Month report
October 2022
Rolled up 2026-08-09 20:45 from 370,662 CVE records
1,849 CVEs published, +8.4% on the same month last year. 240 rated critical, 12 listed by CISA as exploited. microsoft led with 87; the most common weakness class was CWE-79 (168). sourcecodester climbed 44 places, the largest move. 12 vendors ranked for the first time.
Published
1,849
-13.9%on the previous month
Critical / high
240 / 578
of the 1,552 scored
Medium / low
654 / 80
the rest of the scored bands
Added to CISA KEV
12
listed as exploited this month
Public exploit
58
exploit code indexed publicly
Scanner template
0
0% of the month
Publication to KEV
How long before CISA listed them
8 published this month and listed since — not the 12 listed during it.
Median days to listing
53.5
from publication to CISA's date added
Listed within 7 days
50%
of the 8
Listed within 30 days
50%
of the 8
Weakness × vendor
Where the two overlap
CVEs carrying both. Each row is shaded against its own worst class.
| Vendor | CWE-79 | CWE-787 | CWE-119 | CWE-89 | CWE-125 | CWE-284 | CWE-434 | CWE-20 |
|---|---|---|---|---|---|---|---|---|
| microsoft | ||||||||
| oracle | 5 | |||||||
| sap se | 4 | 28 | 43 | |||||
| sourcecodester | 1 | |||||||
| abode systems | 1 | |||||||
| unisoc shanghai technologies co | 2 | 1 | ||||||
| juniper networks | 2 | 4 | ||||||
| jenkins project | 3 | 1 |
Detection gap
Listed as exploited, no public template
CVEs CISA listed this month
Listed this month
12
added to the CISA KEV catalog
With a template
2
16.7% covered
No template
10
nothing in the public index
Measured against the nuclei-templates CVE index only. No template there does not mean a CVE is undetectable by any other tool.
Vendors
Ranked by distinct CVEs this month
Δ is the move against last month's rank.
| # | Vendor | Top products | ||||||
|---|---|---|---|---|---|---|---|---|
| 1 | microsoft | 87 | 1 | 4 | 5 | windows 11 version 21h2 (66) · windows server 2022 (66) · windows 10 version 21h1 (64) | ↑2 | |
| 2 | oracle | 79 | 2 | 1 | 2 | mysql server (25) · vm virtualbox (10) · java se jdk and jre (6) | · | |
| 3 | sap se | 55 | 1 | sap 3d visual enterprise author (26) · sap 3d visual enterprise viewer (17) · sap customer data cloud gigya (2) | ↑22 | |||
| 4 | sourcecodester | 40 | 2 | human resource management system (9) · sanitization management system (7) · simple cold storage management system (7) | ↑44 | |||
| 5 | abode systems | 38 | 18 | iota all in one security kit (38) | new | |||
| 6 | unisoc shanghai technologies co | 38 | sc9863a sc9832e sc7731e t610 t310 t606 t760 t610 t618 t606 t612 t616 t760 t770 t820 s8000 (38) | new | ||||
| 7 | juniper networks | 36 | junos os (29) · junos os evolved (16) · paragon active assurance formerly netrounds (1) | · | ||||
| 8 | jenkins project | 35 | jenkins compuware topaz for total test plugin (4) · jenkins katalon plugin (4) · jenkins script security plugin (3) | — | ||||
| 9 | huawei | 34 | 9 | harmonyos (34) · emui (30) | — | |||
| 10 | linux | 34 | 1 | kernel (33) · linux kernel (1) | ↑16 | |||
| 11 | adobe | 33 | 6 | 1 | coldfusion (13) · dimension (9) · acrobat reader (6) | ↓9 | ||
| 12 | dell | 33 | cpg bios (12) · geodrive (6) · powerscale onefs (4) | ↑1 | ||||
| 13 | samsung mobile | 33 | samsung mobile devices (12) · smartthings (8) · samsung account (3) | ↓6 | ||||
| 14 | gitlab | 30 | 2 | 2 | gitlab (30) | · | ||
| 15 | siemens | 24 | 4 | desigo pxm30 1 (7) · desigo pxm30 e (7) · desigo pxm40 1 (7) | ↓3 | |||
| 16 | qualcomm | 21 | 3 | 1 | snapdragon mobile (4) · snapdragon auto snapdragon compute snapdragon connectivity snapdragon consumer iot snapdragon industrial iot snapdragon mobile snapdragon wearables (3) · snapdragon auto snapdragon compute snapdragon connectivity snapdragon consumer electronics connectivity snapdragon consumer iot snapdragon industrial iot snapdragon iot snapdragon mobile snapdragon voice music snapdragon wearables snapdragon wired infrastructure and networking (2) | ↓11 | ||
| 17 | f5 | 18 | 1 | big ip (7) · big ip advanced waf asm (3) · nginx plus (3) | · | |||
| 18 | delta electronics | 17 | 5 | infrasuite device master (9) · diaenergie (8) | · | |||
| 19 | robustel | 16 | 3 | r1510 (16) | · | |||
| 20 | apache | 15 | 5 | 2 | apache isis (2) · apache xml graphics (2) · apache airflow (1) | ↓9 | ||
| 21 | cisco | 15 | cisco ios xe software (5) · cisco roomos software (5) · cisco identity services engine software (2) | ↓4 | ||||
| 22 | lanner | 13 | 5 | iac ast2500a (13) | new | |||
| 23 | ibm | 12 | robotic process automation (4) · infosphere information server (2) · qradar siem (2) | ↓13 | ||||
| 24 | axiomatic | 11 | bento4 (11) | new | ||||
| 25 | mediatek | 11 | mt6580 mt6739 mt6753 mt6757 mt6761 mt6762 mt6763 mt6765 mt6768 mt6779 mt6781 mt6785 mt6789 mt6833 mt6853 mt6853t mt6855 mt6873 mt6875 mt6877 mt6879 mt6885 mt6893 mt6895 mt6983 mt8321 mt8385 mt8666 mt8675 mt8765 mt8766 mt8768 mt8786 mt8788 mt8789 mt8791 mt8797 (1) · mt6580 mt6739 mt6761 mt6765 mt6768 mt6781 mt6785 mt6789 mt6833 mt6853 mt6853t mt6855 mt6873 mt6877 mt6879 mt6883 mt6885 mt6889 mt6893 mt6895 mt6983 mt8321 mt8385 mt8666 mt8675 mt8765 mt8766 mt8768 mt8786 mt8788 mt8789 mt8791 mt8797 (1) · mt6739 mt6761 mt6762 mt6763 mt6765 mt6768 mt6769 mt6771 mt6779 mt6781 mt6785 mt6789 mt6833 mt6853 mt6853t mt6855 mt6873 mt6875 mt6877 mt6879 mt6883 mt6885 mt6889 mt6891 mt6893 mt6895 mt6983 mt8321 mt8385 mt8666 mt8675 mt8765 mt8766 mt8768 mt8786 mt8788 mt8789 mt8791 mt8797 (1) | ↓11 | ||||
| 26 | php point of sale | 10 | 5 | php point of sale (10) | new | |||
| 27 | ikus060 | 9 | ikus060 rdiffweb (9) | ↓12 | ||||
| 28 | fortinet | 8 | 4 | 1 | 1 | fortinet fortitester (5) · fortinet fortios (1) · fortinet fortios fortiproxy (1) | ↓5 | |
| 29 | synology | 8 | 3 | diskstation manager dsm (6) · presto file server (2) | · | |||
| 30 | e excellence | 7 | u office force (7) | new | ||||
| 31 | octopus deploy | 7 | 1 | octopus server (7) | ↑31 | |||
| 32 | cloudflare | 6 | warp (5) · octorpki (1) | · | ||||
| 33 | esri | 6 | arcgis server (6) | · | ||||
| 34 | forma | 6 | 2 | forma lms (6) | new | |||
| 35 | libtiff | 6 | libtiff (6) | · | ||||
| 36 | solarwinds | 6 | 1 | solarwinds platform (4) · orion platform (3) · network configuration manager (1) | · | |||
| 37 | trend micro | 6 | trend micro apex one (6) | ↓19 | ||||
| 38 | aethon | 5 | tug home base server (5) | new | ||||
| 39 | 5 | 2 | bazel (1) · dart (1) · drive for desktop macos (1) | ↓33 | ||||
| 40 | metabase | 5 | metabase (5) | · | ||||
| 41 | seccome | 5 | ehoney (5) | new | ||||
| 42 | zoom video communications | 5 | zoom on premise meeting connector mmr (3) · zoom client for meetings for android ios linux macos and windows (1) · zoom client for meetings for macos (1) | · | ||||
| 43 | changing information technology | 4 | 1 | rava certificate validation system (4) | new | |||
| 44 | 4 | hermes (4) | · | |||||
| 45 | gocd | 4 | 1 | gocd (4) | · | |||
| 46 | grafana | 4 | grafana (4) | ↑13 | ||||
| 47 | m files | 4 | hubshare (4) | · | ||||
| 48 | openharmony | 4 | openharmony (4) | ↓10 | ||||
| 49 | thorsten | 4 | 1 | thorsten phpmyfaq (4) | new | |||
| 50 | zgr | 4 | 3 | zgr tps200 ng (4) | new |
One CVE is counted once per vendor, product or weakness class it lists, so a ranking column sums to more than the month's total. Only the month's top 100 keys per dimension are stored. The KEV column counts CVEs published in 2022-10 that are on the CISA KEV catalog today. The 12 in the headline is what CISA listed during the month, whenever those CVEs were published. All 50 ranked vendors are listed; a zero count renders as a dot.
Weaknesses
CWE classes by distinct CVEs
- 1CWE-791688 critical—
- 2CWE-78715028 critical—
- 3CWE-119762 critical↑17
- 4CWE-897432 critical↓1
- 5CWE-125544 critical↓1
- 6CWE-284543 critical↑5
- 7CWE-4344825 critical↑11
- 8CWE-20433 critical↓2
- 9CWE-707410 critical↑83
- 10CWE-783722 critical↑16
- 1CWE-862360 critical↑3
- 2CWE-352351 critical↓7
- 3CWE-22345 critical—
- 4CWE-200302 critical↓6
- 5CWE-2872912 critical↓6
- 6CWE-400270 critical↓1
- 7CWE-502278 critical↑7
- 8CWE-416263 critical↓11
- 9CWE-1212110 critical↓2
- 10CWE-404210 critical↑50
One CVE is counted once per vendor, product or weakness class it lists, so a ranking column sums to more than the month's total. Only the month's top 100 keys per dimension are stored.