November 2024
4,154 CVEs published, +13% on October 2024 and +62% on November 2023. CISA added 22 to KEV.
2024 month by month
- Critical
- 3489% of the 4,035 with a CVSS score
- Added to CISA KEV
- 2215 of this month's CVEs are in KEV, listed a median 6 days after publication
- Vendors
- 1,8094,948 products
- Top weakness
- XSSCWE-79 · 824 CVEs
Who drove it
Vendors by distinct CVEs this month, with how many of those CVEs are now in CISA KEV and how far each moved in the ranking.
- 1Сообщество Свободного Программного ОбеспеченияLinux, Debian Gnu/linux, Needrestart375124new
- 2LinuxLinux Kernel, Linux27901new
- 3Ооо «русбитех-астра»Astra Linux Special Edition, Astra Linux Common Edition, Astra Linux Special Edition Для «эльбрус»263123new
- 4Ооо «ред Софт»Ред Ос, Ред База Данных246111new
- 5Ао "нппкт"Осон Основа Оnyx21883new
- 6CanonicalUbuntu, Ubuntu's Pulseaudio16522new
- 7Red HatRed Hat Enterprise Linux, Red Hat Enterprise Linux 9, Red Hat Enterprise Linux 814823new
- 8GoogleAndroid, Chrome, Google Chrome13652new
- 9MicrosoftWindows Server 2022, Windows Server 2022 (Server Core Installation), Windows Server 2022 23h210653new
- 10CiscoCisco Catalyst SD-WAN Manager, Cisco SD-WAN, Catalyst SD-WAN Manager1043nonenew
- 11IrfanviewIrfanview, Formats870nonenew
- 12PackagistMoodle/moodle, Librenms/librenms, Symfony/symfony742nonenew
- 13IntelIntel Arc Graphics, Video Processing Library, Intel Iris XE Graphics590nonenew
- 14AdobeSubstance3d - Painter, Substance 3d Painter, Adobe Substance 3d Painter570nonenew
- 15PyPICalibreweb, Transformers, Aiohttp515nonenew
- 16Fedora ProjectFedora500nonenew
- 17IvantiEndpoint Manager, Connect Secure, Policy Secure498nonenew
- 18NetgearR7000P, R7000P Firmware, R8500 Firmware490nonenew
- 19MavenOrg.keycloak:keycloak-quarkus-server, Org.keycloak:keycloak-services, Ca.uhn.hapi.fhir:org.hl7.fhir.dstu3485nonenew
- 20Ао «ивк»Альт Сп 10, Альт 8 Сп477nonenew
- 21code-projectsE-health Care System, Farmacia, Job Recruitment460nonenew
- 22Novell Inc.Opensuse Leap, Suse Linux Enterprise Server, Suse Linux Enterprise Desktop4411new
- 23GoGithub.com/goharbor/harbor, Github.com/moby/moby, Github.com/drakkan/sftpgo/v2425nonenew
- 24Pdf-xchangePdf-xchange Editor, Pdf-tools390nonenew
- 25UnknownLogo Slider, Rss Feed Widget, Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin392nonenew
Severity
How this month's CVEs score on CVSS; 119 have no score yet. Severity is not exploitation.
- Critical348
- High1,472
- Medium2,067
- Low148
Breakouts
Vendors with at least three times their own 12-month median.
New in the top 100
Not in the top 100 in any of the 24 months before.
What kind of weakness
Weakness classes (CWE) by distinct CVEs, with how far each moved in the ranking.
- CWE-79XSS824
- CWE-862Missing Authorization261
- CWE-89SQL Injection245
- CWE-787Out-of-bounds Write239
- CWE-125Out-of-bounds Read198
- CWE-78OS Command Injection134
- CWE-22Path Traversal115
- CWE-120Buffer Overflow107
- CWE-74Injection104
- CWE-352CSRF99
- CWE-416Use After Free97
- CWE-94Code Injection93
- CWE-434Unrestricted File Upload89
- CWE-20Improper Input Validation71
- CWE-476NULL Pointer Dereference68
- CWE-122Heap Buffer Overflow65
- CWE-276Incorrect Default Permissions64
- CWE-77Command Injection62
- CWE-284Improper Access Control60
- CWE-200Information Exposure57
Where it landed
The month's CVEs by the sector of the software they affect. A CVE that touches several sectors counts in each.
- Web & CMS Plugins99021% of sector-tagged CVEs
- Operating Systems73815% of sector-tagged CVEs
- Enterprise Software54011% of sector-tagged CVEs
- OSS Libraries3898% of sector-tagged CVEs
- Consumer Software3567% of sector-tagged CVEs
- Networking Infrastructure3327% of sector-tagged CVEs
- Hardware Firmware2435% of sector-tagged CVEs
- Mobile Apps1904% of sector-tagged CVEs
- Security Products1844% of sector-tagged CVEs
- ICS / OT / IoT1814% of sector-tagged CVEs
- Not yet classified349
Which weakness, where
The top weakness classes against the vendors and the sectors that carried them.
The lighter the cell, the more CVEs. Point at one to read it.
| By vendor | 79XSS | 862Missing Authorization | 89SQL Injection | 787Out-of-bounds Write | 125Out-of-bounds Read | 78OS Command Injection | 22Path Traversal | 120Buffer Overflow | 74Injection | 352CSRF |
|---|---|---|---|---|---|---|---|---|---|---|
| Сообщество Свободного Программного Обеспечения | 6 | 1 | 1 | 13 | 23 | 3 | 6 | 5 | 2 | |
| Linux | 10 | 18 | 3 | |||||||
| Ооо «русбитех-астра» | 6 | 1 | 10 | 17 | 2 | 1 | 4 | 2 | ||
| Ооо «ред Софт» | 14 | 3 | 4 | 7 | 15 | 2 | 4 | 5 | 2 | |
| Ао «нппкт» | 7 | 7 | 16 | 2 | ||||||
| Canonical Ltd. | 1 | 7 | 16 | 2 | 4 | |||||
| 6 | 11 | 37 | 26 | 1 | 1 | |||||
| Red Hat Inc. | 2 | 4 | 13 | 2 | 1 | 4 | 1 | |||
| Microsoft Corp | 5 | 7 | ||||||||
| Cisco | 21 | 2 | 2 | 4 | 7 | 2 | 1 | |||
| Cisco Systems Inc. | 21 | 2 | 2 | 4 | 7 | 2 | 1 | |||
| Microsoft | 2 | 7 |