December 2024
3,514 CVEs published, −15% on November 2024 and +27% on December 2023. CISA added 16 to KEV.
2024 month by month
- Critical
- 3169% of the 3,397 with a CVSS score
- Added to CISA KEV
- 1611 of this month's CVEs are in KEV, listed a median 28 days after publication
- Vendors
- 1,6244,191 products
- Top weakness
- XSSCWE-79 · 712 CVEs
Who drove it
Vendors by distinct CVEs this month, with how many of those CVEs are now in CISA KEV and how far each moved in the ranking.
- 1Сообщество Свободного Программного ОбеспеченияLinux, Debian Gnu/linux, Drupal456323new
- 2LinuxLinux, Linux Kernel35403new
- 3Ооо «русбитех-астра»Astra Linux Special Edition, Astra Linux Common Edition, Astra Linux Special Edition Для «эльбрус»291183new
- 4Ао "нппкт"Осон Основа Оnyx272173new
- 5Ооо «ред Софт»Ред Ос256253new
- 6CanonicalUbuntu, Lxd2062nonenew
- 7Red HatRed Hat Enterprise Linux, Red Hat Build of Keycloak, Red Hat Openshift Container Platform196172new
- 8AdobeAdobe Experience Manager, Experience Manager, Adobe Connect1773nonenew
- 9Novell Inc.Opensuse Leap, Suse Linux Enterprise Server, Suse Linux Enterprise Desktop9561new
- 10MicrosoftWindows Server 2025, Windows Server 2025 (Server Core Installation), Windows Server 2022, 23h2 Edition (Server Core Installation)9131new
- 11GoogleAndroid, Chrome, Google Chrome6441new
- 12ApplemacOS, iOS and iPadOS, iPadOS626nonenew
- 13code-projectsJob Recruitment, Simple Admin Panel, Online Class and Exam Scheduling System560nonenew
- 14IBMCognos Controller, Cognos Analytics, Security Guardium Key Lifecycle Manager561nonenew
- 15HuaweiHarmonyos, Secospace USG6300 Firmware, Secospace USG6500541nonenew
- 16Ооо «открытая Мобильная Платформа»Ос Аврора, Аврора Центр54163new
- 17PhpgurukulLand Record System, Maid Hiring Management System, Online Nurse Hiring System475nonenew
- 18PackagistDrupal/core, Drupal/core-recommended, Drupal/drupal4271new
- 19GoGithub.com/siyuan-note/siyuan/kernel, Github.com/mattermost/mattermost/server/v8, Github.com/cosmwasm/wasmvm395nonenew
- 20MavenOrg.apache.tomcat:tomcat-catalina, Org.keycloak:keycloak-quarkus-server, Org.apache.tomcat.embed:tomcat-embed-core3910nonenew
- 21Ооо «нцпр»Мсвсфера3717nonenew
- 22UnknownWordPress Button Plugin Maxbuttons, Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content, System Dashboard361nonenew
- 23DellRecoverpoint For Virtual Machines, Elastic Cloud Storage, Ecs351nonenew
- 24PyPIMatrix-synapse, Apache-superset, Django325nonenew
- 25GstreamerGstreamer2916nonenew
Severity
How this month's CVEs score on CVSS; 117 have no score yet. Severity is not exploitation.
- Critical316
- High1,123
- Medium1,840
- Low118
Breakouts
Vendors with at least three times their own 12-month median.
New in the top 100
Not in the top 100 in any of the 24 months before.
What kind of weakness
Weakness classes (CWE) by distinct CVEs, with how far each moved in the ranking.
- CWE-79XSS712
- CWE-862Missing Authorization423
- CWE-89SQL Injection243
- CWE-352CSRF174
- CWE-787Out-of-bounds Write146
- CWE-476NULL Pointer Dereference123
- CWE-94Code Injection117
- CWE-125Out-of-bounds Read111
- CWE-74Injection105
- CWE-416Use After Free102
- CWE-22Path Traversal65
- CWE-200Information Exposure52
- CWE-434Unrestricted File Upload47
- CWE-362Race Condition45
- CWE-284Improper Access Control44
- CWE-120Buffer Overflow42
- CWE-20Improper Input Validation41
- CWE-78OS Command Injection40
- CWE-863Incorrect Authorization36
- CWE-40135
Where it landed
The month's CVEs by the sector of the software they affect. A CVE that touches several sectors counts in each.
- Web & CMS Plugins1,06227% of sector-tagged CVEs
- Operating Systems72518% of sector-tagged CVEs
- Enterprise Software43111% of sector-tagged CVEs
- OSS Libraries3208% of sector-tagged CVEs
- Consumer Software2336% of sector-tagged CVEs
- Mobile Apps2025% of sector-tagged CVEs
- 9 smaller sectors686
- Not yet classified290
Which weakness, where
The top weakness classes against the vendors and the sectors that carried them.
The lighter the cell, the more CVEs. Point at one to read it.
| By vendor | 79XSS | 862Missing Authorization | 89SQL Injection | 352CSRF | 787Out-of-bounds Write | 476NULL Pointer Dereference | 94Code Injection | 125Out-of-bounds Read | 74Injection | 416Use After Free |
|---|---|---|---|---|---|---|---|---|---|---|
| Сообщество Свободного Программного Обеспечения | 9 | 1 | 7 | 1 | 21 | 85 | 2 | 26 | 6 | 58 |
| Linux | 11 | 75 | 11 | 56 | ||||||
| Ооо «русбитех-астра» | 19 | 57 | 23 | 44 | ||||||
| Ао «нппкт» | 1 | 16 | 47 | 21 | 47 | |||||
| Ооо «ред Софт» | 10 | 1 | 19 | 41 | 20 | 32 | ||||
| Canonical Ltd. | 1 | 6 | 43 | 7 | 33 | |||||
| Red Hat Inc. | 1 | 1 | 12 | 33 | 19 | 27 | ||||
| Adobe | 100 | 24 | 7 | 14 | 7 | |||||
| Adobe Systems Inc. | 100 | 24 | 6 | 11 | 7 | |||||
| Novell Inc. | 1 | 5 | 21 | 6 | 7 | |||||
| Microsoft Corp | 2 | 1 | 14 | 16 | ||||||
| Microsoft | 1 | 3 | 13 | 15 |