Month report
July 2023
Rolled up 2026-08-09 20:45 from 370,700 CVE records
2,295 CVEs published, +16.1% on the same month last year. 127 rated critical, 16 listed by CISA as exploited. microsoft led with 138; the most common weakness class was CWE-79 (211). fedora climbed 79 places, the largest move. 8 vendors ranked for the first time.
Published
2,295
-4.2%on the previous month
Critical / high
127 / 531
of the 1,561 scored
Medium / low
753 / 150
the rest of the scored bands
Added to CISA KEV
16
listed as exploited this month
Public exploit
111
exploit code indexed publicly
Scanner template
0
0% of the month
Publication to KEV
How long before CISA listed them
15 published this month and listed since — not the 16 listed during it.
Median days to listing
0
from publication to CISA's date added
Listed within 7 days
66.7%
of the 15
Listed within 30 days
73.3%
of the 15
Detection gap
Listed as exploited, no public template
CVEs CISA listed this month
Listed this month
16
added to the CISA KEV catalog
With a template
6
37.5% covered
No template
10
nothing in the public index
Measured against the nuclei-templates CVE index only. No template there does not mean a CVE is undetectable by any other tool.
Vendors
Ranked by distinct CVEs this month
Δ is the move against last month's rank.
| # | Vendor | Top products | ||||||
|---|---|---|---|---|---|---|---|---|
| 1 | microsoft | 138 | 5 | 5 | 4 | windows server 2022 (99) · windows server 2019 (95) · windows server 2019 server core installation (95) | — | |
| 2 | milesight | 69 | 1 | ur32l (63) · milesightvpn (6) · ur32l firmware (5) | · | |||
| 3 | 65 | 1 | 4 | chrome (35) · android (28) · google wifi next gen (1) | ↑16 | |||
| 4 | unisoc shanghai technologies co | 59 | sc9863a sc9832e sc7731e t610 t310 t606 t760 t610 t618 t606 t612 t616 t760 t770 t820 s8000 (52) · sc9863a sc9832e sc7731e t610 t310 t606 t760 t610 t618 t606 t612 t616 t760 t770 t820 s8001 (2) · sc9863a sc9832e sc7731e t610 t310 t606 t760 t610 t618 t606 t612 t616 t760 t770 t820 s8002 (1) | ↑10 | ||||
| 5 | apple | 56 | 2 | 4 | macos (52) · ios and ipados (35) · watchos (27) | ↓2 | ||
| 6 | oracle | 56 | 2 | 1 | mysql server (13) · business intelligence enterprise edition (7) · java se jdk and jre (7) | · | ||
| 7 | redhat | 50 | 2 | 2 | red hat enterprise linux 6 (40) · red hat enterprise linux 7 (40) · red hat enterprise linux 9 (38) | · | ||
| 8 | ibm | 46 | 1 | db2 for linux unix and windows (13) · sterling connect express for unix (4) · i (3) | — | |||
| 9 | samsung mobile | 38 | samsung mobile devices (31) · samsung pass (3) · calendar (1) | ↑71 | ||||
| 10 | huawei | 30 | harmonyos (30) · emui (29) | ↓5 | ||||
| 11 | jenkins project | 30 | jenkins mabl plugin (4) · jenkins benchmark evaluator plugin (2) · jenkins elasticbox ci plugin (2) | ↑17 | ||||
| 12 | apache | 29 | 8 | 4 | apache airflow (5) · apache inlong (3) · pulsar (3) | ↑4 | ||
| 13 | siemens | 26 | 7 | ruggedcom rox mx5000 (14) · ruggedcom rox mx5000re (14) · ruggedcom rox rx1400 (14) | ↑5 | |||
| 14 | mediatek | 24 | 1 | mt6580 mt6731 mt6735 mt6737 mt6739 mt6753 mt6757 mt6757c mt6757cd mt6757ch mt6761 mt6762 mt6763 mt6765 mt6768 mt6769 mt6771 mt6779 mt6781 mt6785 mt6789 mt6833 mt6835 mt6853 mt6853t mt6855 mt6873 mt6875 mt6877 mt6879 mt6883 mt6885 mt6886 mt6889 mt6891 mt6893 mt6895 mt6983 mt6985 mt8185 mt8321 mt8385 mt8666 mt8667 mt8765 mt8766 mt8768 mt8781 mt8786 mt8788 mt8789 mt8791 mt8791t mt8797 (3) · mt6580 mt6735 mt6737 mt6739 mt6753 mt6761 mt6765 mt6768 mt6771 mt6779 mt6781 mt6785 mt6789 mt6833 mt6835 mt6853 mt6853t mt6855 mt6873 mt6877 mt6879 mt6883 mt6885 mt6886 mt6889 mt6893 mt6895 mt6983 mt6985 mt8781 mt8791 mt8791t mt8797 (2) · mt6739 mt6768 mt6771 mt6781 mt6785 mt6833 mt6853 mt6853t mt6873 mt6877 mt6883 mt6885 mt6889 mt6893 mt8786 mt8789 mt8797 (2) | ↓5 | |||
| 15 | campcodes | 23 | 1 | beauty salon management system (21) · retro cellphone online store (2) | ↑75 | |||
| 16 | fedora | 23 | 2 | 1 | fedora (23) · red hat enterprise linux 7 (21) · red hat enterprise linux 6 (20) | ↑79 | ||
| 17 | adobe | 22 | 2 | 3 | indesign (13) · coldfusion (4) · media encoder (4) | ↓2 | ||
| 18 | sourcecodester | 22 | ac repair and services system (6) · lost and found information system (3) · shopping website (3) | ↓7 | ||||
| 19 | tenda | 21 | 1 | f1202 (10) · fh1202 (10) · fh1203 (8) | new | |||
| 20 | qualcomm | 18 | snapdragon (18) · fastconnect 6200 firmware (8) · sa6155p firmware (8) | ↓13 | ||||
| 21 | sap se | 18 | 1 | sap enable now (3) · sap web dispatcher (2) · sap business warehouse and sap bw 4hana (1) | ↑19 | |||
| 22 | gz scripts | 17 | availability booking calendar php (3) · car listing script php (1) · car rental script (1) | new | ||||
| 23 | mozilla | 17 | 1 | firefox (14) · thunderbird (7) · firefox esr (6) | ↓21 | |||
| 24 | sonicwall | 15 | 1 | 4 | analytics (15) · gms (15) | · | ||
| 25 | open babel | 14 | 12 | open babel (14) · open babbel (1) | new | |||
| 26 | hewlett packard enterprise hpe | 13 | 3 | aruba mobility conductor formerly mobility master aruba mobility controllers wlan gateways and sd wan gateways managed by aruba central (9) · arba access points running instantos and arubaos 10 (3) · aruba access points running instantos and arubaos 10 (3) | · | |||
| 27 | jetbrains | 13 | teamcity (10) · intellij idea (2) · youtrack (1) | ↑44 | ||||
| 28 | mattermost | 13 | mattermost (11) · mattermost ios app (1) · mattermost plugins (1) | ↓4 | ||||
| 29 | bug finder | 12 | chaincity real estate investment platform (2) · listplace directory listing platform (2) · ex rate (1) | new | ||||
| 30 | gitlab | 12 | gitlab (12) | ↓13 | ||||
| 31 | juniper networks | 12 | junos os (11) · junos os evolved (4) | · | ||||
| 32 | phpscriptpoint | 12 | bloodbank (2) · car listing (2) · ecommerce (2) | new | ||||
| 33 | citrix | 10 | 3 | 2 | 3 | netscaler adc (3) · netscaler gateway (3) · citrix adc and citrix gateway (2) | · | |
| 34 | dell | 10 | 1 | wyse management suite (3) · wyse proprietary os modern thinos (3) · dell hybrid client dhc (1) | ↓30 | |||
| 35 | discourse | 9 | discourse (9) | ↑32 | ||||
| 36 | elecom co | 9 | wrc 1167ghbk3 a (5) · wrc 1167febk a (4) · wrc 1167gebk s (4) | · | ||||
| 37 | honeywell | 9 | 5 | direct station (5) · engineering station (5) · experion server (5) | · | |||
| 38 | piigab | 9 | 1 | m bus softwarepack (9) · m bus 900s (7) | new | |||
| 39 | totolink | 9 | lr350 (4) · a3000ru (2) · a3300r (2) | · | ||||
| 40 | zabbix | 9 | zabbix (9) | · | ||||
| 41 | glpi project | 8 | 1 | glpi (8) | · | |||
| 42 | hcl software | 8 | hcl bigfix mobile (2) · hcl bigfix webui (2) · hcl bigfix webui api (1) | ↑28 | ||||
| 43 | sick | 8 | icr890 4 (8) | · | ||||
| 44 | solarwinds | 8 | solarwinds platform (6) · dpa (1) · network configuration manager (1) | · | ||||
| 45 | ami | 7 | 1 | megarac spx (5) · megarac spx12 (2) · megarac spx13 (1) | ↓12 | |||
| 46 | becton dickinson | 7 | bd alaris point of care unit pcu model 8015 (3) · bd alaris systems manager (2) · bd alaris guardrails editor (1) | new | ||||
| 47 | esri | 7 | portal for arcgis sites (3) · arcgis enterprise server (2) · arcgis insights (2) | · | ||||
| 48 | fortinet | 7 | 1 | fortios (3) · fortianalyzer (2) · fortimanager (2) | ↓35 | |||
| 49 | gnu | 7 | gnu grub (4) · gdb (3) | · | ||||
| 50 | moosocial | 7 | 7 | moodating (7) | new |
One CVE is counted once per vendor, product or weakness class it lists, so a ranking column sums to more than the month's total. Only the month's top 100 keys per dimension are stored. The KEV column counts CVEs published in 2023-07 that are on the CISA KEV catalog today. The 16 in the headline is what CISA listed during the month, whenever those CVEs were published. All 50 ranked vendors are listed; a zero count renders as a dot.
Weaknesses
CWE classes by distinct CVEs
- 1CWE-792114 critical—
- 2CWE-3521632 critical↑3
- 3CWE-899111 critical↑1
- 4CWE-20596 critical↑2
- 5CWE-121542 critical↑36
- 6CWE-125462 critical↑1
- 7CWE-200400 critical↑3
- 8CWE-416393 critical↑4
- 9CWE-78326 critical↑5
- 10CWE-863322 critical↓2
- 1CWE-400270 critical↑9
- 2CWE-434274 critical↓3
- 3CWE-94266 critical↑3
- 4CWE-22253 critical↓3
- 5CWE-122242 critical↑6
- 6CWE-787225 critical↓13
- 7CWE-502188 critical↑8
- 8CWE-269172 critical↑19
- 9CWE-77177 critical↓4
- 10CWE-862171 critical↓18
One CVE is counted once per vendor, product or weakness class it lists, so a ranking column sums to more than the month's total. Only the month's top 100 keys per dimension are stored.