Month report
December 2020
Rolled up 2026-08-09 20:45 from 370,700 CVE records
1,538 CVEs published, -2.5% on the same month last year. 41 rated critical, 0 listed by CISA as exploited. apple led with 63; the most common weakness class was CWE-79 (32). siemens climbed 73 places, the largest move. 7 vendors ranked for the first time.
Published
1,538
Critical / high
41 / 160
Medium / low
200 / 20
Added to CISA KEV
0
Public exploit
95
Scanner template
0
Publication to KEV
How long before CISA listed them
Median days to listing
330
Listed within 7 days
0%
Listed within 30 days
0%
Weakness × vendor
Where the two overlap
| Vendor | CWE-79 | CWE-190 | CWE-269 | CWE-20 | CWE-284 | CWE-122 | CWE-120 | CWE-416 |
|---|---|---|---|---|---|---|---|---|
| apple | ||||||||
| microsoft | 1 | 1 | ||||||
| ibm | ||||||||
| mozilla | ||||||||
| siemens | 2 | |||||||
| qnap systems | 8 | 2 | 2 | |||||
| odoo | 4 | 2 | 6 | |||||
| trend micro |
Vendors
Ranked by distinct CVEs this month
| # | Vendor | Top products | ||||||
|---|---|---|---|---|---|---|---|---|
| 1 | apple | 63 | 3 | 4 | macos (50) · ios and ipados (39) · watchos (31) | · | ||
| 2 | microsoft | 59 | 2 | 1 | 5 | windows server 2019 (20) · windows server 2019 server core installation (20) · windows 10 version 1809 (19) | ↓1 | |
| 3 | ibm | 24 | financial transaction manager (6) · security secret server (4) · security key lifecycle manager (2) | ↑2 | ||||
| 4 | mozilla | 21 | 1 | firefox (20) · thunderbird (12) · firefox esr (11) | · | |||
| 5 | siemens | 17 | logo 8 bm incl siplus variants (8) · xhq (7) · logo soft comfort (2) | ↑73 | ||||
| 6 | qnap systems | 16 | 1 | qts (9) · quts hero (7) · qes (4) | ↑7 | |||
| 7 | odoo | 13 | 1 | odoo community (13) · odoo enterprise (13) | · | |||
| 8 | trend micro | 13 | trend micro interscan web security virtual appliance (7) · trend micro apex one (5) · trend micro officescan (5) | ↑1 | ||||
| 9 | apache | 12 | 1 | 1 | 5 | apache airflow (4) · apache nuttx incubating (2) · apache accumulo (1) | ↑15 | |
| 10 | sap se | 12 | 3 | sap solution manager user experience monitoring (2) · sap business warehouse (1) · sap businessobjects bi platform crystal report (1) | ↓2 | |||
| 11 | 11 | asylo (10) · guava (1) | ↓7 | |||||
| 12 | gitlab | 10 | 1 | gitlab ce ee (6) · gitlab (2) · gitlab ee (2) | ↓2 | |||
| 13 | abb | 9 | 3 | abb ability symphony plus operations (9) · abb ability symphony plus historian (8) | · | |||
| 14 | canonical | 7 | aptdaemon (2) · apt (1) · pulseaudio (1) | ↑34 | ||||
| 15 | hgiga | 7 | 1 | mailsherlock msr45 ssr45 (7) | · | |||
| 16 | huawei | 7 | cloudengine 12800 (3) · cloudengine 5800 (3) · cloudengine 6800 (3) | · | ||||
| 17 | joomla project | 7 | joomla cms (7) | new | ||||
| 18 | moxa | 6 | 2 | nport iaw5000a i o (6) | · | |||
| 19 | phoenix contact | 6 | axc f 1152 1151412 (4) · axc f 2152 2404267 (4) · axc f 2152 starterkit 1046568 (4) | · | ||||
| 20 | tensorflow | 6 | tensorflow (6) | · | ||||
| 21 | changing | 5 | nhiservisignadapter (5) | · | ||||
| 22 | jenkins project | 5 | jenkins chaos monkey plugin (2) · jenkins cvs plugin (1) · jenkins plugin installation manager tool (1) | ↓15 | ||||
| 23 | the wireshark foundation | 5 | wireshark (5) | new | ||||
| 24 | weseek | 5 | growi (5) | · | ||||
| 25 | adobe | 4 | 1 | experience manager (2) · lightroom (1) · prelude (1) | ↓19 | |||
| 26 | bitdefender | 4 | hypervisor introspection (3) · antivirus plus (1) | ↑21 | ||||
| 27 | cisco | 4 | 4 | cisco jabber (4) | ↓25 | |||
| 28 | kubernetes | 4 | kubernetes (4) | · | ||||
| 29 | nec | 4 | aterm sa3500g (3) · management software for nec storage disk array system (1) | · | ||||
| 30 | dell | 3 | dell bsafe micro edition suite (2) · integrated dell remote access controller idrac (1) | ↑21 | ||||
| 31 | gallagher | 3 | command centre (3) | · | ||||
| 32 | golang | 3 | 3 | go (3) | · | |||
| 33 | mcafee | 3 | database security (1) · mcafee total protection mtp (1) · virusscan enterprise vse (1) | ↓18 | ||||
| 34 | medtronic | 3 | smart model 25000 patient reader (3) | · | ||||
| 35 | ec cube co | 2 | ec cube (2) | · | ||||
| 36 | ethereum | 2 | go ethereum (2) | ↓10 | ||||
| 37 | gerrit | 2 | gerrit (2) | new | ||||
| 38 | getkirby | 2 | kirby (2) | new | ||||
| 39 | hedgedoc | 2 | hedgedoc (2) | new | ||||
| 40 | jupyterhub | 2 | oauthenticator (1) · systemdspawner (1) | · | ||||
| 41 | mitsubishi electric | 2 | gt21 model of got2000 series gs21 model of got simple series and tension controller le7 40gu l series (1) · melsec iq f series fx5u c cpu unit (1) | ↓29 | ||||
| 42 | palo alto networks | 2 | cortex xdr agent (2) | ↓24 | ||||
| 43 | silver peak systems | 2 | ecos (2) | ↓15 | ||||
| 44 | wago | 2 | 1 | 750 331 xxx xxx (1) · 750 352 (1) · 750 829 (1) | · | |||
| 45 | x stream | 2 | 2 | xstream (2) | ↑45 | |||
| 46 | atlassian | 1 | crucible (1) | ↓32 | ||||
| 47 | bookstackapp | 1 | bookstack (1) | ↓17 | ||||
| 48 | browserup | 1 | 1 | browserup proxy (1) | new | |||
| 49 | c2fo | 1 | fast csv (1) | new | ||||
| 50 | cloud foundry | 1 | capi (1) · cf deployment (1) | · |
One CVE is counted once per vendor, product or weakness class it lists, so a ranking column sums to more than the month's total. Only the month's top 100 keys per dimension are stored. The KEV column counts CVEs published in 2020-12 that are on the CISA KEV catalog today. The 0 in the headline is what CISA listed during the month, whenever those CVEs were published. All 50 ranked vendors are listed; a zero count renders as a dot.
Weaknesses
CWE classes by distinct CVEs
- 1CWE-79322 critical—
- 2CWE-190220 critical↑61
- 3CWE-269190 critical↑3
- 4CWE-20130 critical↓2
- 5CWE-284130 critical↓2
- 6CWE-122120 critical↓1
- 7CWE-120100 critical↑11
- 8CWE-416100 critical↑6
- 9CWE-89102 critical↑8
- 10CWE-7891 critical↓6
- 1CWE-8091 critical↑1
- 2CWE-40080 critical↑33
- 3CWE-12570 critical↑2
- 4CWE-75470 critical↑18
- 5CWE-78771 critical↓8
- 6CWE-20060 critical↓7
- 7CWE-28761 critical↓6
- 8CWE-36960 critical↑60
- 9CWE-11950 critical↓11
- 10CWE-35250 critical↑23
One CVE is counted once per vendor, product or weakness class it lists, so a ranking column sums to more than the month's total. Only the month's top 100 keys per dimension are stored.