Month report
April 2021
Rolled up 2026-08-09 20:45 from 370,700 CVE records
1,817 CVEs published, -16.9% on the same month last year. 66 rated critical, 0 listed by CISA as exploited. oracle led with 179; the most common weakness class was CWE-79 (55). oracle climbed 93 places, the largest move. 11 vendors ranked for the first time.
Published
1,817
+25.6%on the previous month
Critical / high
66 / 389
of the 855 scored
Medium / low
366 / 34
the rest of the scored bands
Added to CISA KEV
0
listed as exploited this month
Public exploit
89
exploit code indexed publicly
Scanner template
0
0% of the month
Publication to KEV
How long before CISA listed them
18 published this month and listed since — not the 0 listed during it.
Median days to listing
208
from publication to CISA's date added
Listed within 7 days
0%
of the 18
Listed within 30 days
0%
of the 18
Vendors
Ranked by distinct CVEs this month
Δ is the move against last month's rank.
| # | Vendor | Top products | ||||||
|---|---|---|---|---|---|---|---|---|
| 1 | oracle | 179 | 15 | 3 | mysql server (39) · vm virtualbox (21) · istore (11) | ↑93 | ||
| 2 | apple | 130 | 2 | 5 | 4 | macos (119) · ios and ipados (86) · tvos (31) | · | |
| 3 | microsoft | 108 | 3 | 1 | 5 | windows 10 version 2004 (79) · windows server version 2004 (79) · windows server version 20h2 (79) | ↓2 | |
| 4 | juniper networks | 53 | 2 | junos os (48) · junos os evolved (8) · contrail insights (1) | · | |||
| 5 | cisco | 46 | 1 | 3 | cisco small business rv series router firmware (9) · cisco adaptive security appliance asa software (6) · cisco firepower threat defense software (6) | ↓3 | ||
| 6 | 41 | 3 | 1 | chrome (39) · dart sdk (1) · vscode bazel (1) | ↓2 | |||
| 7 | asus | 35 | bmc firmware for asmb8 ikvm (18) · bmc firmware for z10pe d16 ws (18) · bmc firmware for z10pr d16 (18) | · | ||||
| 8 | ibm | 27 | engineering lifecycle optimization (4) · engineering test management (4) · engineering workflow management (4) | ↓5 | ||||
| 9 | dell | 21 | 1 | integrated dell remote access controller idrac (6) · dell hybrid client dhc (4) · powerscale onefs (2) | ↑13 | |||
| 10 | samsung mobile | 20 | 1 | 1 | samsung mobile devices (11) · samsung email (2) · bixby (1) | ↓5 | ||
| 11 | siemens | 20 | nucleus net (9) · nucleus source code (9) · nucleus readystart v3 (7) | ↑2 | ||||
| 12 | parallels | 19 | desktop (19) | ↑25 | ||||
| 13 | adobe | 16 | bridge (6) · gocart (3) · acrobat reader (2) | ↓3 | ||||
| 14 | qualcomm | 15 | 1 | snapdragon auto snapdragon compute snapdragon connectivity snapdragon mobile (3) · snapdragon auto snapdragon compute snapdragon connectivity snapdragon consumer iot snapdragon industrial iot snapdragon iot snapdragon mobile snapdragon voice music snapdragon wearables (2) · snapdragon auto snapdragon compute snapdragon connectivity snapdragon consumer electronics connectivity snapdragon consumer iot snapdragon industrial iot snapdragon iot snapdragon mobile snapdragon voice music snapdragon wearables snapdragon wired infrastructure and networking (1) | ↓8 | |||
| 15 | nvidia | 14 | nvidia virtual gpu software (8) · nvidia gpu display driver (5) · nvidia geforce experience software (1) | · | ||||
| 16 | sap se | 14 | 1 | sap commerce (1) · sap fiori apps 2 0 for travel management in sap erp (1) · sap focused run (1) | ↓9 | |||
| 17 | apache | 13 | 6 | apache solr (3) · apache ofbiz (2) · apache tapestry (2) | ↓9 | |||
| 18 | vaadin | 13 | vaadin (12) · flow server (7) · vaadin server (3) | new | ||||
| 19 | gitlab | 12 | 2 | 1 | 2 | gitlab (11) · gitlab vscode extension (1) | ↓10 | |
| 20 | atlassian | 10 | 1 | jira data center (7) · jira server (7) · atlassian connect express ace (1) | ↑11 | |||
| 21 | jenkins project | 9 | jenkins config file provider plugin (4) · jenkins (2) · jenkins cloudbees cd plugin (1) | ↓10 | ||||
| 22 | matrix org | 7 | sydent (4) · synapse (3) | ↑13 | ||||
| 23 | eaton | 6 | 1 | intelligent power manager ipm (6) | · | |||
| 24 | exiv2 | 6 | exiv2 (6) | new | ||||
| 25 | foxit | 6 | studio photo (6) | ↓10 | ||||
| 26 | mcafee | 6 | mcafee advanced threat defense atd (2) · mcafee data loss prevention dlp endpoint for windows (2) · mcafee content security reporter csr (1) | ↑2 | ||||
| 27 | nec | 6 | nec aterm devices (4) · aterm wg2600hs (2) | · | ||||
| 28 | the eclipse foundation | 6 | 2 | eclipse jetty (3) · eclipse jersey (1) · eclipse mosquitto (1) | ↑13 | |||
| 29 | trend micro | 6 | 1 | trend micro apex one (4) · trend micro officescan (4) · trend micro antivirus for mac (1) | · | |||
| 30 | avaya | 5 | aura orchestration designer (1) · avaya meetings management (1) · avaya meetings server (1) | · | ||||
| 31 | lenovo | 5 | pcmanager (2) · power management driver for windows 10 (2) · xclarity controller xcc (1) | ↑3 | ||||
| 32 | tibco software | 5 | 1 | tibco administrator enterprise edition (3) · tibco administrator enterprise edition distribution for tibco silver fabric (3) · tibco administrator enterprise edition for z linux (3) | ↓13 | |||
| 33 | d link japan k k | 4 | dap 1880ac (4) | · | ||||
| 34 | demon1a | 4 | 1 | discord recon (4) | new | |||
| 35 | fibar group s a | 4 | 1 | fibaro home center (4) | new | |||
| 36 | merit lilin ent co | 4 | 2 | p2 z2 p3 z3 ip camera firmware (4) | new | |||
| 37 | palo alto networks | 4 | pan os (2) · bridgecrew checkov (1) · globalprotect app (1) | ↑58 | ||||
| 38 | panva | 4 | jose (2) · jose node cjs runtime (1) · jose node esm runtime (1) | new | ||||
| 39 | qnap systems | 4 | 3 | 1 | 1 | qts (3) · quts hero (2) · media streaming add on (1) | · | |
| 40 | sonicwall | 4 | 1 | 3 | 1 | email security (3) · global management system gms (1) | ↓1 | |
| 41 | wpdatatables | 4 | wpdatatables tables table charts (4) | new | ||||
| 42 | buffalo | 3 | buffalo broadband routers (2) · buffalo network devices (1) | · | ||||
| 43 | d link | 3 | dap 2020 (3) | · | ||||
| 44 | daifukuya com | 3 | kagemai (3) | new | ||||
| 45 | expresstech | 3 | responsive menu create mobile friendly menu (3) · responsive menu pro (3) | new | ||||
| 46 | 3 | 1 | whatsapp business for android (2) · whatsapp for android (2) · facebook thrift (1) | ↓34 | ||||
| 47 | fortinet | 3 | fortinet fortiadcmanager fortiadc (1) · fortinet fortiproxy fortios (1) · fortinet fortiweb (1) | ↓14 | ||||
| 48 | getgrav | 3 | 1 | 2 | grav plugin admin (2) · grav (1) | new | ||
| 49 | gradle | 3 | 1 | gradle (3) | new | |||
| 50 | isc | 3 | bind9 (3) | · |
One CVE is counted once per vendor, product or weakness class it lists, so a ranking column sums to more than the month's total. Only the month's top 100 keys per dimension are stored. The KEV column counts CVEs published in 2021-04 that are on the CISA KEV catalog today. The 0 in the headline is what CISA listed during the month, whenever those CVEs were published. All 50 ranked vendors are listed; a zero count renders as a dot.
Weaknesses
CWE classes by distinct CVEs
- 1CWE-79551 critical—
- 2CWE-120360 critical↑33
- 3CWE-20311 critical↓1
- 4CWE-89302 critical↑3
- 5CWE-200282 critical—
- 6CWE-22201 critical↑4
- 7CWE-284193 critical↑7
- 8CWE-400160 critical—
- 9CWE-119152 critical↓5
- 10CWE-125150 critical↓7
- 1CWE-787150 critical↑1
- 2CWE-78142 critical↑4
- 3CWE-352130 critical↑55
- 4CWE-434121 critical↑1
- 5CWE-287112 critical↓4
- 6CWE-502113 critical↓7
- 7CWE-94114 critical↑25
- 8CWE-121101 critical—
- 9CWE-269101 critical↑12
- 10CWE-12291 critical↑1
One CVE is counted once per vendor, product or weakness class it lists, so a ranking column sums to more than the month's total. Only the month's top 100 keys per dimension are stored.