Month report
November 2019
Rolled up 2026-08-09 20:45 from 370,662 CVE records
1,679 CVEs published, +70.8% on the same month last year. 7 rated critical, 0 listed by CISA as exploited. google led with 109; the most common weakness class was CWE-79 (15). tibco software climbed 38 places, the largest move. 17 vendors ranked for the first time.
Published
1,679
Critical / high
7 / 63
Medium / low
97 / 9
Added to CISA KEV
0
Public exploit
85
Scanner template
0
Publication to KEV
How long before CISA listed them
Median days to listing
925
Listed within 7 days
0%
Listed within 30 days
0%
Vendors
Ranked by distinct CVEs this month
| # | Vendor | Top products | ||||||
|---|---|---|---|---|---|---|---|---|
| 1 | 109 | 2 | 2 | chrome (108) · chrome on 64 bit platforms (1) | · | |||
| 2 | adobe | 75 | 1 | magento 2 (52) · magento 1 (8) · adobe media encoder (5) | ↑1 | |||
| 3 | microsoft | 72 | 4 | 5 | windows (51) · windows server (51) · windows 10 version 1903 for x64 based systems (44) | ↑1 | ||
| 4 | qualcomm | 54 | 1 | snapdragon auto snapdragon compute snapdragon consumer iot snapdragon industrial iot snapdragon iot snapdragon mobile snapdragon voice music snapdragon wearables (11) · snapdragon auto snapdragon compute snapdragon consumer iot snapdragon industrial iot snapdragon mobile snapdragon voice music snapdragon wearables (5) · snapdragon auto snapdragon compute snapdragon connectivity snapdragon consumer iot snapdragon industrial iot snapdragon mobile snapdragon voice music snapdragon wearables (3) | · | |||
| 5 | cisco | 33 | 1 | 3 | cisco dna spaces (3) · cisco firepower threat defense software (3) · cisco email security appliance esa (2) | ↓3 | ||
| 6 | ibm | 23 | qradar (4) · smartcloud analytics (4) · cognos analytics (3) | — | ||||
| 7 | redhat | 23 | 2 | kernel (5) · ansible (2) · ipa (2) | ↑4 | |||
| 8 | nvidia | 12 | 1 | nvidia gpu display driver (5) · nvidia geforce experience (3) · nvidia vgpu display driver (3) | · | |||
| 9 | typo3 | 12 | typo3 (12) | new | ||||
| 10 | cryptocat | 11 | cryptocat (10) · message handling (1) | new | ||||
| 11 | f5 | 11 | big ip (5) · big ip afm (2) · big ip apm edge client (1) | · | ||||
| 12 | jenkins project | 11 | jenkins google compute engine plugin (3) · jenkins qmetry for jira test management plugin (2) · jenkins support core plugin (2) | ↓7 | ||||
| 13 | mcafee | 11 | 1 | 1 | advanced threat defense atd (7) · client proxy mcp (1) · data loss prevention (1) | ↑22 | ||
| 14 | moodle | 10 | moodle (10) | · | ||||
| 15 | sap se | 10 | s4hana sales s4core (1) · sap businessobjects business intelligence platform web intelligence (1) · sap businessobjects business intelligence platform web intelligence html interface (1) | ↓5 | ||||
| 16 | lenovo | 9 | lenovo system interface foundation (2) · thinkpad (2) · customer engagement service ccsdk (1) | · | ||||
| 17 | apache | 8 | 3 | apache arrow (2) · apache cxf (1) · atlas (1) | ↑7 | |||
| 18 | zte | 7 | c520v21 (2) · zxcdn iamweb (2) · zxupn 9000e (2) | ↑23 | ||||
| 19 | brocade communications systems | 6 | brocade sannav (6) | · | ||||
| 20 | hp | 6 | thinpro linux (5) · multiple see https support hp com rs en document c06456250 (1) | ↑34 | ||||
| 21 | fortinet | 5 | 1 | 1 | forticlient for mac os (3) · fortigate (2) · forticlient for windows (1) | ↑12 | ||
| 22 | kaspersky | 5 | kaspersky anti virus kaspersky internet security kaspersky total security kaspersky free anti virus kaspersky small office security kaspersky security cloud (4) · kaspersky protection extension for google chrome (1) | ↓7 | ||||
| 23 | jenkins | 4 | jenkins (4) | · | ||||
| 24 | medtronic | 4 | valleylab ft10 energy platform vlft10gen (4) · valleylab exchange client (2) · valleylab fx8 energy platform vlfx8gen (2) | · | ||||
| 25 | ruby | 4 | 1 | nokogiri gem (2) · ruby (2) | · | |||
| 26 | atlassian | 3 | jira service desk data center (2) · jira service desk server (2) · bamboo (1) | · | ||||
| 27 | computing for good | 3 | 2 | basic laboratory information system (3) | new | |||
| 28 | debian | 3 | icoutils (3) | ↑18 | ||||
| 29 | dolibarr | 3 | dolibarr (3) | new | ||||
| 30 | drupal6 | 3 | drupal6 (3) | new | ||||
| 31 | hardlink | 3 | hardlink (3) | new | ||||
| 32 | linux 2 6 | 3 | linux 2 6 (3) | new | ||||
| 33 | openfind | 3 | mail2000 (3) | new | ||||
| 34 | piwik | 3 | piwik (3) | new | ||||
| 35 | rsyslog | 3 | rsyslog (3) | new | ||||
| 36 | samba | 3 | samba (3) | · | ||||
| 37 | siemens | 3 | polarion (3) | ↓14 | ||||
| 38 | statusnet | 3 | statusnet (3) | new | ||||
| 39 | symantec | 3 | critical system protection csp (1) · norton applock (1) · sonar component (1) | ↑36 | ||||
| 40 | tibco software | 3 | tibco ebx add ons (2) · tibco ebx (1) | ↑38 | ||||
| 41 | vmware | 3 | workstation and fusion (3) | ↑38 | ||||
| 42 | w3 | 3 | total cache (3) | new | ||||
| 43 | activity | 2 | activity (2) | new | ||||
| 44 | beckhoff | 2 | twincat 2 (2) · twincat 3 1 (2) | · | ||||
| 45 | cloud foundry | 2 | routing (1) · uaa release (1) | ↓14 | ||||
| 46 | cobbler | 2 | cobbler (2) | new | ||||
| 47 | dell | 2 | 1 | emc storage m r (1) · integrated dell remote access controller idrac (1) | ↓22 | |||
| 48 | elgg | 2 | elgg (2) | new | ||||
| 49 | foomatic filters | 2 | foomatic filters (2) | new | ||||
| 50 | ghostscript | 2 | ghostscript (2) | new |
One CVE is counted once per vendor, product or weakness class it lists, so a ranking column sums to more than the month's total. Only the month's top 100 keys per dimension are stored. The KEV column counts CVEs published in 2019-11 that are on the CISA KEV catalog today. The 0 in the headline is what CISA listed during the month, whenever those CVEs were published. All 50 ranked vendors are listed; a zero count renders as a dot.
Weaknesses
CWE classes by distinct CVEs
- 1CWE-79150 critical—
- 2CWE-20120 critical↑4
- 3CWE-20070 critical↑4
- 4CWE-12260 critical↑6
- 5CWE-26460 critical↑9
- 6CWE-28462 critical↑6
- 7CWE-40060 critical↑1
- 8CWE-78761 critical↑8
- 9CWE-2250 critical↑2
- 10CWE-12540 critical↓5
- 1CWE-28741 critical·
- 2CWE-7841 critical↑1
- 3CWE-28530 critical↑37
- 4CWE-29530 critical↑38
- 5CWE-41630 critical↓12
- 6CWE-52230 critical↑6
- 7CWE-64830 critical·
- 8CWE-73230 critical↑18
- 9CWE-11920 critical↓15
- 10CWE-12120 critical↑5
One CVE is counted once per vendor, product or weakness class it lists, so a ranking column sums to more than the month's total. Only the month's top 100 keys per dimension are stored.