries43210% of sector-tagged CVEs
- Enterprise Software3408% of sector-tagged CVEs
- Networking Infrastructure3137% of sector-tagged CVEs
- Mobile Apps1794% of sector-tagged CVEs
- Security Products1654% of sector-tagged CVEs
- 8 smaller sectors734
- Not yet classified312
Which weakness, where
The top weakness classes against the vendors and the sectors that carried them.
The lighter the cell, the more CVEs. Point at one to read it.
| By vendor | 79XSS | 89SQL Injection | 416Use After Free | 476NULL Pointer Dereference | 787Out-of-bounds Write | 862Missing Authorization | 22Path Traversal | 434Unrestricted File Upload | 125Out-of-bounds Read | 352CSRF |
|---|---|---|---|---|---|---|---|---|---|---|
| Сообщество Свободного Программного Обеспечения | 11 | 2 | 79 | 98 | 16 | 2 | 9 | 2 | 17 | |
| Linux | 69 | 98 | 11 | 1 | 10 | |||||
| Ооо «русбитех-астра» | 2 | 47 | 54 | 14 | 1 | 3 | 10 | |||
| Ао «нппкт» | 2 | 50 | 49 | 12 | 3 | 8 | ||||
| Ооо «ред Софт» | 2 | 41 | 43 | 14 | 4 | 11 | ||||
| Canonical Ltd. | 21 | 51 | 8 | 1 | 7 | |||||
| Red Hat Inc. | 2 | 27 | 19 | 7 | 4 | 2 | ||||
| Microsoft Corp | 3 | 1 | 19 | 2 | 2 | 12 | ||||
| Microsoft | 4 | 1 | 12 | 2 | 2 | 12 | ||||
| Ао «ивк» | 18 | 18 | 6 | 2 | 7 | |||||
| Novell Inc. | 7 | 21 | 1 | 1 | 1 | 2 | ||||
| Cisco | 18 | 4 | 2 | 11 | 4 | 2 | 1 |