Month report
October 2021
Rolled up 2026-08-09 20:45 from 370,662 CVE records
1,706 CVEs published, +7% on the same month last year. 54 rated critical, 0 listed by CISA as exploited. oracle led with 137; the most common weakness class was CWE-79 (128). d link climbed 50 places, the largest move. 9 vendors ranked for the first time.
Published
1,706
Critical / high
54 / 329
Medium / low
418 / 36
Added to CISA KEV
0
Public exploit
70
Scanner template
0
Publication to KEV
How long before CISA listed them
Median days to listing
28
Listed within 7 days
0%
Listed within 30 days
55.6%
Vendors
Ranked by distinct CVEs this month
| # | Vendor | Top products | ||||||
|---|---|---|---|---|---|---|---|---|
| 1 | oracle | 137 | 2 | 3 | mysql server (44) · java se jdk and jre (12) · outside in technology (10) | · | ||
| 2 | microsoft | 72 | 1 | 3 | 1 | windows server version 2004 (44) · windows server version 20h2 (44) · windows server 2022 (43) | ↑1 | |
| 3 | huawei | 60 | emui (38) · magic ui (38) · harmonyos (22) | · | ||||
| 4 | cisco | 52 | cisco adaptive security appliance asa software (11) · cisco firepower threat defense software (6) · cisco identity services engine software (6) | ↑1 | ||||
| 5 | apple | 46 | 1 | 2 | ios and ipados (24) · macos (23) · watchos (15) | ↓4 | ||
| 6 | ibm | 44 | 1 | sterling b2b integrator (12) · sterling file gateway (10) · engineering lifecycle optimization (5) | ↓2 | |||
| 7 | juniper networks | 42 | 1 | junos os (32) · junos os evolved (14) · src series (3) | · | |||
| 8 | gitlab | 36 | gitlab (36) | · | ||||
| 9 | samsung mobile | 33 | 2 | samsung mobile devices (25) · samsung notes (7) · galaxy store (1) | ↑1 | |||
| 10 | qualcomm | 31 | snapdragon auto snapdragon compute snapdragon connectivity snapdragon consumer iot snapdragon industrial iot snapdragon wearables (8) · snapdragon auto snapdragon compute snapdragon consumer iot snapdragon industrial iot snapdragon mobile snapdragon voice music snapdragon wearables (2) · snapdragon auto snapdragon connectivity snapdragon industrial iot snapdragon mobile (2) | ↓3 | ||||
| 11 | 29 | 2 | 5 | 2 | chrome (28) · slo generator (1) | · | ||
| 12 | siemens | 18 | sinec nms (15) · ruggedcom ape1808 bios (1) · ruggedcom rox mx5000 (1) | ↓6 | ||||
| 13 | auvesy | 17 | 6 | versiondog (17) | new | |||
| 14 | apache | 15 | 1 | 2 | 5 | apache openoffice (5) · apache http server (3) · apache storm (2) | ↓5 | |
| 15 | adobe | 13 | 2 | 1 | acrobat reader (6) · connect (2) · xmp toolkit (2) | ↓13 | ||
| 16 | cybozu | 13 | cybozu remote service (13) | · | ||||
| 17 | inhand networks | 13 | 5 | ir615 router (13) | new | |||
| 18 | trend micro | 12 | trend micro apex one (12) · trend micro worry free business security (8) | ↑24 | ||||
| 19 | sap se | 11 | sap netweaver as abap and abap platform (4) · sap business one (2) · sap businessobjects analysis edition for olap (1) | ↓11 | ||||
| 20 | zephyrproject rtos | 11 | 1 | 1 | zephyr (11) | · | ||
| 21 | solarwinds | 10 | kiwi syslog server (5) · access rights manager (1) · kiwi cattools (1) | ↑3 | ||||
| 22 | nvidia | 9 | nvidia virtual gpu software (6) · nvidia gpu display driver (3) | · | ||||
| 23 | redis | 9 | redis (8) · hiredis (1) | · | ||||
| 24 | tad | 9 | 2 | tadtools (3) · tad book3 (2) · uploader (2) | new | |||
| 25 | fatek automation | 8 | 1 | winproladder (7) · communication server (1) | · | |||
| 26 | nextcloud | 8 | security advisories (8) | ↓11 | ||||
| 27 | atlassian | 7 | jira data center (7) · jira server (7) | ↓15 | ||||
| 28 | codesys | 7 | 1 | codesys v2 (7) | · | |||
| 29 | emerson | 6 | wirelesshart gateway (6) | · | ||||
| 30 | fortinet | 6 | 1 | fortinet forticlientems (2) · fortinet fortianalyzer (1) · fortinet fortimanager fortianalyzer (1) | ↓13 | |||
| 31 | qnap systems | 6 | photo station (3) · image2pdf (1) · media streaming add on (1) | ↓17 | ||||
| 32 | tibco software | 6 | 2 | tibco jasperreports server (3) · tibco jasperreports server community edition (3) · tibco jasperreports server developer edition (3) | · | |||
| 33 | boston scientific | 5 | zoom latitude (5) | · | ||||
| 34 | enalean | 5 | tuleap (5) | new | ||||
| 35 | moxa | 5 | 3 | mxview network management software (5) | · | |||
| 36 | parallels | 5 | desktop (5) | · | ||||
| 37 | signalwire | 5 | 1 | freeswitch (5) | new | |||
| 38 | advantech | 4 | 2 | webaccess (2) · webaccess nms (1) · webaccess scada (1) | · | |||
| 39 | camaleon cms | 4 | camaleon cms (4) | new | ||||
| 40 | canonical | 4 | apport (2) · multipass (2) | · | ||||
| 41 | d link | 4 | dap 2020 (4) | ↑50 | ||||
| 42 | firefly iii | 4 | firefly iii firefly iii (4) | · | ||||
| 43 | huachu digital technology co | 4 | easytest (4) | new | ||||
| 44 | mcafee | 4 | mcafee epolicy orchestrator epo (2) · mcafee drive encryption mde (1) · mcafee total protection mtp (1) | ↓26 | ||||
| 45 | php group | 4 | php (4) | · | ||||
| 46 | rexroth | 4 | 2 | indramotion mlc l20 l40 (3) · indramotion mlc indramotion xlc (1) · indramotion mlc l25 l45 l65 l75 l85 xm21 xm22 xm41 and xm42 indracontrol xlc (1) | new | |||
| 47 | shinher information co | 4 | shinher studyonline system (4) | new | ||||
| 48 | axis communications ab | 3 | axis os (3) | · | ||||
| 49 | bfabiszewski | 3 | bfabiszewski libmobi (3) | ↑25 | ||||
| 50 | bitdefender | 3 | total security (2) · endpoint security tools (1) · endpoint security tools for windows (1) | · |
One CVE is counted once per vendor, product or weakness class it lists, so a ranking column sums to more than the month's total. Only the month's top 100 keys per dimension are stored. The KEV column counts CVEs published in 2021-10 that are on the CISA KEV catalog today. The 0 in the headline is what CISA listed during the month, whenever those CVEs were published. All 50 ranked vendors are listed; a zero count renders as a dot.
Weaknesses
CWE classes by distinct CVEs
- 1CWE-791281 critical—
- 2CWE-20290 critical—
- 3CWE-89271 critical↑4
- 4CWE-22261 critical↑6
- 5CWE-200240 critical↑1
- 6CWE-285181 critical↑20
- 7CWE-352181 critical↑1
- 8CWE-400180 critical↑16
- 9CWE-122153 critical↑4
- 10CWE-416142 critical↑1
- 1CWE-787130 critical↓2
- 2CWE-125120 critical↓9
- 3CWE-120110 critical↑2
- 4CWE-121112 critical↑4
- 5CWE-284113 critical↑1
- 6CWE-434114 critical↑12
- 7CWE-119100 critical↑28
- 8CWE-476100 critical↓6
- 9CWE-78103 critical↓15
- 10CWE-19090 critical↑26
One CVE is counted once per vendor, product or weakness class it lists, so a ranking column sums to more than the month's total. Only the month's top 100 keys per dimension are stored.