Month report
February 2020
Rolled up 2026-08-09 20:45 from 381,136 CVE records
1,397 CVEs published, +66.7% on the same month last year. 32 rated critical, 0 listed by CISA as exploited. microsoft led with 99; the most common weakness class was CWE-79 (19). d link climbed 47 places, the largest move. 9 vendors ranked for the first time.
Published
1,397
-15.6%on the previous month
Critical / high
32 / 109
of the 259 scored
Medium / low
110 / 8
the rest of the scored bands
Added to CISA KEV
0
listed as exploited this month
Public exploit
154
exploit code indexed publicly
Scanner template
0
0% of the month
Publication to KEV
How long before CISA listed them
16 published this month and listed since — not the 0 listed during it.
Median days to listing
636.5
from publication to CISA's date added
Listed within 7 days
0%
of the 16
Listed within 30 days
0%
of the 16
Vendors
Ranked by distinct CVEs this month
Δ is the move against last month's rank.
| # | Vendor | Top products | ||||||
|---|---|---|---|---|---|---|---|---|
| 1 | microsoft | 99 | 1 | 4 | 8 | windows (77) · windows server (77) · windows 10 version 1909 for x64 based systems (74) | ↑1 | |
| 2 | ibm | 52 | 5 | security directory server (6) · spectrum protect plus (6) · db2 for linux unix and windows (5) | ↑5 | |||
| 3 | apple | 47 | 1 | 2 | ios (31) · macos (26) · tvos (21) | · | ||
| 4 | 46 | 1 | 2 | chrome (42) · android (4) | ↑13 | |||
| 5 | adobe | 44 | 1 | adobe framemaker (21) · adobe acrobat and reader (17) · adobe digital editions (2) | ↑4 | |||
| 6 | cisco | 36 | 1 | 2 | 2 | cisco data center network manager (3) · cisco unified computing system managed (3) · cisco adaptive security appliance asa software (2) | ↓3 | |
| 7 | jenkins project | 26 | jenkins pipeline github notify step plugin (3) · jenkins git parameter plugin (2) · jenkins harvest scm plugin (2) | ↑1 | ||||
| 8 | huawei | 22 | nip6800 (9) · secospace usg6600 usg9500 (5) · secospace usg6600 (4) | ↑29 | ||||
| 9 | foxit | 18 | phantompdf (10) · reader (8) | · | ||||
| 10 | qualcomm | 14 | 2 | snapdragon auto snapdragon compute snapdragon connectivity snapdragon consumer iot snapdragon industrial iot snapdragon iot snapdragon mobile snapdragon voice music snapdragon wearables (2) · snapdragon auto snapdragon compute snapdragon consumer electronics connectivity snapdragon consumer iot snapdragon industrial iot snapdragon mobile snapdragon voice music (2) · snapdragon auto snapdragon compute snapdragon consumer iot snapdragon industrial iot snapdragon iot snapdragon mobile snapdragon voice music snapdragon wearables (2) | ↓5 | |||
| 11 | sap se | 13 | sap host agent (2) · sap landscape management (2) · sap netweaver sap basis (2) | ↑16 | ||||
| 12 | atlassian | 12 | jira server (9) · application links (1) · confluence data center (1) | ↑22 | ||||
| 13 | apache | 7 | 1 | 1 | 2 | apache tomcat (3) · apache jclouds (1) · apache kylin (1) | ↓2 | |
| 14 | changing | 6 | 1 | servisign windows versions (3) · syuan gu da shih (3) | new | |||
| 15 | joomla | 6 | 2 | joomla (3) · joomla core (1) · tiny browser included with tinymce 3 0 (1) | ↑17 | |||
| 16 | lenovo | 6 | xclarity administrator lxca (3) · bios (1) · ez media backup center ix2 (1) | · | ||||
| 17 | redhat | 6 | enterprise virtualization hypervisor aka rhev h (1) · keycloak (1) · openshift mysql apb (1) | ↓11 | ||||
| 18 | siemens | 6 | scalance s602 (3) · scalance s612 (3) · scalance s623 (3) | ↑10 | ||||
| 19 | snyk | 6 | bodymen (1) · component flatten (1) · dot object (1) | · | ||||
| 20 | canonical | 5 | apport (4) · whoopsie (1) | · | ||||
| 21 | dell | 5 | dell client consumer and commercial platforms (2) · elastic cloud storage (1) · isilon onefs (1) | ↑14 | ||||
| 22 | php group | 5 | php (5) | · | ||||
| 23 | bosch | 4 | 2 | divar ip 3000 (4) · divar ip 7000 (4) · divar ip all in one 5000 (3) | · | |||
| 24 | cloud foundry | 4 | capi (1) · credhub (1) · routing (1) | · | ||||
| 25 | fortinet | 4 | fortinet forticlientlinux (4) | ↑11 | ||||
| 26 | mozilla | 4 | webthings gateway (2) · firefox (1) · persona (1) | ↓22 | ||||
| 27 | nec | 4 | aterm series (2) · aterm wg2600hs (2) | · | ||||
| 28 | ca technologies a broadcom | 3 | 2 | ca unified infrastructure management nimsoft uim (3) | · | |||
| 29 | f5 | 3 | big ip (2) · edge client for windows (1) | ↑20 | ||||
| 30 | mcafee | 3 | data exchange layer dxl broker (1) · mcafee endpoint security ens (1) · web advisor wa (1) | · | ||||
| 31 | nodejs | 3 | 1 | node (3) | new | |||
| 32 | palo alto networks | 3 | expedition (1) · globalprotect (1) · pan os (1) | · | ||||
| 33 | taiwan secom co | 3 | 1 | door access control system (3) · personnel attendance system (3) | new | |||
| 34 | trend micro | 3 | trend micro im security ims trend micro control manager tmcm trend micro officescan osce trend micro endpoint sensor tmes trend micro security consumer trend micro scanmail for microsoft exchange smex trend micro serverprotect sp trend micro mobile security enterprise tmms enterprise (1) · trend micro security consumer (1) · trend micro vulnerability protection (1) | ↓5 | ||||
| 35 | vmware | 3 | vrealize operations for horizon adapter (3) | ↑36 | ||||
| 36 | yokogawa | 3 | b m9000 vp (3) · b m9000cs (3) · centum cs 1000 (3) | · | ||||
| 37 | broadcom | 2 | wifi drivers (2) | ↑8 | ||||
| 38 | brocade | 2 | brocade fabric os (2) | new | ||||
| 39 | d link | 2 | dap 1330 (1) · dap 2610 (1) | ↑47 | ||||
| 40 | imagemagick | 2 | imagemagick (2) | · | ||||
| 41 | linuxmint | 2 | mint (2) | new | ||||
| 42 | netapp | 2 | netapp fas 8300 8700 and aff a400 baseboard management controller (1) · oncommand cloud manager (1) | · | ||||
| 43 | samsung | 2 | galaxy s10 (1) · knox (1) | · | ||||
| 44 | smf | 2 | 1 | smf (2) | new | |||
| 45 | smoothwall | 2 | smoothwall express (2) | new | ||||
| 46 | tonnet | 2 | dvr (2) | new | ||||
| 47 | xiaomi | 2 | browser (2) | · | ||||
| 48 | zte | 2 | 1 | e8820v3 (2) | · | |||
| 49 | 1up lab | 1 | oneup uploader bundle (1) | new | ||||
| 50 | abb | 1 | asset suite (1) | · |
One CVE is counted once per vendor, product or weakness class it lists, so a ranking column sums to more than the month's total. Only the month's top 100 keys per dimension are stored. The KEV column counts CVEs published in 2020-02 that are on the CISA KEV catalog today. The 0 in the headline is what CISA listed during the month, whenever those CVEs were published. All 50 ranked vendors are listed; a zero count renders as a dot.
Weaknesses
CWE classes by distinct CVEs
- 1CWE-79190 critical—
- 2CWE-78122 critical↑5
- 3CWE-787122 critical↑24
- 4CWE-20110 critical↓2
- 5CWE-284101 critical↑1
- 6CWE-12580 critical↑24
- 7CWE-40080 critical↑9
- 8CWE-41660 critical↑3
- 9CWE-2250 critical↑1
- 10CWE-12240 critical↑19
- 1CWE-28740 critical↑9
- 2CWE-35240 critical↑10
- 3CWE-79842 critical↓4
- 4CWE-9441 critical·
- 5CWE-12031 critical↓12
- 6CWE-19030 critical·
- 7CWE-28530 critical↑2
- 8CWE-12121 critical↓10
- 9CWE-20020 critical↓14
- 10CWE-26420 critical↓5
One CVE is counted once per vendor, product or weakness class it lists, so a ranking column sums to more than the month's total. Only the month's top 100 keys per dimension are stored.