Month report
February 2022
Rolled up 2026-08-09 20:45 from 370,662 CVE records
1,942 CVEs published, +33.5% on the same month last year. 64 rated critical, 32 listed by CISA as exploited. bentley led with 95; the most common weakness class was CWE-79 (125). alexander fuchs climbed 52 places, the largest move. 6 vendors ranked for the first time.
Published
1,942
-2.3%on the previous month
Critical / high
64 / 374
of the 823 scored
Medium / low
329 / 56
the rest of the scored bands
Added to CISA KEV
32
listed as exploited this month
Public exploit
94
exploit code indexed publicly
Scanner template
0
0% of the month
Publication to KEV
How long before CISA listed them
18 published this month and listed since — not the 32 listed during it.
Median days to listing
41
from publication to CISA's date added
Listed within 7 days
11.1%
of the 18
Listed within 30 days
44.4%
of the 18
Weakness × vendor
Where the two overlap
CVEs carrying both. Each row is shaded against its own worst class.
| Vendor | CWE-79 | CWE-125 | CWE-20 | CWE-416 | CWE-787 | CWE-121 | CWE-352 | CWE-200 |
|---|---|---|---|---|---|---|---|---|
| bentley | 39 | 18 | 20 | 4 | ||||
| 1 | 1 | |||||||
| microsoft | 1 | |||||||
| jenkins project | ||||||||
| tensorflow | 4 | 1 | 4 | |||||
| huawei | ||||||||
| samsung mobile | 1 | 8 | 2 | |||||
| siemens | 1 | 1 | 7 | 4 | 1 |
Detection gap
Listed as exploited, no public template
CVEs CISA listed this month
Listed this month
32
added to the CISA KEV catalog
With a template
11
34.4% covered
No template
21
nothing in the public index
- 1microsoft11of 12 listed
- 2apple1of 1 listed
- 3check point software technologies1of 1 listed
- 4dlink1of 1 listed
- 5google1of 1 listed
Measured against the nuclei-templates CVE index only. No template there does not mean a CVE is undetectable by any other tool.
Vendors
Ranked by distinct CVEs this month
Δ is the move against last month's rank.
| # | Vendor | Top products | ||||||
|---|---|---|---|---|---|---|---|---|
| 1 | bentley | 95 | microstation connect (74) · view (21) | ↑2 | ||||
| 2 | 56 | 1 | chrome (50) · fscrypt (3) · dart sdk (1) | ↑39 | ||||
| 3 | microsoft | 51 | 3 | 5 | windows 11 version 21h2 (22) · windows 10 version 1909 (21) · windows 10 version 21h1 (21) | ↓1 | ||
| 4 | jenkins project | 41 | 3 | jenkins pipeline shared groovy libraries plugin (6) · jenkins chef sinatra plugin (3) · jenkins pipeline groovy plugin (3) | ↑5 | |||
| 5 | tensorflow | 36 | tensorflow (36) | · | ||||
| 6 | huawei | 30 | emui (26) · magic ui (18) · harmonyos (17) | ↓2 | ||||
| 7 | samsung mobile | 26 | 1 | samsung mobile devices (10) · samsung wearable devices (4) · samsung mobile devices with exynos chipsets (3) | ↑6 | |||
| 8 | siemens | 26 | simatic field pg m5 (18) · simatic field pg m6 (18) · simatic ipc127e (18) | ↑12 | ||||
| 9 | cisco | 25 | 15 | 5 | 3 | cisco small business rv series router firmware (15) · cisco nx os software (4) · cisco digital network architecture center dna center (1) | ↑2 | |
| 10 | mediatek | 24 | mt8167 mt8175 mt8183 mt8362a mt8365 mt8385 (10) · mt6781 mt6785 mt6833 mt6853 mt6853t mt6873 mt6877 mt6883 mt6885 mt6889 mt6891 mt6893 mt8185 mt8789 mt8791 mt8797 (2) · mt6580 mt6582e mt6582h mt6582t mt6582w mt6582 90 mt6589 mt6589td mt6592e mt6592h mt6592t mt6592w mt6592 90 mt6595 mt6731 mt6732 mt6735 mt6737 mt6739 mt6750 mt6750s mt6752 mt6753 mt6755 mt6755s mt6757 mt6757c mt6757cd mt6757ch mt6758 mt6761 mt6762 mt6763 mt6765 mt6768 mt6769 mt6771 mt6779 mt6781 mt6785 mt6795 mt6797 mt6799 mt6833 mt6853 mt6853t mt6873 mt6875 mt6877 mt6883 mt6885 mt6889 mt6891 mt6893 (1) | ↑8 | ||||
| 11 | microweber | 21 | 4 | 2 | microweber microweber (21) | ↑16 | ||
| 12 | adobe | 18 | 1 | 1 | 1 | illustrator (13) · after effects (1) · creative cloud desktop component (1) | ↓7 | |
| 13 | ibm | 18 | aix (3) · maximo anywhere (3) · vios (3) | ↓3 | ||||
| 14 | foxit | 16 | pdf reader (16) | · | ||||
| 15 | sap se | 15 | 1 | 1 | 1 | sap 3d visual enterprise viewer (3) · sap netweaver application server java (2) · sap adaptive server enterprise (1) | ↑23 | |
| 16 | apache | 14 | 1 | 1 | 3 | apache airflow (2) · apache gobblin (2) · apache jspwiki (2) | ↓9 | |
| 17 | radareorg | 14 | radareorg radare2 (14) | · | ||||
| 18 | qualcomm | 13 | 1 | snapdragon auto snapdragon compute snapdragon connectivity snapdragon consumer iot snapdragon industrial iot snapdragon voice music snapdragon wearables (2) · snapdragon auto snapdragon compute snapdragon connectivity snapdragon industrial iot snapdragon mobile (2) · snapdragon auto snapdragon compute snapdragon consumer iot snapdragon industrial iot snapdragon mobile snapdragon voice music snapdragon wearables snapdragon wired infrastructure and networking (2) | ↓12 | |||
| 19 | drupal | 11 | core (10) · entity embed (1) | · | ||||
| 20 | sante | 10 | dicom viewer pro (10) | new | ||||
| 21 | xwiki | 10 | xwiki platform (10) | · | ||||
| 22 | mruby | 9 | mruby mruby (9) | ↑35 | ||||
| 23 | vim | 9 | vim vim (9) | ↓9 | ||||
| 24 | atlassian | 8 | jira data center (4) · jira server (4) · jira service management data center (3) | ↑9 | ||||
| 25 | envoyproxy | 8 | envoy (8) | · | ||||
| 26 | trend micro | 8 | trend micro worry free business security (4) · trend micro apex one (3) · trend micro serverprotect for emc celerra (3) | ↓1 | ||||
| 27 | acronis | 7 | acronis cyber protect home office (6) · acronis true image 2021 (6) · acronis agent (2) | · | ||||
| 28 | airspan networks | 7 | 3 | mmp (7) · ptmp c series and a5x (7) · ptp c series (7) | new | |||
| 29 | librenms | 7 | librenms librenms (7) | new | ||||
| 30 | palo alto networks | 7 | 1 | globalprotect app (5) · cortex xsoar (1) · pan os (1) | ↑15 | |||
| 31 | synology | 7 | 1 | diskstation manager dsm (6) · mail station (1) | · | |||
| 32 | wp statistics | 6 | 3 | 1 | wp statistics (6) | · | ||
| 33 | nvidia | 5 | nvidia gpu display driver (3) · nvidia license system (1) · nvidia virtual gpu software and nvidia cloud gaming (1) | ↓4 | ||||
| 34 | rockwell automation | 5 | 1734 aentr (2) · factorytalk view se (2) · factorytalk services platform (1) | · | ||||
| 35 | teluu | 5 | pjsip (5) | new | ||||
| 36 | wireshark foundation | 5 | wireshark (5) | · | ||||
| 37 | abb | 4 | pni800 (3) · spiet800 (3) · 800xa control software for ac 800m opc server for ac 800m (1) | · | ||||
| 38 | amd | 4 | 1st 2nd 3rd gen amd epyc processors (1) · 2nd gen epyc (1) · 3rd gen epyc (1) | · | ||||
| 39 | appleple | 4 | a blog cms (4) | · | ||||
| 40 | canonical | 4 | 1 | snapd (4) | · | |||
| 41 | debian | 4 | 1 | 1 | 1 | debian edu config (1) · debian linux (1) · duck (1) | · | |
| 42 | dell | 4 | 1 | cpg bios (2) · dell bsafe ssl j (1) · dell emc integrated system for microsoft azure stack hub (1) | ↓30 | |||
| 43 | mariadb | 4 | mariadb (4) | new | ||||
| 44 | nodejs | 4 | node (4) | · | ||||
| 45 | pimcore | 4 | pimcore pimcore (4) | ↓26 | ||||
| 46 | snipe | 4 | snipe snipe it (4) | ↑40 | ||||
| 47 | unshiftio | 4 | unshiftio url parse (4) | new | ||||
| 48 | alexander fuchs | 3 | 3 | php everywhere (3) | ↑52 | |||
| 49 | chatwoot | 3 | chatwoot chatwoot (3) | · | ||||
| 50 | chocobozzz | 3 | chocobozzz peertube (3) | ↑1 |
One CVE is counted once per vendor, product or weakness class it lists, so a ranking column sums to more than the month's total. Only the month's top 100 keys per dimension are stored. The KEV column counts CVEs published in 2022-02 that are on the CISA KEV catalog today. The 32 in the headline is what CISA listed during the month, whenever those CVEs were published. All 50 ranked vendors are listed; a zero count renders as a dot.
Weaknesses
CWE classes by distinct CVEs
- 1CWE-791251 critical—
- 2CWE-125830 critical↑1
- 3CWE-20582 critical↓1
- 4CWE-416520 critical↑1
- 5CWE-787500 critical↓1
- 6CWE-1213818 critical↑5
- 7CWE-352350 critical↑2
- 8CWE-200280 critical↑5
- 9CWE-89284 critical↓3
- 10CWE-862251 critical↑2
- 1CWE-284241 critical↓3
- 2CWE-122211 critical↓2
- 3CWE-190211 critical↑4
- 4CWE-22211 critical↑4
- 5CWE-476210 critical↓1
- 6CWE-120130 critical↑5
- 7CWE-400130 critical↓10
- 8CWE-78133 critical↓2
- 9CWE-863131 critical↑1
- 10CWE-295100 critical↑76
One CVE is counted once per vendor, product or weakness class it lists, so a ranking column sums to more than the month's total. Only the month's top 100 keys per dimension are stored.