Month report
April 2022
Rolled up 2026-08-09 20:45 from 370,662 CVE records
2,039 CVEs published, +12.2% on the same month last year. 127 rated critical, 45 listed by CISA as exploited. microsoft led with 127; the most common weakness class was CWE-79 (146). sonicwall climbed 55 places, the largest move. 7 vendors ranked for the first time.
Published
2,039
-1.3%on the previous month
Critical / high
127 / 421
of the 1,047 scored
Medium / low
444 / 55
the rest of the scored bands
Added to CISA KEV
45
listed as exploited this month
Public exploit
101
exploit code indexed publicly
Scanner template
0
0% of the month
Publication to KEV
How long before CISA listed them
16 published this month and listed since — not the 45 listed during it.
Median days to listing
84
from publication to CISA's date added
Listed within 7 days
37.5%
of the 16
Listed within 30 days
43.8%
of the 16
Weakness × vendor
Where the two overlap
CVEs carrying both. Each row is shaded against its own worst class.
| Vendor | CWE-79 | CWE-20 | CWE-129 | CWE-22 | CWE-200 | CWE-284 | CWE-89 | CWE-352 |
|---|---|---|---|---|---|---|---|---|
| microsoft | ||||||||
| oracle | 1 | |||||||
| cisco | 4 | 2 | 11 | 3 | 1 | 2 | ||
| samsung mobile | 11 | 3 | 2 | 9 | ||||
| ibm | ||||||||
| cgal project | 38 | |||||||
| dell | 1 | 2 | 1 |
Detection gap
Listed as exploited, no public template
CVEs CISA listed this month
Listed this month
45
added to the CISA KEV catalog
With a template
10
22.2% covered
No template
35
nothing in the public index
Measured against the nuclei-templates CVE index only. No template there does not mean a CVE is undetectable by any other tool.
Vendors
Ranked by distinct CVEs this month
Δ is the move against last month's rank.
| # | Vendor | Top products | ||||||
|---|---|---|---|---|---|---|---|---|
| 1 | microsoft | 127 | 3 | 2 | 10 | windows server 2022 (97) · windows server version 20h2 (96) · windows server 2019 (92) | ↑1 | |
| 2 | oracle | 85 | 3 | 1 | 2 | mysql server (24) · mysql cluster (7) · java se jdk and jre (6) | · | |
| 3 | cisco | 58 | 3 | cisco ios (13) · cisco ios xe software (10) · cisco unified communications manager (5) | · | |||
| 4 | samsung mobile | 55 | samsung mobile devices (38) · galaxy store (3) · samsung flow (2) | ↑2 | ||||
| 5 | 47 | 1 | chrome (47) | ↑52 | ||||
| 6 | ibm | 45 | cognos analytics (7) · qradar siem (7) · infosphere information server (5) | ↓1 | ||||
| 7 | cgal project | 38 | 38 | libcgal (38) | new | |||
| 8 | dell | 33 | 1 | powerscale onefs (20) · vnx2 (4) · dell wyse device agent (3) | ↑20 | |||
| 9 | siemens | 25 | scalance x302 7 eec 230v (9) · scalance x302 7 eec 230v coated (9) · scalance x302 7 eec 24v (9) | ↓2 | ||||
| 10 | gitlab | 24 | 1 | 2 | gitlab (23) · gitlab pages (1) | ↑3 | ||
| 11 | mediatek | 21 | mt6580 mt6731 mt6735 mt6750s mt6753 mt6755s mt6757 mt6757c mt6757cd mt6757ch mt6761 mt6762 mt6763 mt6765 mt6768 mt6769 mt6771 mt6779 mt6781 mt6785 mt6833 mt6853 mt6853t mt6873 mt6875 mt6877 mt6883 mt6885 mt6889 mt6891 mt6893 mt8127 mt8135 mt8163 mt8167 mt8167s mt8168 mt8173 mt8175 mt8176 mt8183 mt8312c mt8312d mt8321 mt8362a mt8365 mt8382 mt8385 mt8389 mt8392 mt8392 90 mt8665 mt8685 mt8693 mt8735 mt8735b mt8735m mt8752 mt8765 mt8783 mt8785 mt8788 (2) · mt6781 mt6785 mt6833 mt6853 mt6853t mt6873 mt6877 mt6883 mt6885 mt6889 mt6891 mt6893 mt8185 mt8789 mt8791 mt8797 (2) · mt2601 mt6580 mt6735 mt6739 mt6761 mt6763 mt6765 mt6768 mt6771 mt6779 mt6781 mt6785 mt6799 mt6833 mt6873 mt6877 mt6885 mt6893 mt8163 mt8167 mt8167s mt8168 mt8173 mt8175 mt8183 mt8185 mt8321 mt8362a mt8365 mt8385 mt8666 mt8667 mt8675 mt8695 mt8696 mt8765 mt8766 mt8768 mt8786 mt8788 mt8789 mt8791 mt8797 (1) | ↑3 | ||||
| 12 | sap se | 19 | 1 | sap 3d visual enterprise viewer (6) · sap businessobjects business intelligence platform (4) · sap netweaver internet communication manager (2) | ↑4 | |||
| 13 | jenkins project | 17 | jenkins promoted builds plugin (2) · jenkins publish over ftp plugin (2) · jenkins subversion plugin (2) | ↓9 | ||||
| 14 | fortinet | 16 | 2 | fortinet fortiwan (6) · fortinet fortiedr (3) · fortinet forticlientlinux (2) | ↑3 | |||
| 15 | jetbrains | 16 | intellij idea (9) · youtrack (3) · hub (1) | · | ||||
| 16 | juniper networks | 16 | junos os (13) · junos os evolved (6) · contrail service orchestration (1) | · | ||||
| 17 | lenovo | 15 | 2 | bios (3) · notebook bios (3) · pcmanager (3) | · | |||
| 18 | qualcomm | 15 | 1 | snapdragon auto snapdragon compute snapdragon connectivity snapdragon consumer iot snapdragon industrial iot snapdragon mobile snapdragon voice music snapdragon wearables (3) · snapdragon auto snapdragon compute snapdragon connectivity snapdragon industrial iot snapdragon mobile (3) · snapdragon auto (1) | · | |||
| 19 | radareorg | 15 | radareorg radare2 (15) | ↑29 | ||||
| 20 | accusoft | 11 | 10 | imagegear (11) | new | |||
| 21 | apache | 11 | 1 | 1 | 2 | apache nifi (2) · apache subversion (2) · apache apisix (1) | ↓6 | |
| 22 | b braun melsungen | 11 | battery pack with wi fi (11) · data module compactplus (11) · spacecom (11) | · | ||||
| 23 | asus | 10 | 1 | rt ax56u (4) · rt ac86u (3) · rt ax88u (2) | · | |||
| 24 | bender ebee | 8 | 1 | cc612 (8) · cc613 (8) · icc15xx (8) | new | |||
| 25 | huawei | 8 | emui (8) · harmonyos (8) · magic ui (6) | ↓15 | ||||
| 26 | philips | 8 | vue motion (7) · vue myvue (7) · vue pacs (7) | · | ||||
| 27 | reolink | 8 | rlc 410w (8) | · | ||||
| 28 | codesys | 7 | codesys control for beaglebone sl (6) · codesys control for beckhoff cx9020 sl (6) · codesys control for empc a imx6 sl (6) | · | ||||
| 29 | mdt software | 7 | 2 | a4sp (7) · autosave for system platform a4sp (7) · mdt autosave (7) | new | |||
| 30 | aveva | 6 | aveva system platform (6) | · | ||||
| 31 | combodo | 6 | 2 | 1 | itop (6) | · | ||
| 32 | eaton | 6 | intelligent power manager infrastructure ipm infrastructure (3) · eaton intelligent power protector ipp (1) · intelligent power manager ipm 1 (1) | · | ||||
| 33 | elcomplus | 6 | 2 | smartptt (4) · smartptt scada server (2) | new | |||
| 34 | moxa | 6 | 3 | nport iaw5000a i o series firmware (4) · mxview series (2) | · | |||
| 35 | nextcloud | 6 | security advisories (6) | ↓5 | ||||
| 36 | nvidia | 6 | jetson agx xavier series jetson xavier nx (4) · jetson agx xavier series jetson xavier nx jetson tx2 nx jetson tx2 series (1) · nvidia omniverse cache (1) | ↑10 | ||||
| 37 | xen | 6 | xen (6) | · | ||||
| 38 | automation direct | 5 | 3 | click plc cpu modules c0 1x cpus (5) | new | |||
| 39 | fanuc | 5 | roboguide (5) | · | ||||
| 40 | fuji electric | 5 | alpha5 (5) | · | ||||
| 41 | livehelperchat | 5 | livehelperchat livehelperchat (5) | ↑51 | ||||
| 42 | mattermost | 5 | mattermost (4) · mattermost playbooks (1) | ↑2 | ||||
| 43 | mruby | 5 | 1 | mruby mruby (5) | ↑18 | |||
| 44 | shopware | 5 | shopware (3) · platform (2) | ↓8 | ||||
| 45 | sonicwall | 5 | sonicos (4) · sonicwall sra sma100 (1) | ↑55 | ||||
| 46 | amazon web services | 4 | hotdog (2) · log4j cve 2021 44228 hotpatch (2) | · | ||||
| 47 | causefx | 4 | 4 | causefx organizr (4) | new | |||
| 48 | discourse | 4 | discourse (3) · discourse assign (1) | · | ||||
| 49 | f secure | 4 | f secure mobile security (3) · all f secure endpoint protection products on windows and mac f secure linux security 32 bit f secure linux security 64 f secure atlant f secure internet gatekeeper f secure cloud protection for salesforce (1) | ↓16 | ||||
| 50 | janeczku | 4 | 2 | janeczku calibre web (4) | ↑38 |
One CVE is counted once per vendor, product or weakness class it lists, so a ranking column sums to more than the month's total. Only the month's top 100 keys per dimension are stored. The KEV column counts CVEs published in 2022-04 that are on the CISA KEV catalog today. The 45 in the headline is what CISA listed during the month, whenever those CVEs were published. All 50 ranked vendors are listed; a zero count renders as a dot.
Weaknesses
CWE classes by distinct CVEs
- 1CWE-7914614 critical—
- 2CWE-20574 critical↑2
- 3CWE-1294039 critical↑85
- 4CWE-22382 critical↑5
- 5CWE-200330 critical↓2
- 6CWE-284310 critical↑9
- 7CWE-89314 critical↓5
- 8CWE-352290 critical↑14
- 9CWE-122268 critical↑15
- 10CWE-125241 critical↓2
- 1CWE-94164 critical↑8
- 2CWE-476150 critical↓6
- 3CWE-434144 critical↓6
- 4CWE-287132 critical↓4
- 5CWE-119121 critical↓3
- 6CWE-400120 critical↑13
- 7CWE-787121 critical↓6
- 8CWE-269111 critical↑9
- 9CWE-120101 critical↑2
- 10CWE-288106 critical·
One CVE is counted once per vendor, product or weakness class it lists, so a ranking column sums to more than the month's total. Only the month's top 100 keys per dimension are stored.