Month report
January 2023
Rolled up 2026-08-09 20:45 from 370,700 CVE records
2,351 CVEs published, +18.3% on the same month last year. 224 rated critical, 5 listed by CISA as exploited. microsoft led with 102; the most common weakness class was CWE-79 (248). thorsten climbed 50 places, the largest move. 9 vendors ranked for the first time.
Published
2,351
Critical / high
224 / 913
Medium / low
1,023 / 157
Added to CISA KEV
5
Public exploit
95
Scanner template
0
Publication to KEV
How long before CISA listed them
Median days to listing
17
Listed within 7 days
37.5%
Listed within 30 days
62.5%
Weakness × vendor
Where the two overlap
| Vendor | CWE-79 | CWE-89 | CWE-121 | CWE-120 | CWE-787 | CWE-125 | CWE-22 | CWE-78 |
|---|---|---|---|---|---|---|---|---|
| microsoft | 1 | 6 | ||||||
| insteon | 81 | 1 | ||||||
| oracle | ||||||||
| pdf xchange | 23 | 34 | ||||||
| siretta | 48 | 5 | 9 | |||||
| unisoc shanghai technologies co | 1 | 1 | 1 | 3 | ||||
| jenkins project | 2 | 1 | ||||||
| adobe | 2 | 9 | 8 |
Detection gap
Listed as exploited, no public template
Listed this month
5
With a template
2
No template
3
- 1microsoft2of 2 listed
Measured against the nuclei-templates CVE index only. No template there does not mean a CVE is undetectable by any other tool.
Vendors
Ranked by distinct CVEs this month
| # | Vendor | Top products | ||||||
|---|---|---|---|---|---|---|---|---|
| 1 | microsoft | 102 | 1 | 10 | windows 11 version 21h2 (64) · windows 11 version 22h2 (64) · windows 10 version 20h2 (63) | ↑1 | ||
| 2 | insteon | 82 | hub (82) | · | ||||
| 3 | oracle | 74 | 1 | 1 | 2 | mysql server (24) · vm virtualbox (6) · weblogic server (5) | · | |
| 4 | pdf xchange | 65 | pdf xchange editor (65) | new | ||||
| 5 | siretta | 64 | 7 | quartz gold (64) · quartz gold firmware (7) · freshtomato (2) | new | |||
| 6 | unisoc shanghai technologies co | 39 | sc9863a sc9832e sc7731e t610 t310 t606 t760 t610 t618 t606 t612 t616 t760 t770 t820 s8000 (39) | ↓2 | ||||
| 7 | jenkins project | 38 | 7 | 1 | jenkins jira pipeline steps plugin (4) · jenkins github pull request builder plugin (3) · jenkins openid plugin (3) | ↑24 | ||
| 8 | adobe | 31 | 1 | 1 | acrobat reader (17) · incopy (6) · indesign (6) | — | ||
| 9 | qualcomm | 30 | 2 | snapdragon (30) | ↑4 | |||
| 10 | amd | 28 | 3rd gen epyc (24) · 2nd gen epyc (17) · 1st gen epyc (5) | · | ||||
| 11 | 28 | 1 | chrome (28) | ↑19 | ||||
| 12 | schneider electric | 28 | 10 | igss data server igssdataserver exe (8) · data center expert (4) · conext combox (3) | · | |||
| 13 | ibm | 27 | sterling b2b integrator standard edition (6) · robotic process automation (3) · robotic process automation for cloud pak (3) | ↓6 | ||||
| 14 | sourcecodester | 27 | online tours travels management system (13) · online food ordering system (7) · online flight booking management system (3) | ↑6 | ||||
| 15 | hewlett packard enterprise hpe | 26 | aruba edgeconnect enterprise orchestration software (13) · aruba clearpass policy manager (11) · hpe officeconnect 1820 and 1850 switch series (1) | · | ||||
| 16 | juniper networks | 26 | junos os (23) · junos os evolved (8) | · | ||||
| 17 | apache | 25 | 6 | 2 | apache superset (7) · apache http server (3) · apache iotdb workbench (2) | ↓3 | ||
| 18 | gitlab | 24 | 1 | gitlab (23) · gitlab runner (1) | · | |||
| 19 | mediatek | 23 | 1 | mt6580 mt6731 mt6735 mt6737 mt6739 mt6753 mt6757 mt6757c mt6757cd mt6757ch mt6761 mt6762 mt6763 mt6765 mt6768 mt6769 mt6771 mt6779 mt6781 mt6785 mt6789 mt6833 mt6853 mt6853t mt6855 mt6873 mt6875 mt6877 mt6879 mt6883 mt6885 mt6889 mt6891 mt6893 mt6895 mt6983 mt8167 mt8168 mt8173 mt8185 mt8321 mt8362a mt8365 mt8385 mt8666 mt8675 mt8765 mt8766 mt8768 mt8781 mt8786 mt8788 mt8789 mt8791 mt8791t mt8797 (2) · mt6789 mt6833 mt6853 mt6855 mt6873 mt6875 mt6877 mt6879 mt6883 mt6885 mt6891 mt6893 mt6895 mt6983 mt8781 mt8791 mt8791t mt8797 (2) · mt6879 mt6895 mt6983 (2) | ↓4 | |||
| 20 | cisco | 22 | 1 | 1 | cisco identity services engine software (4) · cisco small business rv series router firmware (4) · cisco broadworks (2) | ↑7 | ||
| 21 | nvidia | 21 | nvidia dgx servers (20) · nvidia isaac sim (1) · omniverse audio2face (1) | ↓12 | ||||
| 22 | lenovo | 17 | bios (9) · thinkpad x13s (4) · lenovo xclarity controller (2) | · | ||||
| 23 | discourse | 16 | discourse (15) · discourse mermaid theme component (1) | · | ||||
| 24 | dell | 14 | bios (3) · cpg bios (2) · secure connect gateway scg policy manager (2) | · | ||||
| 25 | hp | 13 | hp pc bios (5) · hp security manager (4) · hp support assistant (3) | · | ||||
| 26 | siemens | 12 | 2 | jt2go (3) · sinec ins (3) · teamcenter visualization v13 3 (3) | ↓20 | |||
| 27 | wproyal | 11 | royal addons for elementor addons and templates kit for elementor (11) | new | ||||
| 28 | sap | 9 | 5 | bank account management manage banks (1) · businessobjects business intelligence platform analysis edition for olap (1) · businessobjects business intelligence platform central management console (1) | ↓10 | |||
| 29 | sewio | 9 | 4 | rtls studio (9) | new | |||
| 30 | thorsten | 9 | 2 | thorsten phpmyfaq (9) | ↑50 | |||
| 31 | wireshark foundation | 9 | wireshark (9) | · | ||||
| 32 | pyload | 8 | 2 | 1 | pyload pyload (8) | new | ||
| 33 | huawei | 7 | emui (7) · harmonyos (7) | ↓23 | ||||
| 34 | zyxel | 7 | nr7101 firmware (4) · ax7501 b0 firmware (2) · gs1920 24v2 firmware (1) | · | ||||
| 35 | changingtec | 6 | 1 | megaservisignadapter (3) · servisign (3) | new | |||
| 36 | fortinet | 6 | 1 | 1 | 1 | fortiadc (1) · fortimanager (1) · fortios (1) | ↓3 | |
| 37 | froxlor | 6 | 1 | froxlor froxlor (6) | ↑20 | |||
| 38 | github | 6 | 1 | cmark gfm (4) · github enterprise server (2) | ↑7 | |||
| 39 | glpi project | 6 | glpi (6) | · | ||||
| 40 | hitachi energy | 6 | foxman un (5) · unem (5) · lumada apm (1) | · | ||||
| 41 | openmage | 6 | magento lts (6) | · | ||||
| 42 | usememos | 6 | 1 | usememos memos (6) | ↓37 | |||
| 43 | vim | 6 | vim vim (6) | ↓1 | ||||
| 44 | zoom video communications | 6 | zoom rooms for macos (3) · zoom rooms for windows (2) · zoom for android (1) | · | ||||
| 45 | contec co | 5 | conprosys hmi system chs (5) | · | ||||
| 46 | d link | 5 | dir 2150 (4) · multiple routers (1) | · | ||||
| 47 | fuji electric co ltd and hakko electronics co | 5 | v server (3) · v sft and tellus (2) | new | ||||
| 48 | ge digital | 5 | 1 | proficy historian (5) | new | |||
| 49 | inhand networks | 5 | 2 | inrouter 302 (5) · inrouter 615 (5) | · | |||
| 50 | modoboa | 5 | modoboa modoboa (5) | new |
One CVE is counted once per vendor, product or weakness class it lists, so a ranking column sums to more than the month's total. Only the month's top 100 keys per dimension are stored. The KEV column counts CVEs published in 2023-01 that are on the CISA KEV catalog today. The 5 in the headline is what CISA listed during the month, whenever those CVEs were published. All 50 ranked vendors are listed; a zero count renders as a dot.
Weaknesses
CWE classes by distinct CVEs
- 1CWE-792489 critical—
- 2CWE-8922145 critical↑4
- 3CWE-121980 critical↑52
- 4CWE-1209511 critical↑1
- 5CWE-787908 critical↓3
- 6CWE-125770 critical↓2
- 7CWE-22747 critical—
- 8CWE-786621 critical↑1
- 9CWE-284598 critical↓1
- 10CWE-20574 critical↑1
- 1CWE-416470 critical↓1
- 2CWE-200451 critical—
- 3CWE-862403 critical—
- 4CWE-352381 critical↑1
- 5CWE-122362 critical↑10
- 6CWE-77355 critical↑19
- 7CWE-287338 critical↓3
- 8CWE-190306 critical↑6
- 9CWE-269270 critical↑1
- 10CWE-400240 critical↓3
One CVE is counted once per vendor, product or weakness class it lists, so a ranking column sums to more than the month's total. Only the month's top 100 keys per dimension are stored.