Month report
March 2021
Rolled up 2026-08-09 20:45 from 370,700 CVE records
1,447 CVEs published, -17.5% on the same month last year. 57 rated critical, 0 listed by CISA as exploited. microsoft led with 88; the most common weakness class was CWE-79 (45). sonicwall climbed 60 places, the largest move. 8 vendors ranked for the first time.
Published
1,447
Critical / high
57 / 210
Medium / low
243 / 29
Added to CISA KEV
0
Public exploit
93
Scanner template
0
Publication to KEV
How long before CISA listed them
Median days to listing
269.5
Listed within 7 days
0%
Listed within 30 days
0%
Vendors
Ranked by distinct CVEs this month
| # | Vendor | Top products | ||||||
|---|---|---|---|---|---|---|---|---|
| 1 | microsoft | 88 | 10 | 7 | 7 | windows server version 2004 (46) · windows server version 20h2 (46) · windows server version 1909 server core installation (45) | ↑1 | |
| 2 | cisco | 47 | 5 | cisco ios xe software (30) · cisco ios (5) · cisco jabber (5) | ↓1 | |||
| 3 | ibm | 44 | 1 | engineering lifecycle optimization (16) · engineering workflow management (16) · rational team concert (16) | ↑2 | |||
| 4 | 36 | 2 | chrome (35) · exposure notifications verification server (1) | — | ||||
| 5 | samsung mobile | 32 | 5 | 1 | samsung mobile devices (15) · samsung internet (3) · samsung pay mini (3) | new | ||
| 6 | qualcomm | 21 | snapdragon auto snapdragon compute snapdragon connectivity snapdragon consumer iot snapdragon industrial iot snapdragon iot snapdragon mobile snapdragon voice music snapdragon wearables (8) · snapdragon auto snapdragon compute snapdragon connectivity snapdragon consumer iot snapdragon industrial iot snapdragon mobile snapdragon voice music snapdragon wearables (2) · snapdragon auto snapdragon compute snapdragon connectivity snapdragon consumer iot snapdragon industrial iot snapdragon iot snapdragon mobile (1) | — | ||||
| 7 | sap se | 21 | 1 | sap 3d visual enterprise viewer (14) · sap enterprise financial services bank customer accounts (1) · sap hana (1) | ↑9 | |||
| 8 | apache | 18 | 1 | apache ambari (2) · apache pdfbox (2) · apache tomcat (2) | ↑15 | |||
| 9 | gitlab | 17 | 1 | 1 | gitlab (17) | · | ||
| 10 | adobe | 16 | animate (7) · connect (3) · creative cloud desktop component (3) | ↓7 | ||||
| 11 | jenkins project | 16 | jenkins team foundation server plugin (3) · jenkins build with parameters plugin (2) · jenkins owasp dependency track plugin (2) | ↑8 | ||||
| 12 | 14 | hhvm (9) · zstandard (2) · facebook gameroom (1) | ↑54 | |||||
| 13 | siemens | 14 | solid edge se2020 (4) · solid edge se2021 (4) · simatic s7 plcsim v5 4 (3) | ↓3 | ||||
| 14 | cybozu | 11 | cybozu office (11) | · | ||||
| 15 | foxit | 11 | phantompdf (11) | ↓7 | ||||
| 16 | x stream | 11 | 3 | xstream (11) | · | |||
| 17 | joomla project | 10 | 1 | joomla cms (10) | · | |||
| 18 | netgear | 10 | 1 | prosafe network management system (5) · r7800 (4) · multiple routers (1) | ↑4 | |||
| 19 | tibco software | 10 | 1 | tibco enterprise message service (2) · tibco enterprise message service community edition (2) · tibco enterprise message service developer edition (2) | · | |||
| 20 | glpi project | 9 | glpi (9) | · | ||||
| 21 | mozilla | 9 | firefox (8) · firefox esr (4) · thunderbird (4) | ↓14 | ||||
| 22 | dell | 8 | 1 | 1 | dell open manage server administrator (2) · powerscale onefs (2) · dell supportassist client (1) | ↓10 | ||
| 23 | typo3 | 8 | typo3 cms (8) | · | ||||
| 24 | bosch | 7 | bvms (1) · bvms viewer (1) · configuration manager (1) | · | ||||
| 25 | weseek | 7 | growi (5) · growi v4 2 series (2) | · | ||||
| 26 | esri | 6 | arcgis desktop (3) · arcgis desktop background geoprocessing (3) · arcgis engine (3) | new | ||||
| 27 | github | 5 | github enterprise server (5) | · | ||||
| 28 | mcafee | 5 | mcafee epolicy orchestrator epo (3) · endpoint product removal tool (1) · mcafee data loss prevention dlp endpoint for windows (1) | ↓14 | ||||
| 29 | secomea | 5 | 1 | gatemanager (4) · sitemanager (1) | ↓12 | |||
| 30 | mb connect line | 4 | mbconnect24 (4) · mymbconnect24 (4) · myrex24 (1) | new | ||||
| 31 | atlassian | 3 | jira data center (2) · jira server (2) · crowd (1) | ↓20 | ||||
| 32 | basercms users community | 3 | basercms (3) | · | ||||
| 33 | fortinet | 3 | fortinet fortios (2) · fortinet fortiproxy (1) | ↑7 | ||||
| 34 | lenovo | 3 | xclarity orchestrator (2) · pcmanager (1) | ↑43 | ||||
| 35 | matrix org | 3 | synapse (2) · matrix react sdk (1) | ↑8 | ||||
| 36 | nim lang | 3 | security (3) | new | ||||
| 37 | parallels | 3 | desktop (3) | · | ||||
| 38 | six apart | 3 | movable type (3) | · | ||||
| 39 | sonicwall | 3 | 1 | sma100 (2) · directory services connector (1) | ↑60 | |||
| 40 | synology | 3 | 3 | synology diskstation manager dsm (3) | ↓20 | |||
| 41 | the eclipse foundation | 3 | eclipse theia (2) · eclipse platform (1) | ↓5 | ||||
| 42 | zopefoundation | 3 | 1 | products pluggableauthservice (2) · products genericsetup (1) | new | |||
| 43 | broadcom | 2 | ca ehealth performance manager (1) · ehealth (1) | · | ||||
| 44 | excellent infotek | 2 | 2 | e document system (2) | new | |||
| 45 | fastify | 2 | 2 | fastify http proxy (1) · fastify reply from (1) | new | |||
| 46 | ipfs | 2 | go ipfs (2) | · | ||||
| 47 | m system co | 2 | m system dl8 series (2) | new | ||||
| 48 | minio | 2 | minio (2) | ↑34 | ||||
| 49 | mongodb | 2 | mongodb server (2) · mongodb (1) | ↓20 | ||||
| 50 | netty | 2 | io netty netty codec http2 (1) · netty (1) | ↑34 |
One CVE is counted once per vendor, product or weakness class it lists, so a ranking column sums to more than the month's total. Only the month's top 100 keys per dimension are stored. The KEV column counts CVEs published in 2021-03 that are on the CISA KEV catalog today. The 0 in the headline is what CISA listed during the month, whenever those CVEs were published. All 50 ranked vendors are listed; a zero count renders as a dot.
Weaknesses
CWE classes by distinct CVEs
- 1CWE-79451 critical↑8
- 2CWE-20272 critical↑2
- 3CWE-125201 critical—
- 4CWE-119181 critical↑9
- 5CWE-200180 critical↑11
- 6CWE-416162 critical↑6
- 7CWE-89151 critical↑13
- 8CWE-400140 critical↓3
- 9CWE-502140 critical↑42
- 10CWE-22130 critical↓3
- 1CWE-287131 critical↑33
- 2CWE-787120 critical↓10
- 3CWE-285110 critical↑30
- 4CWE-284101 critical↓6
- 5CWE-434101 critical↑21
- 6CWE-78101 critical↓10
- 7CWE-42790 critical·
- 8CWE-12180 critical↓17
- 9CWE-60180 critical↑9
- 10CWE-86380 critical↑4
One CVE is counted once per vendor, product or weakness class it lists, so a ranking column sums to more than the month's total. Only the month's top 100 keys per dimension are stored.