Month report
September 2022
Rolled up 2026-08-09 20:45 from 375,696 CVE records
2,148 CVEs published, +13.1% on the same month last year. 161 rated critical, 24 listed by CISA as exploited. apple led with 68; the most common weakness class was CWE-79 (186). jenkins project climbed 46 places, the largest move. 12 vendors ranked for the first time.
Published
2,148
Critical / high
161 / 601
Medium / low
666 / 46
Added to CISA KEV
24
Public exploit
74
Scanner template
0
Publication to KEV
How long before CISA listed them
Median days to listing
0.5
Listed within 7 days
58.3%
Listed within 30 days
66.7%
Weakness × vendor
Where the two overlap
| Vendor | CWE-79 | CWE-787 | CWE-89 | CWE-125 | CWE-352 | CWE-20 | CWE-416 | CWE-200 |
|---|---|---|---|---|---|---|---|---|
| apple | 15 | 10 | 3 | 2 | 4 | |||
| adobe | 13 | 6 | 26 | 1 | 5 | |||
| microsoft | 1 | |||||||
| tensorflow | 1 | 2 | 12 | |||||
| qualcomm | 1 | |||||||
| 1 | 9 | 1 | 2 | 15 | ||||
| samsung mobile | 5 | 3 | 2 | |||||
| jenkins project | 5 | 6 |
Detection gap
Listed as exploited, no public template
Listed this month
24
With a template
7
No template
17
- 1microsoft3of 3 listed
- 2apple2of 2 listed
- 3fortinet1of 1 listed
- 4google1of 1 listed
- 5trend micro1of 1 listed
Measured against the nuclei-templates CVE index only. No template there does not mean a CVE is undetectable by any other tool.
Vendors
Ranked by distinct CVEs this month
| # | Vendor | Top products | ||||||
|---|---|---|---|---|---|---|---|---|
| 1 | apple | 68 | 4 | 1 | 3 | macos (57) · tvos (24) · watchos (24) | ↑15 | |
| 2 | adobe | 65 | indesign (17) · experience manager (14) · bridge (12) | ↑3 | ||||
| 3 | microsoft | 64 | 3 | 1 | 4 | windows server 2022 (44) · windows server 2019 (43) · windows server 2019 server core installation (43) | ↓2 | |
| 4 | tensorflow | 59 | tensorflow (59) | · | ||||
| 5 | qualcomm | 54 | 5 | snapdragon auto snapdragon compute snapdragon connectivity snapdragon consumer iot snapdragon industrial iot snapdragon mobile snapdragon voice music snapdragon wearables (10) · snapdragon auto (8) · snapdragon auto snapdragon compute snapdragon connectivity snapdragon industrial iot snapdragon mobile snapdragon wearables (5) | · | |||
| 6 | 44 | 1 | 3 | 1 | chrome (42) · fedora (2) · kubevirt (1) | ↑2 | ||
| 7 | samsung mobile | 40 | samsung mobile devices (21) · samsung pay (3) · com samsung android waterplugin (2) | ↓3 | ||||
| 8 | jenkins project | 32 | 4 | jenkins cons3rt plugin (4) · jenkins build publisher plugin (3) · jenkins dotci plugin (3) | ↑46 | |||
| 9 | huawei | 30 | 3 | emui (30) · harmonyos (25) · magic ui (11) | ↑12 | |||
| 10 | ibm | 29 | cognos analytics (7) · websphere application server (3) · aix (2) | — | ||||
| 11 | apache | 26 | 1 | 3 | apache ofbiz (5) · apache airflow (4) · apache pulsar (4) | ↓5 | ||
| 12 | siemens | 25 | parasolid v33 1 (20) · parasolid v34 0 (20) · parasolid v34 1 (20) | ↑11 | ||||
| 13 | dell | 23 | 3 | cpg bios (11) · dell networking os10 (3) · powerscale onefs (3) | ↓4 | |||
| 14 | mediatek | 23 | mt6833 mt6853 mt6855 mt6873 mt6877 mt6879 mt6883 mt6885 mt6889 mt6893 mt6895 mt6983 mt8791 mt8797 (6) · mt6761 mt6765 mt6768 mt6771 mt6779 mt6781 mt6785 mt6833 mt6853 mt6875 mt6877 mt6879 mt6885 mt6893 mt6895 mt6983 (2) · mt6879 mt6895 mt6983 (2) | ↓7 | ||||
| 15 | ikus060 | 22 | 2 | ikus060 rdiffweb (20) · ikus060 minarca (2) | new | |||
| 16 | ansys | 19 | spaceclaim (19) | new | ||||
| 17 | cisco | 19 | 1 | 1 | cisco ios xe software (6) · cisco sd wan vmanage (3) · cisco aironet access point software ios xe controller (2) | ↓2 | ||
| 18 | trend micro | 15 | 1 | 1 | trend micro apex one (6) · trend micro deep security (4) · trend micro security consumer (3) | · | ||
| 19 | matrix org | 13 | matrix js sdk (4) · matrix android sdk2 (2) · matrix appservice irc (2) | · | ||||
| 20 | xwiki | 13 | 2 | xwiki platform (13) | · | |||
| 21 | carlo gavazzi | 11 | 6 | cpy car park server (11) · uwp 3 0 monitoring gateway and controller (11) · uwp 3 0 monitoring gateway and controller edp version (11) | new | |||
| 22 | vim | 11 | vim vim (11) | ↓9 | ||||
| 23 | fortinet | 10 | fortinet fortisoar (4) · fortinet fortios (3) · fortiadc (1) | ↑29 | ||||
| 24 | nikon | 9 | nis elements viewer (9) | new | ||||
| 25 | sap se | 8 | sap business one (1) · sap businessobjects business intelligence platform cmc (1) · sap businessobjects business intelligence platform commentary db (1) | ↑36 | ||||
| 26 | linux | 7 | kernel (7) · linux kernel (1) · simatic s7 1500 tm mfp gnu linux subsystem (1) | · | ||||
| 27 | smart evision information technology | 7 | 1 | smart evision (7) | new | |||
| 28 | glpi project | 6 | 1 | glpi (6) | · | |||
| 29 | isc | 6 | bind9 (6) · bind (2) · fedora (1) | · | ||||
| 30 | jgraph | 6 | jgraph drawio (6) | · | ||||
| 31 | nextcloud | 6 | security advisories (6) | ↑4 | ||||
| 32 | rizinorg | 6 | rizin (6) | new | ||||
| 33 | typo3 | 6 | typo3 (5) · html sanitizer (1) | · | ||||
| 34 | ami | 5 | aptio (5) | new | ||||
| 35 | contec health | 5 | cms8000 contec icu ccu vital signs patient monitor (5) | new | ||||
| 36 | discourse | 5 | 1 | discourse (4) · discourse chat (1) | ↑34 | |||
| 37 | hitachi energy | 5 | microscada x sys600 (5) · microscada pro sys600 (2) | · | ||||
| 38 | openharmony | 5 | openharmony (5) | new | ||||
| 39 | allied telesis k k | 4 | centrecom ar260s v2 (4) | · | ||||
| 40 | baxter | 4 | baxter spectrum wireless battery module wbm (4) | · | ||||
| 41 | fedoraproject | 4 | 2 | fedora (4) · chrome (2) · bind (1) | · | |||
| 42 | ieee | 4 | 802 2 (4) · draft ietf v6ops ra guard (3) · p802 1q (3) | · | ||||
| 43 | ietf | 4 | 802 2 (4) · draft ietf v6ops ra guard (3) · p802 1q (3) | · | ||||
| 44 | justinbusa | 4 | beaver builder wordpress page builder (4) | new | ||||
| 45 | mz automation | 4 | 2 | libiec61850 (4) | · | |||
| 46 | owasp | 4 | modsecurity core rule set (4) | new | ||||
| 47 | snakeyaml | 4 | snakeyaml (4) | new | ||||
| 48 | sourcecodester | 4 | clinics patient management system (2) · food ordering management system (1) · online employee leave management system (1) | ↓46 | ||||
| 49 | suse | 4 | 3 | 1 | rancher (3) · opensuse factory (1) | · | ||
| 50 | theonedev | 4 | 2 | onedev (4) | · |
One CVE is counted once per vendor, product or weakness class it lists, so a ranking column sums to more than the month's total. Only the month's top 100 keys per dimension are stored. The KEV column counts CVEs published in 2022-09 that are on the CISA KEV catalog today. The 24 in the headline is what CISA listed during the month, whenever those CVEs were published. All 50 ranked vendors are listed; a zero count renders as a dot.
Weaknesses
CWE classes by distinct CVEs
- 1CWE-791861 critical—
- 2CWE-78713918 critical↑7
- 3CWE-898934 critical↓1
- 4CWE-125660 critical↑2
- 5CWE-352600 critical↑3
- 6CWE-20511 critical↓2
- 7CWE-416481 critical—
- 8CWE-200440 critical↓3
- 9CWE-287397 critical↑12
- 10CWE-617360 critical·
- 1CWE-284351 critical↓1
- 2CWE-122312 critical↑17
- 3CWE-22303 critical↓1
- 4CWE-862271 critical↑5
- 5CWE-400250 critical↓2
- 6CWE-269221 critical↓5
- 7CWE-121215 critical↑1
- 8CWE-434207 critical↓2
- 9CWE-476190 critical↑1
- 10CWE-119161 critical↓6
One CVE is counted once per vendor, product or weakness class it lists, so a ranking column sums to more than the month's total. Only the month's top 100 keys per dimension are stored.