Month report
April 2023
Rolled up 2026-08-09 20:45 from 370,700 CVE records
2,302 CVEs published, +12.9% on the same month last year. 272 rated critical, 17 listed by CISA as exploited. microsoft led with 104; the most common weakness class was CWE-79 (398). schneider electric climbed 28 places, the largest move. 10 vendors ranked for the first time.
Published
2,302
-7.5%on the previous month
Critical / high
272 / 705
of the 2,238 scored
Medium / low
1,131 / 130
the rest of the scored bands
Added to CISA KEV
17
listed as exploited this month
Public exploit
123
exploit code indexed publicly
Scanner template
0
0% of the month
Publication to KEV
How long before CISA listed them
17 published this month and listed since — not the 17 listed during it.
Median days to listing
36
from publication to CISA's date added
Listed within 7 days
47.1%
of the 17
Listed within 30 days
47.1%
of the 17
Detection gap
Listed as exploited, no public template
CVEs CISA listed this month
Listed this month
17
added to the CISA KEV catalog
With a template
4
23.5% covered
No template
13
nothing in the public index
- 1apple3of 3 listed
- 2google2of 2 listed
- 3microsoft2of 2 listed
- 4cisco1of 1 listed
- 5intellishield1of 1 listed
- 6novisurvey1of 1 listed
Measured against the nuclei-templates CVE index only. No template there does not mean a CVE is undetectable by any other tool.
Vendors
Ranked by distinct CVEs this month
Δ is the move against last month's rank.
| # | Vendor | Top products | ||||||
|---|---|---|---|---|---|---|---|---|
| 1 | microsoft | 104 | 3 | 2 | 10 | windows server 2022 (73) · windows server 2019 (70) · windows server 2019 server core installation (70) | ↑2 | |
| 2 | sourcecodester | 98 | 2 | online computer and laptop store (19) · online payroll system (9) · vehicle service management system (9) | — | |||
| 3 | oracle | 91 | 4 | mysql server (23) · vm virtualbox (10) · java se jdk and jre (7) | · | |||
| 4 | adobe | 56 | acrobat reader (16) · dimension (15) · substance3d stager (14) | ↓3 | ||||
| 5 | cisco | 40 | 1 | 1 | cisco small business rv series router firmware (20) · cisco identity services engine software (8) · cisco prime infrastructure (5) | ↑3 | ||
| 6 | nvidia | 38 | nvidia dgx servers (11) · nvidia cuda toolkit (5) · vgpu software guest driver windows nvidia cloud gaming guest driver windows (5) | · | ||||
| 7 | xwiki | 38 | 27 | 2 | xwiki platform (36) · xwiki commons (2) | ↑20 | ||
| 8 | campcodes | 37 | 1 | advanced online voting system (9) · coffee shop pos system (8) · online thesis archiving system (6) | new | |||
| 9 | qualcomm | 33 | 8 | snapdragon (33) · 9205 lte modem firmware (9) · qca4004 firmware (9) | ↑2 | |||
| 10 | mediatek | 30 | mt5221 mt6781 mt6789 mt6833 mt6855 mt6877 mt6879 mt6895 mt6983 mt7663 mt7668 mt7902 mt7921 mt8167s mt8168 mt8169 mt8175 mt8185 mt8362a mt8365 mt8385 mt8518 mt8532 mt8675 mt8695 mt8766 mt8768 mt8771 mt8781 mt8786 mt8788 mt8789 mt8791t mt8797 mt8798 (5) · mt5221 mt6879 mt6895 mt6983 mt7902 mt7921 mt8167s mt8168 mt8175 mt8362a mt8365 mt8385 mt8518 mt8532 mt8696 mt8766 mt8768 mt8771 mt8781 mt8786 mt8788 mt8789 mt8791t mt8795t mt8797 mt8798 (4) · mt6580 mt6731 mt6735 mt6737 mt6739 mt6753 mt6757 mt6757c mt6757cd mt6757ch mt6761 mt6762 mt6763 mt6765 mt6768 mt6769 mt6771 mt6779 mt6781 mt6785 mt6789 mt6833 mt6853 mt6853t mt6855 mt6873 mt6875 mt6877 mt6879 mt6883 mt6885 mt6889 mt6891 mt6893 mt6895 mt6983 mt8185 mt8192 mt8321 mt8385 mt8666 mt8667 mt8673 mt8675 mt8765 mt8766 mt8768 mt8771 mt8781 mt8786 mt8788 mt8789 mt8791 mt8791t mt8795t mt8797 mt8798 mt8871 mt8891 (3) | ↓3 | ||||
| 11 | ibm | 26 | 1 | db2 for linux unix and windows (7) · safer payments (3) · aix (2) | ↓6 | |||
| 12 | juniper networks | 25 | junos os (19) · junos os evolved (10) · appid service sigpack (1) | · | ||||
| 13 | schneider electric | 24 | 3 | struxureware data center expert (9) · apc easy ups online monitoring software windows 10 11 windows server 2016 2019 2022 (3) · netbotz 4 355 450 455 550 570 (3) | ↑28 | |||
| 14 | apache | 21 | 8 | 1 | 2 | apache linkis (5) · linkis (5) · apache superset (4) | ↑7 | |
| 15 | 21 | 1 | 2 | 1 | chrome (20) · android (1) · mt5221 (1) | ↓11 | ||
| 16 | fortinet | 20 | 1 | fortios (4) · fortiadc (3) · forticlientwindows (3) | ↑6 | |||
| 17 | jenkins project | 20 | jenkins report portal plugin (4) · jenkins consul kv builder plugin (2) · jenkins quay io trigger plugin (2) | ↓7 | ||||
| 18 | sap | 18 | 3 | application interface framework message dashboard (2) · abap platform and sap web dispatcher (1) · application interface framework message monitoring (1) | ↓2 | |||
| 19 | netgear | 17 | srx5308 (17) | ↑14 | ||||
| 20 | pimcore | 17 | pimcore pimcore (12) · pimcore (4) · perspective editor (1) | — | ||||
| 21 | odoo | 15 | odoo enterprise (15) · odoo community (14) | · | ||||
| 22 | thorsten | 15 | thorsten phpmyfaq (15) | ↑27 | ||||
| 23 | emrevona | 14 | wp fastest cache wordpress cache plugin (14) | new | ||||
| 24 | gitlab | 14 | gitlab (14) | — | ||||
| 25 | hitachi vantara | 14 | 2 | 2 | pentaho business analytics server (14) | · | ||
| 26 | siemens | 12 | 1 | simatic cp 1242 7 v2 (3) · simatic cp 1243 1 (3) · simatic cp 1243 1 dnp3 incl siplus variants (3) | ↓3 | |||
| 27 | unisoc shanghai technologies co | 11 | sc9863a sc9832e sc7731e t610 t310 t606 t760 t610 t618 t606 t612 t616 t760 t770 t820 s8000 (11) | ↓13 | ||||
| 28 | zyxel | 11 | 2 | 1 | 3 | usg flex series firmware (9) · vpn series firmware (9) · atp series firmware (6) | · | |
| 29 | dell | 9 | powerscale onefs (3) · dell display manager (2) · dell power manager dpm (1) | ↓17 | ||||
| 30 | nextcloud | 9 | security advisories (9) | — | ||||
| 31 | apple | 8 | 1 | 2 | 2 | macos (6) · ios and ipados (3) · ios (1) | · | |
| 32 | hhyo | 8 | archery (8) | new | ||||
| 33 | drupal | 7 | core (7) | · | ||||
| 34 | glpi project | 7 | 2 | glpi (7) | · | |||
| 35 | hewlett packard enterprise hpe | 7 | hpe oneview (6) · hpe oneview global dashboard (1) | ↓3 | ||||
| 36 | pluginbuilders | 7 | yourchannel everything you want in a youtube plugin (7) | new | ||||
| 37 | ubiquiti | 7 | 1 | edgerouter x (7) | new | |||
| 38 | wclovers | 7 | 1 | 1 | wcfm membership woocommerce memberships for multivendor marketplace (3) · wcfm marketplace multivendor marketplace for woocommerce (2) · wcfm frontend manager for woocommerce (1) | new | ||
| 39 | bestwebsoft | 6 | contact form plugin (2) · facebook like button (2) · car rental by bestwebsoft (1) | · | ||||
| 40 | envoyproxy | 6 | envoy (6) | · | ||||
| 41 | fullworks | 6 | quick paypal payments (3) · quick contact form (2) · quick event manager (1) | new | ||||
| 42 | kiboko labs | 6 | arigato autoresponder and newsletter (3) · chained quiz (1) · namaste lms (1) | new | ||||
| 43 | linux | 6 | 3 | linux kernel (6) · kernel (2) · debian linux (1) | · | |||
| 44 | phpgurukul | 6 | bp monitoring management system (4) · bank locker management system (2) | · | ||||
| 45 | ping identity | 6 | pingfederate (1) · pingfederate includes pingid adapter (1) · pingfederate includes radius pcv (1) | · | ||||
| 46 | riot os | 6 | 2 | riot (6) | new | |||
| 47 | tribe29 | 6 | checkmk (3) · checkmk appliance (3) | · | ||||
| 48 | arista networks | 5 | 1 | eos (3) · arista eos (1) · terminattr (1) | · | |||
| 49 | datakit | 5 | crosscad ware x64 library 0 (4) · crosscad ware x64 library (1) | new | ||||
| 50 | devolutions | 5 | remote desktop manager (3) · devolutions server (1) · workspace desktop (1) | ↑1 |
One CVE is counted once per vendor, product or weakness class it lists, so a ranking column sums to more than the month's total. Only the month's top 100 keys per dimension are stored. The KEV column counts CVEs published in 2023-04 that are on the CISA KEV catalog today. The 17 in the headline is what CISA listed during the month, whenever those CVEs were published. All 50 ranked vendors are listed; a zero count renders as a dot.
Weaknesses
CWE classes by distinct CVEs
- 1CWE-793989 critical—
- 2CWE-8917828 critical—
- 3CWE-78714144 critical↑1
- 4CWE-125692 critical↓1
- 5CWE-352540 critical↑3
- 6CWE-20487 critical↓1
- 7CWE-416471 critical—
- 8CWE-22467 critical↑2
- 9CWE-774017 critical↑9
- 10CWE-284373 critical↑2
- 1CWE-4343411 critical↑2
- 2CWE-190323 critical↑13
- 3CWE-400321 critical↑6
- 4CWE-1203011 critical↑2
- 5CWE-269295 critical↑8
- 6CWE-476291 critical↓1
- 7CWE-863291 critical↑4
- 8CWE-742816 critical↑26
- 9CWE-78288 critical↓5
- 10CWE-200272 critical↓14
One CVE is counted once per vendor, product or weakness class it lists, so a ranking column sums to more than the month's total. Only the month's top 100 keys per dimension are stored.