Month report
December 2019
Rolled up 2026-08-09 20:45 from 370,662 CVE records
1,578 CVEs published, +35.7% on the same month last year. 34 rated critical, 0 listed by CISA as exploited. apple led with 245; the most common weakness class was CWE-122 (22). apple climbed 81 places, the largest move. 17 vendors ranked for the first time.
Published
1,578
Critical / high
34 / 65
Medium / low
78 / 8
Added to CISA KEV
0
Public exploit
126
Scanner template
0
Publication to KEV
How long before CISA listed them
Median days to listing
849
Listed within 7 days
0%
Listed within 30 days
0%
Vendors
Ranked by distinct CVEs this month
| # | Vendor | Top products | ||||||
|---|---|---|---|---|---|---|---|---|
| 1 | apple | 245 | 5 | 36 | ios (162) · macos (142) · tvos (131) | ↑81 | ||
| 2 | siemens | 68 | 3 | sppa t3000 ms3000 migration server (35) · sppa t3000 application server (18) · control center server ccs (6) | ↑35 | |||
| 3 | qualcomm | 48 | snapdragon auto snapdragon compute snapdragon consumer iot snapdragon industrial iot snapdragon iot snapdragon mobile snapdragon voice music snapdragon wearables (8) · snapdragon auto snapdragon consumer electronics connectivity snapdragon consumer iot snapdragon industrial iot snapdragon mobile snapdragon voice music (4) · snapdragon auto snapdragon compute snapdragon connectivity snapdragon consumer electronics connectivity snapdragon consumer iot snapdragon industrial iot snapdragon iot snapdragon mobile snapdragon voice music snapdragon wearables snapdragon wired infrastructure and networking (3) | ↑1 | ||||
| 4 | 41 | 1 | chrome (41) | ↓3 | ||||
| 5 | ibm | 34 | 3 | 1 | 1 | cloud pak system (8) · cognos analytics (4) · financial transaction manager (4) | ↑1 | |
| 6 | microsoft | 31 | 1 | 3 | windows (19) · windows server (17) · windows 10 version 1903 for x64 based systems (14) | ↓3 | ||
| 7 | jenkins project | 28 | jenkins build failure analyzer plugin (3) · jenkins team concert plugin (3) · jenkins websphere deployer plugin (3) | ↑5 | ||||
| 8 | adobe | 25 | 1 | adobe acrobat and reader (21) · adobe photoshop cc (2) · brackets (1) | ↓6 | |||
| 9 | f5 | 15 | big ip (10) · big ip asm (2) · big ip apm (1) | ↑2 | ||||
| 10 | redhat | 11 | tower (3) · libyang (2) · samba (2) | ↓3 | ||||
| 11 | sonicwall | 11 | 2 | 2 | sma100 (6) · email security appliance (2) · sonicos (2) | · | ||
| 12 | trend micro | 10 | trend micro security consumer (3) · trend micro housecall for home networks (2) · trend micro antivirus for mac (1) | · | ||||
| 13 | apache | 9 | 1 | 3 | olingo (3) · apache spamassassin (2) · apache tomcat (2) | ↑4 | ||
| 14 | huawei | 9 | usg9500 (4) · elle al00b (1) · m5 lite 10 (1) | · | ||||
| 15 | sap se | 9 | sap enable now (3) · sap treasury and risk management ea finserv (2) · sap treasury and risk management s4core (2) | — | ||||
| 16 | dell | 8 | rsa identity governance lifecycle (3) · dell command update dcu (2) · cpg bios (1) | ↑31 | ||||
| 17 | atlassian | 7 | crucible (3) · fisheye (3) · application links (1) | ↑9 | ||||
| 18 | 7 | hhvm (3) · mcrouter (2) · folly (1) | · | |||||
| 19 | kaspersky | 6 | tigervnc (5) · kaspersky secure connection kaspersky internet security kaspersky total security kaspersky security cloud (1) | ↑3 | ||||
| 20 | php group | 6 | php (6) | · | ||||
| 21 | abb | 4 | pb610 panel builder 600 (3) · abb pb610 panel builder 600 (1) | · | ||||
| 22 | tibco software | 4 | tibco spotfire analytics platform for aws marketplace (4) · tibco spotfire server (3) · tibco spotfire analyst (1) | ↑18 | ||||
| 23 | katello | 3 | katello (3) | new | ||||
| 24 | mcafee | 3 | mcafee web advisor wa (2) · mcafee techcheck (1) | ↓11 | ||||
| 25 | npm | 3 | cli (3) | · | ||||
| 26 | pylons | 3 | waitress (3) | new | ||||
| 27 | zte | 3 | zxcloud goldendata vap (3) | ↓9 | ||||
| 28 | andrei lupu | 2 | custom body class (2) | new | ||||
| 29 | appleple | 2 | a blog cms (2) | new | ||||
| 30 | cloud foundry | 2 | capi (1) · uaa release (1) | ↑15 | ||||
| 31 | cybozu | 2 | cybozu office (2) | · | ||||
| 32 | d link japan k k | 2 | dba 1510p (2) | new | ||||
| 33 | docker | 2 | cs docker engine (2) · docker engine (2) | · | ||||
| 34 | edeploy | 2 | edeploy (2) | new | ||||
| 35 | jasig project | 2 | php pear cas (1) · phpcas (1) | new | ||||
| 36 | jboss keycloak | 2 | 1 | jboss keycloak (2) | new | |||
| 37 | kubernetes | 2 | kubernetes (1) · kubernetes csi external provisioner (1) · kubernetes csi external resizer (1) | · | ||||
| 38 | ldap account manager | 2 | ldap account manager lam (1) · ldap account manager lam pro (1) | new | ||||
| 39 | lenovo | 2 | 1 | energy management driver (1) · power management driver (1) | ↓23 | |||
| 40 | micro focus international | 2 | acutoweb (1) · arcsight logger (1) | · | ||||
| 41 | monkey | 2 | monkey (2) | new | ||||
| 42 | openshift | 2 | openshift (1) · openshift enterprise (1) | new | ||||
| 43 | palo alto networks | 2 | 1 | pan os (2) | · | |||
| 44 | piwigo | 2 | piwigo (2) | new | ||||
| 45 | python keystoneclient | 2 | python keystoneclient (2) | new | ||||
| 46 | remise | 2 | remise payment module 2 11 2 12 and 2 13 (2) | new | ||||
| 47 | tms plugins | 2 | wpdatatables lite (2) | new | ||||
| 48 | wordpress | 2 | wordpress (2) | new | ||||
| 49 | alfasado | 1 | powercms (1) | new | ||||
| 50 | amazon | 1 | blink xt2 sync module firmware (1) | · |
One CVE is counted once per vendor, product or weakness class it lists, so a ranking column sums to more than the month's total. Only the month's top 100 keys per dimension are stored. The KEV column counts CVEs published in 2019-12 that are on the CISA KEV catalog today. The 0 in the headline is what CISA listed during the month, whenever those CVEs were published. All 50 ranked vendors are listed; a zero count renders as a dot.
Weaknesses
CWE classes by distinct CVEs
- 1CWE-122220 critical↑3
- 2CWE-287163 critical↑9
- 3CWE-79110 critical↓2
- 4CWE-190101 critical↑17
- 5CWE-200100 critical↓2
- 6CWE-2293 critical↑3
- 7CWE-12180 critical↑13
- 8CWE-78785 critical—
- 9CWE-8980 critical↑24
- 10CWE-12571 critical—
- 1CWE-9472 critical↑49
- 2CWE-2061 critical↓10
- 3CWE-28460 critical↓7
- 4CWE-30651 critical·
- 5CWE-41651 critical—
- 6CWE-50253 critical↑10
- 7CWE-28530 critical↓4
- 8CWE-42730 critical↑33
- 9CWE-44030 critical·
- 10CWE-44430 critical·
One CVE is counted once per vendor, product or weakness class it lists, so a ranking column sums to more than the month's total. Only the month's top 100 keys per dimension are stored.