Month report
March 2023
Rolled up 2026-08-09 20:45 from 370,662 CVE records
2,488 CVEs published, +20.5% on the same month last year. 227 rated critical, 18 listed by CISA as exploited. adobe led with 106; the most common weakness class was CWE-79 (328). pimcore climbed 65 places, the largest move. 7 vendors ranked for the first time.
Published
2,488
Critical / high
227 / 801
Medium / low
1,018 / 144
Added to CISA KEV
18
Public exploit
95
Scanner template
0
Publication to KEV
How long before CISA listed them
Median days to listing
30
Listed within 7 days
40%
Listed within 30 days
53.3%
Detection gap
Listed as exploited, no public template
Listed this month
18
With a template
4
No template
14
Measured against the nuclei-templates CVE index only. No template there does not mean a CVE is undetectable by any other tool.
Vendors
Ranked by distinct CVEs this month
| # | Vendor | Top products | ||||||
|---|---|---|---|---|---|---|---|---|
| 1 | adobe | 106 | 1 | 2 | 1 | dimension (58) · experience manager (16) · substance3d stager (16) | ↑11 | |
| 2 | sourcecodester | 105 | automatic question paper generator system (7) · student study center desk management system (7) · young entrepreneur e negosyo system (7) | ↑1 | ||||
| 3 | microsoft | 74 | 4 | 2 | 7 | windows 11 version 22h2 (52) · windows server 2022 (52) · windows 10 version 21h2 (50) | ↓2 | |
| 4 | 34 | 1 | chrome (31) · android (2) · youtube android player api sdk (1) | ↑10 | ||||
| 5 | ibm | 31 | 2 | 1 | security key lifecycle manager (7) · aspera faspex (4) · financial transaction manager (4) | ↑3 | ||
| 6 | bentley | 29 | microstation connect (23) · view (5) · microstation (1) | · | ||||
| 7 | mediatek | 29 | mt6580 mt6735 mt6739 mt6761 mt6763 mt6765 mt6768 mt6771 mt6779 mt6781 mt6785 mt6789 mt6833 mt6853 mt6855 mt6873 mt6885 mt6893 mt6895 mt6983 mt8167 mt8168 mt8666 mt8675 (3) · mt6879 mt6895 mt6983 mt8321 mt8765 mt8766 mt8768 mt8781 mt8786 mt8788 mt8789 mt8791t mt8797 (3) · mt6879 mt6895 mt6983 mt8791 mt8791t mt8797 (2) | ↑4 | ||||
| 8 | cisco | 28 | 2 | cisco ios xe software (8) · cisco aironet access point software (3) · cisco digital network architecture center dna center (2) | ↑9 | |||
| 9 | pdf xchange | 27 | pdf xchange editor (27) | · | ||||
| 10 | jenkins project | 26 | 4 | jenkins (7) · jenkins octoperf load testing plugin plugin (5) · jenkins convert to pipeline plugin (2) | ↑20 | |||
| 11 | qualcomm | 25 | 2 | snapdragon (25) · wcd9370 firmware (12) · wsa8810 firmware (12) | ↑2 | |||
| 12 | dell | 24 | poweredge platform (18) · dell networker nve (2) · cpg bios (1) | ↓10 | ||||
| 13 | foxit | 24 | pdf reader (21) · pdf editor (3) | · | ||||
| 14 | unisoc shanghai technologies co | 24 | sc9863a sc9832e sc7731e t610 t310 t606 t760 t610 t618 t606 t612 t616 t760 t770 t820 s8000 (24) | ↓9 | ||||
| 15 | d link | 23 | dir 1935 (15) · dir 825 (6) · dir 2150 (1) | · | ||||
| 16 | sap | 21 | 5 | businessobjects business intelligence platform web services (3) · netweaver as for abap and abap platform (3) · netweaver application server for abap and abap platform (2) | — | |||
| 17 | tensorflow | 21 | 1 | tensorflow (21) | · | |||
| 18 | huawei | 20 | 3 | emui (20) · harmonyos (20) | ↑1 | |||
| 19 | answerdev | 18 | 1 | answerdev answer (18) | ↑14 | |||
| 20 | pimcore | 17 | pimcore pimcore (13) · pimcore (4) | ↑65 | ||||
| 21 | apache | 16 | 2 | 2 | apache fineract (3) · apache http server (2) · apache openoffice (2) | ↓1 | ||
| 22 | fortinet | 16 | 1 | 4 | fortios (4) · fortianalyzer (3) · fortiproxy (3) | ↓15 | ||
| 23 | siemens | 16 | 1 | tecnomatix plant simulation (9) · ruggedcom crossbow (4) · linux kernel (1) | ↓17 | |||
| 24 | gitlab | 15 | gitlab (12) · dast (2) · gitlab dast api scanner (1) | ↑20 | ||||
| 25 | samsung mobile | 15 | 1 | samsung mobile devices (11) · bixby touch (1) · myfiles (1) | ↓15 | |||
| 26 | shakee93 | 15 | 1 | rapidload ai optimize web vitals automatically (15) | new | |||
| 27 | xwiki | 15 | 7 | xwiki platform (14) · xwiki commons (1) | · | |||
| 28 | delta electronics | 14 | 4 | 1 | infrasuite device master (13) · dx 2100 l1 cn (1) | ↑26 | ||
| 29 | ivanti | 13 | 9 | avalanche (13) | · | |||
| 30 | nextcloud | 13 | 1 | 1 | security advisories (13) | ↓8 | ||
| 31 | akuvox | 12 | 4 | e11 (12) | new | |||
| 32 | hewlett packard enterprise hpe | 11 | 1 | aruba clearpass policy manager (8) · aruba cx 10000 switch series aruba cx 9300 switch series aruba cx 8400 switch series aruba cx 8360 switch series aruba cx 8325 switch series aruba cx 8320 switch series aruba cx 6400 switch series aruba cx 6300 switch series aruba cx 6200f switch series (1) · hpe flexfabric 5700 switch series (1) | ↓23 | |||
| 33 | netgear | 11 | 1 | 1 | r6700v3 (7) · orbi router rbr750 (3) · orbi satellite rbs750 (1) | ↑30 | ||
| 34 | opensips | 11 | opensips (11) | new | ||||
| 35 | corel | 9 | coreldraw graphics suite (9) | · | ||||
| 36 | discourse | 9 | discourse (8) · discourse yearly review (1) | ↑62 | ||||
| 37 | iobit | 9 | malware fighter (9) | new | ||||
| 38 | propump and controls | 9 | 4 | osprey pump controller (9) | new | |||
| 39 | rocket software | 9 | 5 | 2 | unidata (9) · universe (9) | new | ||
| 40 | jetbrains | 8 | 1 | intellij idea (4) · teamcity (3) · hub (1) | ↑37 | |||
| 41 | schneider electric | 8 | custom reports rms16 dll (8) · igss dashboard dashboard exe (8) · igss data server igssdataserver exe (8) | ↓15 | ||||
| 42 | tp link | 8 | tl wr940n (5) · ac1750 (2) · tl wr841n (1) | · | ||||
| 43 | trend micro | 8 | 1 | trend micro apex one (6) · trend micro endpoint encryption full disk encryption (1) · txone networks stellarone (1) | · | |||
| 44 | aveva | 7 | 1 | edge (6) · aveva plant scada (1) · aveva telemetry server (1) | · | |||
| 45 | flatpressblog | 7 | flatpressblog flatpress (7) | new | ||||
| 46 | hashicorp | 7 | vault (4) · vault enterprise (4) · nomad (2) | ↑28 | ||||
| 47 | hgiga | 7 | 2 | mailsherlock (4) · powerstation (2) · hgiga oaklouds (1) | · | |||
| 48 | netatalk | 7 | 5 | netatalk (7) | · | |||
| 49 | thorsten | 7 | thorsten phpmyfaq (7) | ↓24 | ||||
| 50 | centreon | 6 | centreon (6) | · |
One CVE is counted once per vendor, product or weakness class it lists, so a ranking column sums to more than the month's total. Only the month's top 100 keys per dimension are stored. The KEV column counts CVEs published in 2023-03 that are on the CISA KEV catalog today. The 18 in the headline is what CISA listed during the month, whenever those CVEs were published. All 50 ranked vendors are listed; a zero count renders as a dot.
Weaknesses
CWE classes by distinct CVEs
- 1CWE-793286 critical—
- 2CWE-8917344 critical—
- 3CWE-1251393 critical↑4
- 4CWE-7879715 critical↓1
- 5CWE-20785 critical↑1
- 6CWE-200703 critical↑2
- 7CWE-416701 critical↑6
- 8CWE-352671 critical↓4
- 9CWE-862513 critical—
- 10CWE-22446 critical↑1
- 1CWE-119420 critical↑22
- 2CWE-284404 critical↓2
- 3CWE-434408 critical↑9
- 4CWE-78408 critical—
- 5CWE-476380 critical↑10
- 6CWE-120359 critical↑7
- 7CWE-122344 critical↓1
- 8CWE-77329 critical↓13
- 9CWE-400311 critical↓7
- 10CWE-121306 critical↓5
One CVE is counted once per vendor, product or weakness class it lists, so a ranking column sums to more than the month's total. Only the month's top 100 keys per dimension are stored.