Month report
January 2021
Rolled up 2026-08-09 20:45 from 370,877 CVE records
1,514 CVEs published, -8.5% on the same month last year. 63 rated critical, 0 listed by CISA as exploited. cisco led with 155; the most common weakness class was CWE-121 (69). oracle climbed 75 places, the largest move. 11 vendors ranked for the first time.
Published
1,514
-1.6%on the previous month
Critical / high
63 / 317
of the 718 scored
Medium / low
321 / 17
the rest of the scored bands
Added to CISA KEV
0
listed as exploited this month
Public exploit
75
exploit code indexed publicly
Scanner template
0
0% of the month
Publication to KEV
How long before CISA listed them
9 published this month and listed since — not the 0 listed during it.
Median days to listing
361
from publication to CISA's date added
Listed within 7 days
0%
of the 9
Listed within 30 days
0%
of the 9
Vendors
Ranked by distinct CVEs this month
Δ is the move against last month's rank.
| # | Vendor | Top products | ||||||
|---|---|---|---|---|---|---|---|---|
| 1 | cisco | 155 | 9 | cisco small business rv series router firmware (74) · cisco data center network manager (15) · cisco sd wan solution (14) | ↑26 | |||
| 2 | oracle | 141 | 9 | 8 | mysql server (38) · vm virtualbox (17) · weblogic server (14) | ↑75 | ||
| 3 | ibm | 83 | engineering lifecycle optimization (10) · engineering test management (10) · engineering workflow management (10) | — | ||||
| 4 | microsoft | 82 | 1 | 4 | windows 10 version 2004 (63) · windows 10 version 1909 (60) · windows 10 version 20h2 (60) | ↓2 | ||
| 5 | 46 | 1 | 3 | 3 | chrome (46) | ↑6 | ||
| 6 | qualcomm | 34 | 1 | snapdragon auto snapdragon compute snapdragon connectivity snapdragon consumer iot snapdragon industrial iot snapdragon iot snapdragon mobile snapdragon voice music snapdragon wearables snapdragon wired infrastructure and networking (9) · snapdragon auto snapdragon compute snapdragon connectivity snapdragon consumer iot snapdragon industrial iot snapdragon mobile snapdragon voice music snapdragon wearables (7) · snapdragon auto snapdragon compute snapdragon connectivity snapdragon consumer electronics connectivity snapdragon consumer iot snapdragon industrial iot snapdragon mobile snapdragon voice music snapdragon wired infrastructure and networking (3) | · | |||
| 7 | siemens | 28 | jt2go (18) · teamcenter visualization (18) · solid edge se2020 (6) | ↓2 | ||||
| 8 | sap se | 27 | 2 | sap 3d visual enterprise viewer (16) · sap business warehouse (3) · cla assistant (1) | ↑2 | |||
| 9 | nvidia | 21 | 1 | nvidia virtual gpu manager (8) · nvidia gpu display driver (6) · shield tv (3) | · | |||
| 10 | juniper networks | 19 | 1 | junos os (16) · junos os evolved (3) · contrail networking (1) | · | |||
| 11 | dell | 18 | 4 | avamar (3) · powerstore (3) · unity (3) | ↑19 | |||
| 12 | jenkins project | 14 | jenkins (11) · jenkins bumblebee hp alm plugin (1) · jenkins tics plugin (1) | ↑10 | ||||
| 13 | mozilla | 13 | firefox (13) · firefox esr (7) · thunderbird (7) | ↓9 | ||||
| 14 | apache | 11 | 1 | 1 | 3 | apache flink (2) · apache activemq (1) · apache activemq artemis (1) | ↓5 | |
| 15 | theonedev | 10 | 7 | onedev (10) | new | |||
| 16 | adobe | 8 | magento commerce (2) · animate (1) · campaign (1) | ↑9 | ||||
| 17 | nec | 7 | aterm wg2600hp and aterm wg2600hp2 (2) · univerge sv9500 sv8500 series (2) · aterm wf800hp (1) | ↑12 | ||||
| 18 | combodo | 5 | itop (5) | · | ||||
| 19 | debian | 5 | 3 | agile plm (5) · autovue for agile product lifecycle management (5) · banking digital experience (5) | · | |||
| 20 | fasterxml | 5 | 3 | agile plm (5) · autovue for agile product lifecycle management (5) · banking digital experience (5) | · | |||
| 21 | gitlab | 5 | gitlab (5) | ↓9 | ||||
| 22 | kubernetes | 5 | 2 | kubernetes secrets store csi driver (2) · csi snapshotter (1) · kubernetes (1) | ↑6 | |||
| 23 | netapp | 5 | 3 | agile plm (5) · autovue for agile product lifecycle management (5) · banking digital experience (5) | · | |||
| 24 | bosch | 4 | 1 | fsm 2500 (2) · fsm 5000 (2) · praesensa (2) | · | |||
| 25 | pepper fuchs | 4 | comtrol io link master (4) | new | ||||
| 26 | trend micro | 4 | trend micro serverprotect for linux (3) · trend micro housecall for home networks (1) | ↓18 | ||||
| 27 | atlassian | 3 | bamboo (1) · confluence server (1) · crucible (1) | ↑19 | ||||
| 28 | hgiga | 3 | 1 | oaksv20 oaklouds document v3 (1) · oaksv20 oaklouds document v3 2 0 (1) · oaksv20 oaklouds mol course v3 2 0 (1) | ↓13 | |||
| 29 | joomla project | 3 | joomla cms (3) | ↓12 | ||||
| 30 | openmage | 3 | magento lts (3) | · | ||||
| 31 | the eclipse foundation | 3 | 1 | eclipse hawkbit (1) · eclipse hono (1) · eclipse openj9 (1) | · | |||
| 32 | canonical | 2 | linux kernel (1) · remote login service (1) | ↓18 | ||||
| 33 | eaton | 2 | easysoft software (2) | · | ||||
| 34 | fortinet | 2 | fortinet fortiweb (2) | · | ||||
| 35 | hyweb | 2 | hycms j1 (2) | new | ||||
| 36 | identitypython | 2 | 1 | pysaml2 (2) | new | |||
| 37 | mcafee | 2 | mcafee agent (1) · network security management nsm (1) | ↓4 | ||||
| 38 | nodejs | 2 | 1 | node (2) | · | |||
| 39 | palo alto networks | 2 | pan os (2) | ↑3 | ||||
| 40 | reolink | 2 | rlc 4xx series (2) · rlc 5xx series (2) · rln x10 series (2) | new | ||||
| 41 | seeds co | 2 | acmailer and acmailer db (2) | new | ||||
| 42 | sonicwall | 2 | 1 | sma100 (1) · sonicwall netextender (1) | · | |||
| 43 | spring by vmware | 2 | spring cloud data flow (1) · spring cloud task (1) | · | ||||
| 44 | tibco software | 2 | tibco bpm enterprise (1) · tibco bpm enterprise distribution for tibco silver fabric (1) · tibco ebx add ons (1) | ↑46 | ||||
| 45 | ziv automation | 2 | 4cct ea6 334126bf (2) | new | ||||
| 46 | arcserve | 1 | d2d (1) | new | ||||
| 47 | bigprof software | 1 | online invoicing system (1) | new | ||||
| 48 | ca technologies a broadcom | 1 | ca service catalog (1) | · | ||||
| 49 | chatter social | 1 | creeper (1) | new | ||||
| 50 | ckeditor | 1 | ckeditor5 (1) | new |
One CVE is counted once per vendor, product or weakness class it lists, so a ranking column sums to more than the month's total. Only the month's top 100 keys per dimension are stored. The KEV column counts CVEs published in 2021-01 that are on the CISA KEV catalog today. The 0 in the headline is what CISA listed during the month, whenever those CVEs were published. All 50 ranked vendors are listed; a zero count renders as a dot.
Weaknesses
CWE classes by distinct CVEs
- 1CWE-121690 critical↑23
- 2CWE-79410 critical↓1
- 3CWE-20325 critical↑1
- 4CWE-122160 critical↑2
- 5CWE-400140 critical↑7
- 6CWE-787140 critical↑9
- 7CWE-74126 critical↑48
- 8CWE-119113 critical↑11
- 9CWE-22111 critical↑17
- 10CWE-125100 critical↑3
- 1CWE-89102 critical↓2
- 2CWE-41681 critical↓4
- 3CWE-50280 critical↑27
- 4CWE-7881 critical↓4
- 5CWE-35270 critical↑5
- 6CWE-42770 critical↑5
- 7CWE-47670 critical↑31
- 8CWE-27665 critical↑54
- 9CWE-43461 critical↑28
- 10CWE-20050 critical↓4
One CVE is counted once per vendor, product or weakness class it lists, so a ranking column sums to more than the month's total. Only the month's top 100 keys per dimension are stored.