Month report
January 2020
Rolled up 2026-08-09 20:45 from 370,662 CVE records
1,655 CVEs published, +36.6% on the same month last year. 21 rated critical, 0 listed by CISA as exploited. oracle led with 203; the most common weakness class was CWE-79 (30). microsoft climbed 4 places, the largest move. 14 vendors ranked for the first time.
Published
1,655
+4.9%on the previous month
Critical / high
21 / 132
of the 438 scored
Medium / low
253 / 32
the rest of the scored bands
Added to CISA KEV
0
listed as exploited this month
Public exploit
184
exploit code indexed publicly
Scanner template
0
0% of the month
Publication to KEV
How long before CISA listed them
7 published this month and listed since — not the 0 listed during it.
Median days to listing
786
from publication to CISA's date added
Listed within 7 days
0%
of the 7
Listed within 30 days
0%
of the 7
Vendors
Ranked by distinct CVEs this month
Δ is the move against last month's rank.
| # | Vendor | Top products | ||||||
|---|---|---|---|---|---|---|---|---|
| 1 | oracle | 203 | 5 | 2 | 4 | enterprise manager base platform (36) · vm virtualbox (18) · mysql server (15) | · | |
| 2 | microsoft | 61 | 1 | 3 | 6 | windows server (36) · windows (31) · windows 10 version 1903 for 32 bit systems (30) | ↑4 | |
| 3 | cisco | 41 | 3 | 6 | cisco data center network manager (12) · cisco ios xr software (5) · cisco sd wan solution (3) | · | ||
| 4 | mozilla | 37 | firefox (37) · firefox esr (22) · thunderbird (15) | · | ||||
| 5 | qualcomm | 28 | snapdragon auto snapdragon compute snapdragon connectivity snapdragon consumer iot snapdragon industrial iot snapdragon iot snapdragon mobile snapdragon voice music snapdragon wearables (10) · snapdragon auto snapdragon compute snapdragon consumer iot snapdragon industrial iot snapdragon mobile snapdragon voice music snapdragon wearables (2) · snapdragon auto snapdragon compute snapdragon consumer iot snapdragon industrial iot snapdragon mobile snapdragon wearables (2) | ↓2 | ||||
| 6 | redhat | 24 | 1 | jboss eap (2) · jboss portal (2) · quay (2) | ↑4 | |||
| 7 | ibm | 19 | 1 | security secret server (8) · mq (2) · qradar siem (2) | ↓2 | |||
| 8 | jenkins project | 19 | 1 | jenkins (7) · jenkins amazon ec2 plugin (2) · jenkins health advisor by cloudbees plugin (2) | ↓1 | |||
| 9 | adobe | 17 | magento (6) · adobe illustrator cc (5) · adobe experience manager (4) | ↓1 | ||||
| 10 | gitlab | 16 | gitlab ce ee (7) · gitlab (4) · gitlab ee (4) | · | ||||
| 11 | apache | 14 | 2 | apache nifi (2) · apache spamassassin (2) · cxf (2) | ↑2 | |||
| 12 | suse | 13 | factory (4) · suse linux enterprise server 15 (4) · leap 15 1 (2) | · | ||||
| 13 | symantec | 12 | 1 | it management suite (3) · norton mobile security for android (3) · encryption desktop (1) | · | |||
| 14 | juniper networks | 11 | 1 | junos os (10) · junos os evolved (3) · junos space (1) | · | |||
| 15 | opensuse | 11 | factory (7) · leap 15 1 (6) · suse linux enterprise server 15 (3) | · | ||||
| 16 | bitdefender | 9 | 1 | bitdefender box 2 (3) · bitdefender antivirus for mac (2) · bdserviceshost exe (1) | · | |||
| 17 | 9 | chrome (8) · android (1) | ↓13 | |||||
| 18 | intel | 8 | 1 | intel r processors (3) · intel r chipset device software inf utility (1) · intel r daal (1) | · | |||
| 19 | xnview | 7 | xnview (7) | new | ||||
| 20 | abrt | 6 | abrt (6) | new | ||||
| 21 | hp | 6 | hp deskjet 3630 all in one printer series (2) · 389 directory server (1) · elitebook 850 g1 (1) | · | ||||
| 22 | nethack | 6 | nethack (6) | new | ||||
| 23 | opencast | 6 | opencast (6) | new | ||||
| 24 | telos | 6 | automated message handling system (6) | new | ||||
| 25 | postgresql global development group | 5 | postgresql (5) | · | ||||
| 26 | qemu | 5 | qemu (5) | · | ||||
| 27 | sap se | 5 | automated note search tool sap basis (1) · sap disclosure management (1) · sap leasing ea appl (1) | ↓12 | ||||
| 28 | siemens | 5 | apogee mec mbc pxc p2 (1) · apogee pxc compact bacnet (1) · apogee pxc compact p2 ethernet (1) | ↓26 | ||||
| 29 | trend micro | 5 | trend micro password manager (2) · trend micro security consumer (2) · trend micro anti threat toolkit attk (1) | ↓17 | ||||
| 30 | anglersnet co | 4 | access analysis cgi an analyzer (4) | new | ||||
| 31 | fuji xerox co | 4 | awms mobile app (1) · kantan netprint app for android (1) · kantan netprint app for ios (1) | · | ||||
| 32 | joomla | 4 | 1 | joomla (3) · joomla core (1) | new | |||
| 33 | the tor project | 4 | tor (4) | new | ||||
| 34 | atlassian | 3 | bitbucket data center (3) · bitbucket server (3) | ↓17 | ||||
| 35 | dell | 3 | 1 | elitebook 850 g1 (1) · latitude e6430 (1) · rsa authentication manager (1) | ↓19 | |||
| 36 | fortinet | 3 | fortinet fortisiem (2) · fortiauthenticator web ui (1) | · | ||||
| 37 | huawei | 3 | honor magic2 (1) · huawei mate 20 (1) · huawei mate 20 pro (1) | ↓23 | ||||
| 38 | info zip | 3 | unzip (3) | · | ||||
| 39 | irfanview | 3 | mrsid plugin (3) | · | ||||
| 40 | otrs | 3 | otrs (3) · otrs community edition (3) | new | ||||
| 41 | pivotal | 3 | pivotal ops manager (1) · pivotal tc server 3 x (1) · pivotal tc server 3 x runtimes (1) | · | ||||
| 42 | schneider electric se | 3 | modicon m580 modicon m340 modicon quantum modicon premium see security notification for specific versions (3) | · | ||||
| 43 | websitebaker | 3 | websitebaker (3) | new | ||||
| 44 | american megatrends incorporated ami | 2 | bios (2) · sct3 (2) | new | ||||
| 45 | broadcom | 2 | brcmfmac wifi driver (2) | new | ||||
| 46 | chamilo | 2 | chamilo (2) | new | ||||
| 47 | cloudbees | 2 | jenkins (2) · jenkins lts (2) | new | ||||
| 48 | drupal | 2 | data module (2) | · | ||||
| 49 | f5 | 2 | big ip (1) · big ip apm (1) | ↓40 | ||||
| 50 | hpe | 2 | hpe enhanced internet usage manager eium (1) · hpe superdome flex server (1) | · |
One CVE is counted once per vendor, product or weakness class it lists, so a ranking column sums to more than the month's total. Only the month's top 100 keys per dimension are stored. The KEV column counts CVEs published in 2020-01 that are on the CISA KEV catalog today. The 0 in the headline is what CISA listed during the month, whenever those CVEs were published. All 50 ranked vendors are listed; a zero count renders as a dot.
Weaknesses
CWE classes by distinct CVEs
- 1CWE-79301 critical↑2
- 2CWE-20130 critical↑10
- 3CWE-12090 critical↑37
- 4CWE-5990 critical↑17
- 5CWE-20080 critical—
- 6CWE-28480 critical↑7
- 7CWE-7881 critical↑15
- 8CWE-12170 critical↓1
- 9CWE-79873 critical·
- 10CWE-2260 critical↓4
- 1CWE-41660 critical↑4
- 2CWE-53260 critical↑52
- 3CWE-75450 critical·
- 4CWE-8950 critical↓5
- 5CWE-26440 critical·
- 6CWE-40040 critical↑40
- 7CWE-44440 critical↑3
- 8CWE-27630 critical↑27
- 9CWE-28530 critical↓2
- 10CWE-28730 critical↓18
One CVE is counted once per vendor, product or weakness class it lists, so a ranking column sums to more than the month's total. Only the month's top 100 keys per dimension are stored.