Month report
January 2022
Rolled up 2026-08-09 20:45 from 376,493 CVE records
1,988 CVEs published, +31.3% on the same month last year. 70 rated critical, 40 listed by CISA as exploited. oracle led with 163; the most common weakness class was CWE-79 (136). qnap systems climbed 53 places, the largest move. 14 vendors ranked for the first time.
Published
1,988
+0.5%on the previous month
Critical / high
70 / 484
of the 1,044 scored
Medium / low
409 / 81
the rest of the scored bands
Added to CISA KEV
40
listed as exploited this month
Public exploit
84
exploit code indexed publicly
Scanner template
0
0% of the month
Publication to KEV
How long before CISA listed them
12 published this month and listed since — not the 40 listed during it.
Median days to listing
89.5
from publication to CISA's date added
Listed within 7 days
8.3%
of the 12
Listed within 30 days
25%
of the 12
Detection gap
Listed as exploited, no public template
CVEs CISA listed this month
Listed this month
40
added to the CISA KEV catalog
With a template
22
55% covered
No template
18
nothing in the public index
Measured against the nuclei-templates CVE index only. No template there does not mean a CVE is undetectable by any other tool.
Vendors
Ranked by distinct CVEs this month
Δ is the move against last month's rank.
| # | Vendor | Top products | ||||||
|---|---|---|---|---|---|---|---|---|
| 1 | oracle | 163 | 8 | 1 | 6 | mysql cluster (44) · mysql server (29) · java se jdk and jre (16) | · | |
| 2 | microsoft | 101 | 6 | 2 | 7 | windows server 2019 (79) · windows server 2019 server core installation (79) · windows server 2022 (78) | ↓1 | |
| 3 | bentley | 78 | view (76) · contextcapture (2) | new | ||||
| 4 | huawei | 62 | 1 | harmonyos (56) · emui (24) · magic ui (20) | ↓2 | |||
| 5 | adobe | 46 | 1 | 1 | acrobat reader (26) · experience manager (8) · incopy (4) | ↑2 | ||
| 6 | qualcomm | 40 | 4 | snapdragon auto snapdragon compute snapdragon connectivity snapdragon consumer iot snapdragon industrial iot snapdragon voice music snapdragon wired infrastructure and networking (6) · snapdragon auto snapdragon compute snapdragon connectivity snapdragon consumer iot snapdragon industrial iot snapdragon mobile snapdragon voice music snapdragon wearables snapdragon wired infrastructure and networking (4) · snapdragon auto snapdragon compute snapdragon connectivity snapdragon consumer iot snapdragon industrial iot snapdragon voice music snapdragon wearables (3) | · | |||
| 7 | apache | 32 | 1 | 3 | apache kylin (6) · apache james (4) · apache shenyu incubating (4) | ↑5 | ||
| 8 | juniper networks | 27 | junos os (25) · junos os evolved (5) · contrail service orchestration (1) | · | ||||
| 9 | jenkins project | 24 | 1 | jenkins publish over ssh plugin (5) · jenkins bitbucket branch source plugin (2) · jenkins conjur secrets plugin (2) | · | |||
| 10 | ibm | 23 | security verify access (5) · cognos controller (4) · security guardium insights (3) | ↓6 | ||||
| 11 | cisco | 18 | 1 | cisco security manager (13) · cisco adaptive security appliance software (2) · cisco firepower threat defense software (2) | · | |||
| 12 | dell | 18 | 1 | vnx control station (4) · appsync (3) · integrated dell remote access controller idrac (3) | ↑6 | |||
| 13 | samsung mobile | 18 | 1 | samsung mobile devices (10) · samsung internet (2) · bixby routines (1) | ↓2 | |||
| 14 | vim | 16 | vim vim (16) | ↑3 | ||||
| 15 | gitlab | 13 | gitlab (13) | ↓6 | ||||
| 16 | fresenius kabi | 12 | vigilant software suite mastermed dashboard (6) · agilia link (5) · agilia connect wifi (1) | new | ||||
| 17 | livehelperchat | 12 | livehelperchat livehelperchat (12) | ↓1 | ||||
| 18 | mediatek | 11 | mt6580 mt6630 mt6735 mt6737 mt6739 mt6750s mt6753 mt6755s mt6757 mt6757c mt6757cd mt6757ch mt6763 mt6771 mt7662t mt7663 mt7668 mt8163 mt8167 mt8167s mt8173 mt8183 mt8321 mt8362a mt8362b mt8385 mt8765 mt8788 (2) · mt6781 mt6785 mt6833 mt6853 mt6853t mt6873 mt6877 mt6883 mt6885 mt6889 mt6891 mt6893 mt8185 mt8789 mt8791 mt8797 (2) · mt6580 mt6630 mt6735 mt6737 mt6739 mt6750s mt6753 mt6755s mt6757 mt6757c mt6757cd mt6757ch mt6761 mt6762 mt6763 mt6765 mt6768 mt6771 mt6779 mt6785 mt6833 mt6853 mt6853t mt6873 mt6877 mt6885 mt6889 mt6893 mt7662t mt7663 mt7668 mt7915 mt7920 mt7921 mt7922 mt8163 mt8167 mt8167s mt8168 mt8173 mt8175 mt8183 mt8185 mt8195 mt8321 mt8362a mt8362b mt8365 mt8385 mt8765 mt8766 mt8768 mt8786 mt8788 mt8789 mt8791 mt8797 (1) | new | ||||
| 19 | pimcore | 10 | pimcore pimcore (10) | ↑20 | ||||
| 20 | siemens | 10 | 1 | comos v10 2 (4) · comos v10 3 (4) · comos v10 4 (4) | ↓17 | |||
| 21 | onionshare | 9 | onionshare (9) | new | ||||
| 22 | qnap systems | 8 | qvr elite (5) · qvr guard (5) · qvr pro (5) | ↑53 | ||||
| 23 | bottelet | 7 | daybydaycrm (7) · flarepoint (5) | new | ||||
| 24 | linux | 7 | 1 | 1 | linux (5) · kernel (2) | · | ||
| 25 | trend micro | 7 | trend micro apex one (4) · trend micro worry free business security (4) · trend micro deep security agent for linux (2) | ↑1 | ||||
| 26 | janeczku | 6 | janeczku calibre web (6) | new | ||||
| 27 | microweber | 6 | microweber microweber (6) | new | ||||
| 28 | netgear | 6 | r6260 (3) · multiple routers (1) · r7000 (1) | · | ||||
| 29 | nvidia | 6 | shield tv (6) | · | ||||
| 30 | silicon labs | 6 | 500 series (4) · uzb 7 (2) · zst10 (2) | new | ||||
| 31 | tibco software | 6 | 1 | tibco eftl community edition (2) · tibco eftl developer edition (2) · tibco eftl enterprise edition (2) | · | |||
| 32 | western digital | 6 | 1 | my cloud (5) · edgerover (1) | · | |||
| 33 | atlassian | 5 | jira data center (3) · jira server (3) · jira service management data center (2) | ↑22 | ||||
| 34 | commvault | 5 | 1 | commcell (5) | · | |||
| 35 | discourse | 5 | discourse (5) | ↓6 | ||||
| 36 | konica minolta | 5 | bizhub series (5) | new | ||||
| 37 | mcafee | 5 | mcafee agent for windows (2) · mcafee application and change control macc (1) · mcafee data loss prevention dlp epo extension (1) | ↑34 | ||||
| 38 | sap se | 5 | sap s 4hana (2) · sap business one (1) · sap enterprise threat detection (1) | ↓24 | ||||
| 39 | arista networks | 4 | 3 | eos (2) · arista eos (1) · terminattr (1) | · | |||
| 40 | crater invoice | 4 | crater invoice crater (4) | new | ||||
| 41 | 4 | dart sdk (1) · fuchsia (1) · google protobuf jruby gem (1) | ↓35 | |||||
| 42 | kron | 4 | single connect (4) | new | ||||
| 43 | mattermost | 4 | mattermost (2) · mattermost boards (2) | ↑8 | ||||
| 44 | mirantis | 4 | lens (2) · bored agent (1) · mirantis container runtime (1) | new | ||||
| 45 | palo alto networks | 4 | cortex xdr agent (4) | · | ||||
| 46 | phoronix test suite | 4 | phoronix test suite phoronix test suite (4) | new | ||||
| 47 | wordpress | 4 | 1 | wordpress develop (4) | · | |||
| 48 | zabbix | 4 | 1 | 2 | 2 | frontend (3) · proxy server (1) | · | |
| 49 | aaron junker | 3 | 2 | usoc (3) | new | |||
| 50 | asus | 3 | rt ax56u (2) · pa90 (1) · pb50 (1) | · |
One CVE is counted once per vendor, product or weakness class it lists, so a ranking column sums to more than the month's total. Only the month's top 100 keys per dimension are stored. The KEV column counts CVEs published in 2022-01 that are on the CISA KEV catalog today. The 40 in the headline is what CISA listed during the month, whenever those CVEs were published. All 50 ranked vendors are listed; a zero count renders as a dot.
Weaknesses
CWE classes by distinct CVEs
- 1CWE-791362 critical—
- 2CWE-20832 critical↑6
- 3CWE-125434 critical—
- 4CWE-787392 critical↑3
- 5CWE-416360 critical↑14
- 6CWE-89274 critical↓4
- 7CWE-400250 critical↑11
- 8CWE-284240 critical↑2
- 9CWE-352230 critical↓5
- 10CWE-122221 critical↑10
- 1CWE-121192 critical↓2
- 2CWE-862190 critical↓1
- 3CWE-200170 critical↑2
- 4CWE-476160 critical↑8
- 5CWE-287141 critical↑2
- 6CWE-78126 critical↓10
- 7CWE-190114 critical↑52
- 8CWE-22111 critical↓13
- 9CWE-285103 critical↑17
- 10CWE-863100 critical↑21
One CVE is counted once per vendor, product or weakness class it lists, so a ranking column sums to more than the month's total. Only the month's top 100 keys per dimension are stored.