Month report
September 2020
Rolled up 2026-08-09 20:45 from 370,662 CVE records
1,592 CVEs published, +4% on the same month last year. 57 rated critical, 0 listed by CISA as exploited. microsoft led with 129; the most common weakness class was CWE-20 (62). palo alto networks climbed 58 places, the largest move. 13 vendors ranked for the first time.
Published
1,592
+37.2%on the previous month
Critical / high
57 / 219
of the 621 scored
Medium / low
313 / 32
the rest of the scored bands
Added to CISA KEV
0
listed as exploited this month
Public exploit
75
exploit code indexed publicly
Scanner template
0
0% of the month
Publication to KEV
How long before CISA listed them
8 published this month and listed since — not the 0 listed during it.
Median days to listing
424
from publication to CISA's date added
Listed within 7 days
0%
of the 8
Listed within 30 days
0%
of the 8
Vendors
Ranked by distinct CVEs this month
Δ is the move against last month's rank.
| # | Vendor | Top products | ||||||
|---|---|---|---|---|---|---|---|---|
| 1 | microsoft | 129 | 2 | 1 | 3 | windows server version 2004 (75) · windows server version 1903 server core installation (74) · windows server 2019 (73) | — | |
| 2 | cisco | 101 | 2 | 1 | 1 | cisco ios xe software (33) · cisco ios xr software (6) · cisco email security appliance esa (5) | ↑1 | |
| 3 | qualcomm | 58 | snapdragon auto snapdragon compute snapdragon connectivity snapdragon consumer electronics connectivity snapdragon consumer iot snapdragon industrial iot snapdragon mobile snapdragon voice music snapdragon wearables snapdragon wired infrastructure and networking (10) · snapdragon auto snapdragon compute snapdragon consumer iot snapdragon industrial iot snapdragon mobile snapdragon voice music snapdragon wearables (7) · snapdragon auto snapdragon compute snapdragon connectivity snapdragon consumer electronics connectivity snapdragon consumer iot snapdragon industrial iot snapdragon mobile snapdragon voice music snapdragon wired infrastructure and networking (6) | · | ||||
| 4 | ibm | 53 | 1 | data risk manager (12) · infosphere guardium (5) · business automation workflow (4) | ↓2 | |||
| 5 | 48 | chrome (47) · brotli (1) | ↑9 | |||||
| 6 | jenkins project | 48 | 1 | jenkins database plugin (3) · jenkins elastest plugin (3) · jenkins liquibase runner plugin (3) | ↑5 | |||
| 7 | sap se | 48 | 2 | sap 3d visual enterprise viewer (38) · banking services from sap 9 0 bank analyzer (1) · s 4hana fin prod subldgr (1) | ↑1 | |||
| 8 | gitlab | 39 | gitlab (39) | ↓2 | ||||
| 9 | tensorflow | 25 | 3 | tensorflow (25) | new | |||
| 10 | adobe | 21 | 5 | experience manager (11) · indesign (5) · media encoder (3) | ↓6 | |||
| 11 | mcafee | 17 | 1 | mcafee web gateway mwg (5) · endpoint security for windows (4) · ma for windows (3) | ↓2 | |||
| 12 | trend micro | 17 | 1 | trend micro apex one (12) · trend micro worry free business security (4) · trend micro security consumer (3) | ↑8 | |||
| 13 | philips | 13 | patient information center ix picix (7) · clinical collaboration platform (5) · performancebridge focal point (3) | ↑5 | ||||
| 14 | siemens | 12 | 1 | simatic rtls locating manager (3) · polarion subversion webclient (2) · simatic hmi unified comfort panels (2) | ↑12 | |||
| 15 | 9 | whatsapp business for android (4) · hermes (3) · whatsapp android (2) | · | |||||
| 16 | linux | 9 | 1 | kernel (9) | · | |||
| 17 | palo alto networks | 9 | 1 | 1 | pan os (9) | ↑58 | ||
| 18 | lenovo | 8 | enterprise network disk (2) · bios (1) · system interface foundation (1) | · | ||||
| 19 | gallagher | 6 | 2 | command centre (6) | new | |||
| 20 | atlassian | 5 | 2 | jira server (4) · jira service desk server (1) | ↑29 | |||
| 21 | dell | 5 | cpg bios (3) · elastic cloud storage (1) · isilon onefs (1) | ↑12 | ||||
| 22 | fortinet | 5 | fortinet fortianalyzer (1) · fortinet fortimanager fortianalyzer (1) · fortinet fortinac (1) | ↑37 | ||||
| 23 | helm | 4 | helm (4) | · | ||||
| 24 | inunosinsi | 4 | 1 | soycms (4) | new | |||
| 25 | prestashop | 4 | 1 | prestashop (3) · contactform (1) | · | |||
| 26 | rapid7 | 4 | 1 | nexpose (2) · appspider (1) · metasploit framework (1) | ↑15 | |||
| 27 | nodejs | 3 | node (3) | · | ||||
| 28 | qnap systems | 3 | helpdesk (3) | · | ||||
| 29 | redhat | 3 | ansible (2) · resteasy client (1) | · | ||||
| 30 | buffalo | 2 | whr g54s (2) | · | ||||
| 31 | canonical | 2 | add apt repository (1) · ubuntu ui toolkit (1) | ↓12 | ||||
| 32 | cloud foundry | 2 | cf deployment (2) · capi (1) · routing (1) | ↓2 | ||||
| 33 | nvidia | 2 | nvidia geforce now application (2) | · | ||||
| 34 | opensuse | 2 | open build service (1) · opensuse leap 15 1 (1) · opensuse leap 15 2 (1) | ↑4 | ||||
| 35 | ory | 2 | fosite (2) | · | ||||
| 36 | suse | 2 | 1 | opensuse leap 15 1 (1) · opensuse leap 15 2 (1) · suse enterprise storage 5 (1) | ↑50 | |||
| 37 | uniqlo co | 2 | uniqlo app for android (2) | new | ||||
| 38 | wago | 2 | 1 | 750 362 (1) · 750 363 (1) · 750 823 (1) | · | |||
| 39 | accel ppp | 1 | accel ppp (1) | new | ||||
| 40 | atop technology | 1 | 3g 4g lte cellular to ethernet and serial secure industrial gateway se5901 (1) · 3g 4g lte cellular to ethernet and serial secure industrial gateway se5901b (1) · 3g 4g lte cellular to ethernet and serial secure industrial gateway se5904d (1) | new | ||||
| 41 | august | 1 | connect firmware (1) · smart lock and connect wi fi bridge app (1) | new | ||||
| 42 | bitdefender | 1 | bitdefender engines (1) | ↓14 | ||||
| 43 | bosch | 1 | smart home (1) | · | ||||
| 44 | ctripcorp | 1 | apollo (1) | new | ||||
| 45 | cyber security cloud | 1 | shadankun server security type excluding normal blocking method types (1) | new | ||||
| 46 | duffelhq | 1 | 1 | paginator (1) | new | |||
| 47 | eaton | 1 | 9000x programming and configuration software (1) | ↑10 | ||||
| 48 | failure project | 1 | 1 | failure (1) | new | |||
| 49 | fatek automation | 1 | plc winproladder (1) | new | ||||
| 50 | flexsolution | 1 | 1 | alfrescoresetpassword (1) | new |
One CVE is counted once per vendor, product or weakness class it lists, so a ranking column sums to more than the month's total. Only the month's top 100 keys per dimension are stored. The KEV column counts CVEs published in 2020-09 that are on the CISA KEV catalog today. The 0 in the headline is what CISA listed during the month, whenever those CVEs were published. All 50 ranked vendors are listed; a zero count renders as a dot.
Weaknesses
CWE classes by distinct CVEs
- 1CWE-20623 critical—
- 2CWE-79305 critical—
- 3CWE-89298 critical↑29
- 4CWE-119161 critical↑4
- 5CWE-287123 critical↑4
- 6CWE-787120 critical↑1
- 7CWE-400110 critical↑3
- 8CWE-12580 critical↓2
- 9CWE-20080 critical↓5
- 10CWE-35280 critical↑5
- 1CWE-12271 critical↑5
- 2CWE-2271 critical↓9
- 3CWE-28472 critical—
- 4CWE-41670 critical↑27
- 5CWE-7871 critical↑16
- 6CWE-47660 critical↑61
- 7CWE-50261 critical·
- 8CWE-12051 critical↑3
- 9CWE-34750 critical↑53
- 10CWE-78850 critical·
One CVE is counted once per vendor, product or weakness class it lists, so a ranking column sums to more than the month's total. Only the month's top 100 keys per dimension are stored.