Month report
September 2021
Rolled up 2026-08-09 20:45 from 370,690 CVE records
1,899 CVEs published, +19.3% on the same month last year. 79 rated critical, 0 listed by CISA as exploited. apple led with 214; the most common weakness class was CWE-79 (135). nextcloud climbed 40 places, the largest move. 10 vendors ranked for the first time.
Published
1,899
-9%on the previous month
Critical / high
79 / 327
of the 811 scored
Medium / low
369 / 36
the rest of the scored bands
Added to CISA KEV
0
listed as exploited this month
Public exploit
78
exploit code indexed publicly
Scanner template
0
0% of the month
Publication to KEV
How long before CISA listed them
30 published this month and listed since — not the 0 listed during it.
Median days to listing
56.5
from publication to CISA's date added
Listed within 7 days
0%
of the 30
Listed within 30 days
0%
of the 30
Vendors
Ranked by distinct CVEs this month
Δ is the move against last month's rank.
| # | Vendor | Top products | ||||||
|---|---|---|---|---|---|---|---|---|
| 1 | apple | 214 | 8 | 2 | macos (168) · ios and ipados (108) · watchos (47) | — | ||
| 2 | adobe | 148 | 12 | 1 | 2 | acrobat reader (37) · magento commerce (25) · bridge (16) | — | |
| 3 | microsoft | 85 | 1 | 7 | 5 | windows 10 version 1809 (33) · windows 10 version 1909 (33) · windows 10 version 2004 (33) | ↑1 | |
| 4 | ibm | 58 | jazz for service management (13) · tivoli netcool omnibus (11) · edge (4) | ↑3 | ||||
| 5 | cisco | 51 | 4 | 1 | cisco ios xe software (17) · cisco ios xr software (11) · cisco ios (5) | ↑4 | ||
| 6 | siemens | 39 | 1 | 1 | solid edge se2021 (10) · nx 1980 series (6) · sinema remote connect server (6) | ↑10 | ||
| 7 | qualcomm | 37 | 9 | 1 | snapdragon auto snapdragon compute snapdragon connectivity snapdragon consumer iot snapdragon industrial iot snapdragon iot snapdragon voice music snapdragon wearables (5) · snapdragon auto snapdragon compute snapdragon connectivity snapdragon consumer electronics connectivity snapdragon consumer iot snapdragon industrial iot snapdragon mobile snapdragon voice music snapdragon wired infrastructure and networking (3) · snapdragon auto snapdragon compute snapdragon connectivity snapdragon consumer iot snapdragon industrial iot snapdragon mobile snapdragon voice music snapdragon wearables (3) | · | ||
| 8 | sap se | 33 | 8 | 1 | 2 | sap business one (7) · sap cloud connector (4) · sap contact center (4) | ↑21 | |
| 9 | apache | 22 | 2 | 1 | 3 | apache dubbo (4) · apache http server (4) · apache zeppelin (3) | ↑12 | |
| 10 | samsung mobile | 18 | 1 | samsung mobile devices (14) · penup (1) · samsung capture (1) | ↑18 | |||
| 11 | ecoa | 13 | 7 | ecs router controller ecs flash (13) · graphic control software (13) · riskbuster system rb 3 0 0 (13) | new | |||
| 12 | atlassian | 12 | 1 | jira data center (10) · jira server (10) · atlasboard (1) | ↑10 | |||
| 13 | geutebr ck | 12 | 1 | 9 | e2 series (12) · encoder g code (12) | new | ||
| 14 | qnap systems | 10 | 6 | qts (3) · quts hero (3) · qutscloud (3) | · | |||
| 15 | nextcloud | 9 | 1 | security advisories (9) | ↑40 | |||
| 16 | dell | 8 | cpg bios (4) · networker (2) · supportassist client consumer (2) | ↓8 | ||||
| 17 | fortinet | 7 | 1 | fortinet fortimanager (3) · fortinet fortisandbox (2) · fortinet fortiweb (2) | ↓3 | |||
| 18 | mcafee | 7 | mcafee agent for windows (3) · mcafee endpoint security ens for windows (2) · mcafee data loss prevention dlp discover (1) | · | ||||
| 19 | arista | 6 | 1 | metamako operating system (6) | new | |||
| 20 | aveva software | 6 | aveva batch management 2020 (6) · aveva communication drivers pack 2020 (6) · aveva historian 2020 (6) | · | ||||
| 21 | palo alto networks | 6 | pan os (4) · cortex xsoar (2) | ↑14 | ||||
| 22 | stylemixthemes | 6 | 1 | ulisting wordpress plugin (6) | new | |||
| 23 | kubernetes | 5 | 2 | kubernetes (5) | · | |||
| 24 | solarwinds | 5 | 1 | orion platform (3) · patch manager (2) | ↓4 | |||
| 25 | wordpress | 5 | wordpress develop (4) · absolutely glamorous custom admin (1) · agca absolutely glamorous custom admin wordpress plugin (1) | · | ||||
| 26 | glpi project | 4 | glpi (4) | · | ||||
| 27 | line | 4 | line client for ios (2) · central dogma (1) · line for windows (1) | · | ||||
| 28 | micro focus | 4 | netiq access manager (4) | · | ||||
| 29 | otrs | 4 | otrs (4) · otrs community edition (4) | · | ||||
| 30 | the eclipse foundation | 4 | eclipse theia (2) · eclipse che (1) · eclipse equinox (1) | ↑38 | ||||
| 31 | abb | 3 | 1 | base software for softcontrol (1) · my busch jaeger de (1) · mybuildings abb com (1) | · | |||
| 32 | bookstackapp | 3 | bookstackapp bookstack (3) | · | ||||
| 33 | bytecodealliance | 3 | wasmtime (3) | · | ||||
| 34 | delta electronics | 3 | 1 | dopsoft 2 (3) | · | |||
| 35 | elastic | 3 | elastic enterprise search (2) · elasticsearch (1) | · | ||||
| 36 | enbra | 3 | ewm 1 7 29 (3) · at wmbus 16 2 (2) · er am dn 15 (2) | new | ||||
| 37 | f secure | 3 | f secure internet gatekeeper (2) · f secure endpoint protection products on windows and mac f secure linux security 32 bit f secure linux security 64 f secure atlant f secure cloud protection for salesforce (1) | ↓6 | ||||
| 38 | pi hole | 3 | pi hole adminlte (3) | ↑23 | ||||
| 39 | pimcore | 3 | pimcore (3) | ↑8 | ||||
| 40 | pomerium | 3 | pomerium (3) | new | ||||
| 41 | sonicwall | 3 | 1 | 1 | sma100 (2) · sonicwall global vpn client (1) | ↑25 | ||
| 42 | trend micro | 3 | trend micro housecall for home networks (1) · trend micro security consumer (1) · trend micro serverprotect for emc celerra (1) | ↑28 | ||||
| 43 | vim | 3 | vim vim (3) | new | ||||
| 44 | btcpayserver | 2 | btcpayserver btcpayserver (2) | new | ||||
| 45 | busch jaeger | 2 | my busch jaeger de (1) · mybuildings abb com (1) · system access point (1) | · | ||||
| 46 | code cabin | 2 | wp google maps pro (1) · wp google maps wordpress plugin (1) | new | ||||
| 47 | discourse | 2 | discourse (2) | ↓10 | ||||
| 48 | eclipse | 2 | keti (2) | new | ||||
| 49 | getgrav | 2 | getgrav grav (1) · getgrav grav plugin admin (1) | · | ||||
| 50 | github | 2 | github enterprise server (2) | · |
One CVE is counted once per vendor, product or weakness class it lists, so a ranking column sums to more than the month's total. Only the month's top 100 keys per dimension are stored. The KEV column counts CVEs published in 2021-09 that are on the CISA KEV catalog today. The 0 in the headline is what CISA listed during the month, whenever those CVEs were published. All 50 ranked vendors are listed; a zero count renders as a dot.
Weaknesses
CWE classes by distinct CVEs
- 1CWE-791351 critical—
- 2CWE-20597 critical↑6
- 3CWE-125350 critical—
- 4CWE-78297 critical↑8
- 5CWE-788290 critical↑26
- 6CWE-200282 critical↑7
- 7CWE-89271 critical↓3
- 8CWE-352250 critical↓2
- 9CWE-787234 critical—
- 10CWE-22213 critical↑4
- 1CWE-416211 critical↓9
- 2CWE-476170 critical↓2
- 3CWE-122161 critical↑2
- 4CWE-287134 critical↑5
- 5CWE-120122 critical↑6
- 6CWE-284122 critical↓5
- 7CWE-1333110 critical↑65
- 8CWE-12190 critical↑4
- 9CWE-132181 critical·
- 10CWE-50281 critical↓13
One CVE is counted once per vendor, product or weakness class it lists, so a ranking column sums to more than the month's total. Only the month's top 100 keys per dimension are stored.