Month report
December 2021
Rolled up 2026-08-09 20:45 from 375,726 CVE records
1,978 CVEs published, +28.6% on the same month last year. 132 rated critical, 20 listed by CISA as exploited. microsoft led with 68; the most common weakness class was CWE-79 (109). discourse climbed 35 places, the largest move. 10 vendors ranked for the first time.
Published
1,978
Critical / high
132 / 377
Medium / low
308 / 35
Added to CISA KEV
20
Public exploit
62
Scanner template
0
Publication to KEV
How long before CISA listed them
Median days to listing
503
Listed within 7 days
20%
Listed within 30 days
20%
Detection gap
Listed as exploited, no public template
Listed this month
20
With a template
12
No template
8
Measured against the nuclei-templates CVE index only. No template there does not mean a CVE is undetectable by any other tool.
Vendors
Ranked by distinct CVEs this month
| # | Vendor | Top products | ||||||
|---|---|---|---|---|---|---|---|---|
| 1 | microsoft | 68 | 7 | 2 | 7 | windows 10 version 2004 (30) · windows 10 version 21h1 (30) · windows 10 version 21h2 (30) | — | |
| 2 | huawei | 67 | harmonyos (60) · emui (25) · magic ui (24) | ↑6 | ||||
| 3 | siemens | 46 | jt utilities (23) · jttk (21) · jt2go (14) | ↑6 | ||||
| 4 | ibm | 42 | cognos analytics (7) · spectrum copy data management (7) · db2 for linux unix and windows (5) | ↓1 | ||||
| 5 | fortinet | 39 | fortinet fortiweb (15) · fortinet fortios (6) · fortinet fortiwlm (3) | ↑7 | ||||
| 6 | 38 | chrome (36) · dart sdk (1) · google exposure notifications verification server (1) | — | |||||
| 7 | adobe | 28 | premiere rush (14) · dimension (6) · audition (3) | ↓5 | ||||
| 8 | mozilla | 27 | 1 | firefox (25) · thunderbird (20) · firefox esr (19) | ↑9 | |||
| 9 | gitlab | 22 | 1 | gitlab (21) · gitlab runner (1) | ↑6 | |||
| 10 | apple | 19 | macos (16) · ios (5) · watchos (5) | · | ||||
| 11 | samsung mobile | 18 | samsung mobile devices (10) · samsung internet (2) · samsung pay (2) | ↑9 | ||||
| 12 | apache | 14 | 2 | 2 | 7 | apache log4j2 (3) · apache http server (2) · apache airavata django portal (1) | ↓2 | |
| 13 | elecom co | 13 | elecom lan routers (8) · elecom routers (3) · elecom lan router (2) | · | ||||
| 14 | sap se | 12 | 1 | sap 3d visual enterprise viewer (3) · kyma (1) · saf t framework (1) | ↑21 | |||
| 15 | sonicwall | 11 | 1 | 1 | 2 | sonicwall sma100 (10) · sonicwall global vpn client (1) | · | |
| 16 | livehelperchat | 10 | livehelperchat livehelperchat (10) | new | ||||
| 17 | vim | 9 | vim vim (9) | ↑19 | ||||
| 18 | dell | 8 | 1 | avamar (3) · wyse management suite (2) · dell wyse device agent (1) | ↓11 | |||
| 19 | myscada | 8 | 7 | mypro (8) | new | |||
| 20 | crafter software | 7 | crafter cms (7) | · | ||||
| 21 | solarwinds | 7 | web help desk (2) · orion (1) · orion core (1) | · | ||||
| 22 | wireshark foundation | 7 | wireshark (7) | ↓1 | ||||
| 23 | fatpipe | 6 | 2 | 1 | ipvpn (6) · mpvpn (6) · warp (6) | new | ||
| 24 | fuji electric | 6 | tellus lite v simulator (6) · v server lite (6) | · | ||||
| 25 | star7th | 6 | star7th showdoc (6) | ↑28 | ||||
| 26 | trend micro | 6 | trend micro worry free business security (3) · trend micro apex one (1) · trend micro security 2021 consumer (1) | · | ||||
| 27 | yetiforcecompany | 6 | yetiforcecompany yetiforcecrm (6) | new | ||||
| 28 | delta electronics | 5 | diaenergie (4) · cncsoft (1) | ↓9 | ||||
| 29 | discourse | 5 | discourse (3) · discourse footnote (1) · message bus (1) | ↑35 | ||||
| 30 | mesa labs | 5 | 2 | amegaview (5) | new | |||
| 31 | philips | 5 | patient information center ix pic ix (3) · intellibridge ec 40 hub (2) · intellibridge ec 80 hub (2) | ↑18 | ||||
| 32 | requarks | 5 | wiki (5) | · | ||||
| 33 | snipe | 5 | snipe snipe it (5) | ↑19 | ||||
| 34 | bosch | 4 | 1 | bvms (4) · divar ip 7000 r2 (4) · divar ip all in one 5000 (4) | · | |||
| 35 | esri | 4 | arcgis server (4) | · | ||||
| 36 | grafana | 4 | 1 | 1 | grafana (3) · agent (1) | ↑35 | ||
| 37 | ifmeorg | 4 | ifme (4) | new | ||||
| 38 | kevinpapst | 4 | kevinpapst kimai2 (4) | ↑7 | ||||
| 39 | pimcore | 4 | pimcore pimcore (4) | · | ||||
| 40 | tcman | 4 | 1 | gim (4) | new | |||
| 41 | wp cloud plugins | 4 | lets box (1) · out of the box (1) · share one drive (1) | new | ||||
| 42 | zyxel | 4 | gs1900 series firmware (2) · nbg6604 series firmware (2) · xgs1210 series firmware (1) | · | ||||
| 43 | amd | 3 | amd epyc (1) · amd processors (1) · prof tool (1) | ↓39 | ||||
| 44 | chain sea information integration co | 3 | 1 | ai chatbot system (3) | new | |||
| 45 | delicious brains | 3 | advanced custom fields and advanced custom fields pro (3) | · | ||||
| 46 | elgg | 3 | 1 | elgg elgg (3) | · | |||
| 47 | enalean | 3 | tuleap (3) | · | ||||
| 48 | f secure | 3 | f secure mobile security (2) · f secure endpoint protection products on windows and mac f secure linux security 32 bit f secure linux security 64 f secure atlant f secure internet gatekeeper (1) | · | ||||
| 49 | galette | 3 | galette (3) | new | ||||
| 50 | japan total system co | 3 | groupsession free edition groupsession bycloud groupsession zion (3) | · |
One CVE is counted once per vendor, product or weakness class it lists, so a ranking column sums to more than the month's total. Only the month's top 100 keys per dimension are stored. The KEV column counts CVEs published in 2021-12 that are on the CISA KEV catalog today. The 20 in the headline is what CISA listed during the month, whenever those CVEs were published. All 50 ranked vendors are listed; a zero count renders as a dot.
Weaknesses
CWE classes by distinct CVEs
- 1CWE-791091 critical—
- 2CWE-89512 critical↑2
- 3CWE-125290 critical↑7
- 4CWE-352270 critical↓2
- 5CWE-22264 critical↑4
- 6CWE-782519 critical↑2
- 7CWE-787221 critical↑9
- 8CWE-20171 critical↓5
- 9CWE-121156 critical↑19
- 10CWE-284141 critical↓4
- 1CWE-862120 critical↑3
- 2CWE-502112 critical↑19
- 3CWE-788110 critical↓8
- 4CWE-119103 critical↑3
- 5CWE-20090 critical—
- 6CWE-26990 critical↑19
- 7CWE-28792 critical↓4
- 8CWE-40091 critical↑12
- 9CWE-41690 critical↓12
- 10CWE-12280 critical↑2
One CVE is counted once per vendor, product or weakness class it lists, so a ranking column sums to more than the month's total. Only the month's top 100 keys per dimension are stored.