Month report
December 2022
Rolled up 2026-08-09 20:45 from 370,662 CVE records
2,356 CVEs published, +19.1% on the same month last year. 294 rated critical, 9 listed by CISA as exploited. mozilla led with 175; the most common weakness class was CWE-79 (288). github climbed 53 places, the largest move. 10 vendors ranked for the first time.
Published
2,356
+16.6%on the previous month
Critical / high
294 / 802
of the 2,329 scored
Medium / low
1,034 / 199
the rest of the scored bands
Added to CISA KEV
9
listed as exploited this month
Public exploit
62
exploit code indexed publicly
Scanner template
0
0% of the month
Publication to KEV
How long before CISA listed them
7 published this month and listed since — not the 9 listed during it.
Median days to listing
0
from publication to CISA's date added
Listed within 7 days
85.7%
of the 7
Listed within 30 days
85.7%
of the 7
Detection gap
Listed as exploited, no public template
CVEs CISA listed this month
Listed this month
9
added to the CISA KEV catalog
With a template
1
11.1% covered
No template
8
nothing in the public index
Measured against the nuclei-templates CVE index only. No template there does not mean a CVE is undetectable by any other tool.
Vendors
Ranked by distinct CVEs this month
Δ is the move against last month's rank.
| # | Vendor | Top products | ||||||
|---|---|---|---|---|---|---|---|---|
| 1 | mozilla | 175 | 18 | 2 | 3 | firefox (154) · thunderbird (116) · firefox esr (103) | · | |
| 2 | microsoft | 51 | 1 | 1 | windows 10 version 1809 (26) · windows 10 version 21h1 (26) · windows 10 version 21h2 (26) | ↑1 | ||
| 3 | apple | 49 | 2 | 1 | 2 | tvos (26) · watchos (23) · macos (21) | ↓2 | |
| 4 | unisoc shanghai technologies co | 49 | sc9863a sc9832e sc7731e t610 t310 t606 t760 t610 t618 t606 t612 t616 t760 t770 t820 s8000 (26) · sc9863a sc9832e sc7731e t610 t310 t606 t760 t610 t618 t606 t612 t616 t760 t770 t820 s8001 (1) · sc9863a sc9832e sc7731e t610 t310 t606 t760 t610 t618 t606 t612 t616 t760 t770 t820 s8002 (1) | · | ||||
| 5 | usememos | 47 | 4 | usememos memos (47) | new | |||
| 6 | siemens | 42 | 2 | jt2go (12) · teamcenter visualization v13 2 (12) · teamcenter visualization v13 3 (12) | ↑1 | |||
| 7 | ibm | 40 | aix (9) · security verify governance identity manager (6) · cognos analytics (4) | ↓2 | ||||
| 8 | adobe | 39 | experience manager (34) · illustrator (4) · adobe campaign classic acc (1) | · | ||||
| 9 | nvidia | 32 | 1 | vgpu software guest driver linux vgpu software virtual gpu manager nvidia cloud gaming guest driver nvidia cloud gaming virtual gpu manager (16) · vgpu software guest driver windows nvidia cloud gaming guest driver (5) · vgpu software virtual gpu manager nvidia cloud gaming virtual gpu manager (3) | ↑11 | |||
| 10 | huawei | 29 | 8 | harmonyos (24) · emui (18) · aslan al10 (3) | ↑1 | |||
| 11 | openimageio project | 24 | 5 | openimageio (24) | new | |||
| 12 | samsung mobile | 22 | samsung mobile devices (18) · samsung pass (2) · samsung calendar (1) | ↑6 | ||||
| 13 | qualcomm | 20 | 1 | snapdragon mobile (4) · snapdragon auto snapdragon compute snapdragon consumer iot snapdragon industrial iot snapdragon mobile snapdragon wearables (2) · snapdragon auto snapdragon compute snapdragon industrial iot snapdragon mobile snapdragon wearables (2) | ↑3 | |||
| 14 | apache | 18 | 6 | 1 | apache traffic server (3) · apache cxf (2) · apache kylin (2) | ↓8 | ||
| 15 | mediatek | 18 | mt6762 mt6765 mt6768 mt6769 mt6779 mt6781 mt6785 mt6789 mt6833 mt6853 mt6853t mt6855 mt6873 mt6875 mt6877 mt6879 mt6883 mt6885 mt6889 mt6891 mt6893 mt6895 mt8385 mt8765 mt8766 mt8768 mt8781 mt8786 mt8788 mt8789 mt8791 mt8797 (4) · mt6833 mt6853 mt6855 mt6873 mt6877 mt6893 mt8791 (2) · mt6580 mt6731 mt6735 mt6737 mt6739 mt6753 mt6757 mt6757c mt6757cd mt6757ch mt6761 mt6762 mt6763 mt6765 mt6768 mt6769 mt6771 mt6779 mt6781 mt6785 mt6789 mt6833 mt6853 mt6853t mt6855 mt6873 mt6875 mt6877 mt6879 mt6883 mt6885 mt6889 mt6891 mt6893 mt6895 mt6983 mt8185 mt8321 mt8385 mt8666 mt8667 mt8765 mt8766 mt8768 mt8781 mt8786 mt8788 mt8789 mt8791 mt8791t mt8797 (1) | ↓2 | ||||
| 16 | hcl software | 14 | 6 | domino (3) · notes (3) · bigfix insights for vulnerability remediation (2) | ↑21 | |||
| 17 | prasunsen | 13 | chained quiz (13) | new | ||||
| 18 | sap | 13 | 3 | 1 | netweaver process integration (2) · basis (1) · business objects business intelligence platform web intelligence (1) | · | ||
| 19 | esri | 11 | arcgis enterprise (8) · arcgis quickcapture (1) · arcgis server (1) | · | ||||
| 20 | sourcecodester | 11 | canteen management system (3) · human resource management system (3) · blood bank management system (2) | ↑4 | ||||
| 21 | jetbrains | 10 | intellij idea (7) · teamcity (2) · jetbrains gateway (1) | ↑25 | ||||
| 22 | neutrinolabs | 10 | 5 | xrdp (10) | · | |||
| 23 | ikus060 | 9 | ikus060 rdiffweb (9) | · | ||||
| 24 | openemr | 8 | openemr openemr (8) | · | ||||
| 25 | openmrs | 8 | admin ui module (3) · appointment scheduling module (2) · openmrs module referenceapplication (2) | new | ||||
| 26 | bigbluebutton | 7 | bigbluebutton (7) | · | ||||
| 27 | cisco | 7 | cisco analog telephone adaptor ata software (6) · cisco session initiation protocol sip software (1) | ↓23 | ||||
| 28 | click studios | 7 | 1 | passwordstate (7) · passwordstate browser extension chrome (7) | new | |||
| 29 | dataprobe | 7 | 2 | iboot pdu fw (7) | new | |||
| 30 | 7 | 1 | 1 | chrome (6) · android google search app (1) | ↓28 | |||
| 31 | jenkins project | 7 | 1 | jenkins checkmarx plugin (1) · jenkins custom build properties plugin (1) · jenkins gitea plugin (1) | ↓23 | |||
| 32 | buffalo | 6 | buffalo network devices (3) · wsr 2533dhp2 (3) · wsr 2533dhp3 (3) | · | ||||
| 33 | fortinet | 6 | fortiadc (2) · fortios (2) · fortiproxy (2) | ↓19 | ||||
| 34 | lansweeper | 6 | 6 | lansweeper (6) | · | |||
| 35 | shoplazza | 6 | lifestyle (6) | new | ||||
| 36 | sophos | 6 | sophos firewall (6) | · | ||||
| 37 | typo3 | 6 | typo3 (5) · html sanitizer (1) | · | ||||
| 38 | ctrlo | 5 | lenio (5) | new | ||||
| 39 | ge | 5 | cimplicity (5) | · | ||||
| 40 | rockwell automation | 5 | micrologix 1400 a (2) · micrologix 1400 b c (2) · compact guardlogix (1) | · | ||||
| 41 | tibco software | 5 | 3 | tibco jasperreports server (3) · tibco jasperreports server developer edition (3) · tibco jasperreports server for aws marketplace (3) | · | |||
| 42 | vim | 5 | vim vim (5) | · | ||||
| 43 | altair | 4 | hyperview player (4) | new | ||||
| 44 | auth0 | 4 | node jsonwebtoken (3) · passport wsfed saml2 (1) | · | ||||
| 45 | github | 4 | 1 | github enterprise server (4) | ↑53 | |||
| 46 | m files | 4 | m files web (2) · m files client (1) · m files server (1) | · | ||||
| 47 | nextcloud | 4 | security advisories (4) | ↓17 | ||||
| 48 | omron | 4 | cx programmer (3) · cx drive (1) | · | ||||
| 49 | opencaching deutschland | 4 | oc server3 (4) | new | ||||
| 50 | openharmony | 4 | openharmony (4) | ↑23 |
One CVE is counted once per vendor, product or weakness class it lists, so a ranking column sums to more than the month's total. Only the month's top 100 keys per dimension are stored. The KEV column counts CVEs published in 2022-12 that are on the CISA KEV catalog today. The 9 in the headline is what CISA listed during the month, whenever those CVEs were published. All 50 ranked vendors are listed; a zero count renders as a dot.
Weaknesses
CWE classes by distinct CVEs
- 1CWE-792886 critical—
- 2CWE-78722959 critical—
- 3CWE-707950 critical↑5
- 4CWE-125937 critical↑7
- 5CWE-1208020 critical↑11
- 6CWE-896520 critical↓3
- 7CWE-226210 critical↓1
- 8CWE-284533 critical↑2
- 9CWE-785226 critical↑4
- 10CWE-416515 critical↑2
- 1CWE-20483 critical↓6
- 2CWE-200443 critical↓5
- 3CWE-862423 critical↑4
- 4CWE-287408 critical—
- 5CWE-352390 critical↓11
- 6CWE-476330 critical↑10
- 7CWE-400291 critical↑4
- 8CWE-863293 critical↑12
- 9CWE-434278 critical↓10
- 10CWE-269263 critical↑4
One CVE is counted once per vendor, product or weakness class it lists, so a ranking column sums to more than the month's total. Only the month's top 100 keys per dimension are stored.