Month report
March 2022
Rolled up 2026-08-09 20:45 from 375,743 CVE records
2,065 CVEs published, +42.7% on the same month last year. 94 rated critical, 226 listed by CISA as exploited. apple led with 74; the most common weakness class was CWE-79 (170). libtiff climbed 46 places, the largest move. 11 vendors ranked for the first time.
Published
2,065
+6.3%on the previous month
Critical / high
94 / 283
of the 728 scored
Medium / low
290 / 61
the rest of the scored bands
Added to CISA KEV
226
listed as exploited this month
Public exploit
114
exploit code indexed publicly
Scanner template
0
0% of the month
Publication to KEV
How long before CISA listed them
16 published this month and listed since — not the 226 listed during it.
Median days to listing
61.5
from publication to CISA's date added
Listed within 7 days
25%
of the 16
Listed within 30 days
43.8%
of the 16
Weakness × vendor
Where the two overlap
CVEs carrying both. Each row is shaded against its own worst class.
| Vendor | CWE-79 | CWE-89 | CWE-200 | CWE-20 | CWE-788 | CWE-476 | CWE-434 | CWE-125 |
|---|---|---|---|---|---|---|---|---|
| apple | ||||||||
| microsoft | ||||||||
| adobe | 24 | 14 | 6 | |||||
| jenkins project | ||||||||
| ibm | ||||||||
| samsung mobile | 6 | 1 | 2 | |||||
| siemens | 4 | 1 | ||||||
| delta electronics | 15 | 1 |
Detection gap
Listed as exploited, no public template
CVEs CISA listed this month
Listed this month
226
added to the CISA KEV catalog
With a template
39
17.3% covered
No template
187
nothing in the public index
- 1microsoft33of 33 listed
- 2cisco12of 12 listed
- 3intellishield5of 5 listed
- 4sonicwall3of 3 listed
- 5mozilla2of 2 listed
- 6qnap systems1of 2 listed
- 7adobe1of 1 listed
- 8dell1of 1 listed
Measured against the nuclei-templates CVE index only. No template there does not mean a CVE is undetectable by any other tool.
Vendors
Ranked by distinct CVEs this month
Δ is the move against last month's rank.
| # | Vendor | Top products | ||||||
|---|---|---|---|---|---|---|---|---|
| 1 | apple | 74 | 1 | 2 | 3 | macos (49) · ios and ipados (43) · tvos (27) | · | |
| 2 | microsoft | 70 | 2 | windows 10 version 1909 (30) · windows 10 version 21h1 (30) · windows 10 version 21h2 (30) | ↑1 | |||
| 3 | adobe | 53 | audition (9) · bridge (9) · character animator preview 4 (8) | ↑9 | ||||
| 4 | jenkins project | 52 | jenkins continuous integration with toad edge plugin (4) · jenkins extended choice parameter plugin (4) · jenkins job and node ownership plugin (4) | — | ||||
| 5 | ibm | 27 | aix (6) · vios (6) · spectrum copy data management (4) | ↑8 | ||||
| 6 | samsung mobile | 22 | samsung mobile devices (12) · galaxy watch plugin (2) · bixbytouch (1) | ↑1 | ||||
| 7 | siemens | 22 | 1 | 2 | ruggedcom i800 (7) · ruggedcom i801 (7) · ruggedcom i802 (7) | ↑1 | ||
| 8 | delta electronics | 19 | 16 | diaenergie (18) · cncsoft (1) | · | |||
| 9 | star7th | 19 | 7 | 1 | star7th showdoc (19) | · | ||
| 10 | huawei | 17 | emui (17) · magic ui (17) · harmonyos (10) | ↓4 | ||||
| 11 | rockwell automation | 17 | 10 | factorytalk assetcentre (9) · isagraf runtime (5) · connected components workbench (3) | ↑23 | |||
| 12 | microweber | 16 | 1 | microweber microweber (16) | ↓1 | |||
| 13 | gitlab | 14 | 1 | 1 | gitlab (14) | · | ||
| 14 | mediatek | 13 | mt6761 mt6762 mt6765 mt6768 mt6771 mt6779 mt6781 mt6785 mt6833 mt6853 mt6853t mt6873 mt6877 mt6885 mt6893 mt8183 mt8185 mt8321 mt8385 mt8666 mt8667 mt8675 mt8735a mt8735b mt8765 mt8766 mt8768 mt8786 mt8788 mt8789 mt8791 mt8797 (3) · mt5816 mt5835 mt6885 mt6893 mt9900 mt9901 mt9950 mt9969 mt9970 mt9980 (2) · mt6580 mt6739 mt6750 mt6761 mt6762 mt6763 mt6765 mt6768 mt6771 mt6779 mt8167 mt8168 mt8173 mt8183 mt8185 mt8321 mt8362a mt8365 mt8385 mt8666 mt8667 mt8675 mt8765 mt8766 mt8768 mt8786 mt8788 mt8789 mt8791 mt8797 (1) | ↓4 | ||||
| 15 | apache | 12 | 1 | apache http server (4) · apache traffic server (2) · apache any23 (1) | ↑1 | |||
| 16 | sap se | 12 | sap netweaver enterprise portal (2) · fiori launchpad (1) · sap business objects business intelligence platform (1) | ↓1 | ||||
| 17 | fortinet | 11 | 1 | fortinet fortiwlm (3) · fortinet fortimail (2) · fortinet fortiap c (1) | ↑36 | |||
| 18 | schneider electric | 11 | 2 | ecostruxure control expert (3) · smartconnect (3) · ecostruxure process expert (2) | · | |||
| 19 | yokogawa electric | 10 | centum vp (10) · exaopc (10) · centum cs 3000 (8) | · | ||||
| 20 | ge | 9 | 3 | ur family (6) · reason rt43x clocks (2) · ur bootloader binary (1) | · | |||
| 21 | joomla project | 9 | joomla cms (9) · joomla archive (1) · joomla filesystem (1) | · | ||||
| 22 | mcafee | 8 | mcafee epolicy orchestrator epo (6) · mcafee total protection for windows (1) · mcafee webadvisor (1) | · | ||||
| 23 | pimcore | 8 | pimcore pimcore (7) · pimcore data hub (1) | ↑22 | ||||
| 24 | aternity | 7 | 4 | steelcentral appinternals dynamic sampling agent (7) | new | |||
| 25 | ptc | 7 | 3 | axeda agent (7) · axeda desktop server for windows (7) | new | |||
| 26 | yandex | 7 | clickhouse (7) | new | ||||
| 27 | atlassian | 6 | 1 | crucible (5) · fisheye (5) · jira data center (1) | ↓3 | |||
| 28 | dell | 6 | cpg bios (5) · dell emc enterprise storage analytics for vrealize operations (1) | ↑14 | ||||
| 29 | libtiff | 6 | libtiff (6) | ↑46 | ||||
| 30 | nextcloud | 6 | security advisories (6) | · | ||||
| 31 | sourcecodester | 6 | one church management system (3) · microfinance management system (2) · college website management system (1) | new | ||||
| 32 | weka | 6 | interest security scanner (6) | new | ||||
| 33 | f secure | 5 | f secure safe browser for android version 18 5 (2) · f secure elements agent f secure mdr f secure client security f secure server security f secure email and server security f secure freedome vpn f secure safe f secure key and f secure internet security anti virus (1) · f secure endpoint protection products on mac f secure linux security 32 bit f secure linux security 64 f secure atlant f secure internet gatekeeper f secure security cloud (1) | · | ||||
| 34 | omron | 5 | cx programmer (5) | · | ||||
| 35 | openemr | 5 | openemr openemr (5) | new | ||||
| 36 | shopware | 5 | platform (5) | · | ||||
| 37 | sophos | 5 | 1 | 1 | 1 | sophos firewall (2) · sophos utm (2) · ssl vpn client (1) | · | |
| 38 | sylius | 5 | 1 | sylius (4) · syliusgridbundle (1) | · | |||
| 39 | crater invoice | 4 | crater invoice crater (4) | · | ||||
| 40 | hestiacp | 4 | hestiacp hestiacp (4) | new | ||||
| 41 | ipcomm | 4 | ipcomm ipdio (4) | new | ||||
| 42 | isc | 4 | bind (4) | · | ||||
| 43 | kingsoft japan | 4 | 1 | the installer of wps office (2) · kingsoft internet security 9 plus (1) · wps presentation (1) | new | |||
| 44 | mattermost | 4 | mattermost (4) | · | ||||
| 45 | naver | 4 | naver whale browser (4) | · | ||||
| 46 | nvidia | 4 | jetson nano jetson nano 2gb (1) · nvidia cuda toolkit (1) · nvidia data center gpu manager (1) | ↓13 | ||||
| 47 | pfsense | 4 | pfsense ce and pfsense plus (3) · pfsense pkg wireguard (1) | new | ||||
| 48 | radareorg | 4 | radareorg radare2 (4) | ↓31 | ||||
| 49 | secomea | 4 | 1 | gatemanager (3) · sitemanager (1) | · | |||
| 50 | smartertools | 4 | 1 | smartertrack (4) | new |
One CVE is counted once per vendor, product or weakness class it lists, so a ranking column sums to more than the month's total. Only the month's top 100 keys per dimension are stored. The KEV column counts CVEs published in 2022-03 that are on the CISA KEV catalog today. The 226 in the headline is what CISA listed during the month, whenever those CVEs were published. All 50 ranked vendors are listed; a zero count renders as a dot.
Weaknesses
CWE classes by distinct CVEs
- 1CWE-791704 critical—
- 2CWE-896021 critical↑7
- 3CWE-200431 critical↑5
- 4CWE-20297 critical↓1
- 5CWE-788240 critical·
- 6CWE-476230 critical↑9
- 7CWE-434207 critical↑35
- 8CWE-125190 critical↓6
- 9CWE-22182 critical↑5
- 10CWE-287181 critical↑13
- 1CWE-787181 critical↓6
- 2CWE-119170 critical↑15
- 3CWE-862170 critical↓3
- 4CWE-78158 critical↑4
- 5CWE-284140 critical↓4
- 6CWE-416140 critical↓12
- 7CWE-190131 critical↓4
- 8CWE-863130 critical↑1
- 9CWE-94122 critical↑7
- 10CWE-601110 critical↑11
One CVE is counted once per vendor, product or weakness class it lists, so a ranking column sums to more than the month's total. Only the month's top 100 keys per dimension are stored.