Month report
September 2023
Rolled up 2026-08-09 20:45 from 370,745 CVE records
2,148 CVEs published, 0% on the same month last year. 132 rated critical, 19 listed by CISA as exploited. apple led with 112; the most common weakness class was CWE-79 (267). tp link climbed 46 places, the largest move. 10 vendors ranked for the first time.
Published
2,148
Critical / high
132 / 566
Medium / low
659 / 93
Added to CISA KEV
19
Public exploit
138
Scanner template
0
Publication to KEV
How long before CISA listed them
Median days to listing
4
Listed within 7 days
63.6%
Listed within 30 days
77.3%
Detection gap
Listed as exploited, no public template
Listed this month
19
With a template
2
No template
17
Measured against the nuclei-templates CVE index only. No template there does not mean a CVE is undetectable by any other tool.
Vendors
Ranked by distinct CVEs this month
| # | Vendor | Top products | ||||||
|---|---|---|---|---|---|---|---|---|
| 1 | apple | 112 | 3 | 6 | 7 | macos (97) · ios and ipados (60) · watchos (44) | ↑18 | |
| 2 | microsoft | 62 | 1 | 2 | 3 | windows server 2022 (19) · windows 11 version 21h2 (18) · windows server 2019 (18) | — | |
| 3 | adobe | 59 | 3 | 2 | acrobat reader (12) · illustrator (10) · after effects (9) | ↑1 | ||
| 4 | 52 | 4 | 6 | android (33) · chrome (18) · mt6883 (8) | ↓3 | |||
| 5 | redhat | 52 | 1 | 3 | red hat enterprise linux 9 (24) · red hat enterprise linux 8 (23) · red hat enterprise linux 7 (22) | ↑11 | ||
| 6 | mediatek | 45 | android (11) · mt6883 (8) · mt6885 (8) | ↑1 | ||||
| 7 | unisoc shanghai technologies co | 44 | sc7731e sc9832e sc9863a t606 t612 t616 t610 t618 (30) · sc7731e (11) · sc9832e (11) | ↑36 | ||||
| 8 | d link | 40 | 1 | dir 619l (10) · dar 7000 (9) · dar 8000 (8) | ↑31 | |||
| 9 | os commerce | 36 | os commerce (36) | new | ||||
| 10 | sourcecodester | 36 | engineers online portal (9) · best courier management system (6) · contact manager app (5) | ↓1 | ||||
| 11 | qualcomm | 35 | 2 | snapdragon (35) · qca6696 firmware (6) · qca6391 firmware (5) | ↑9 | |||
| 12 | cisco | 31 | 2 | 2 | cisco ios xe software (8) · cisco sd wan vmanage (6) · cisco ios xr software (5) | ↓6 | ||
| 13 | jenkins project | 27 | 1 | jenkins (5) · jenkins aws codecommit trigger plugin (4) · jenkins build failure analyzer plugin (4) | ↑5 | |||
| 14 | gitlab | 26 | 1 | gitlab (26) | ↑10 | |||
| 15 | huawei | 25 | harmonyos (25) · emui (23) | ↓5 | ||||
| 16 | samsung mobile | 24 | samsung mobile devices (16) · gallery (2) · camera (1) | ↓5 | ||||
| 17 | siemens | 24 | qms automotive (9) · tecnomatix plant simulation v2201 (8) · tecnomatix plant simulation v2302 (8) | ↓12 | ||||
| 18 | mozilla | 23 | 5 | firefox (22) · firefox esr (17) · thunderbird (17) | ↑10 | |||
| 19 | ibm | 20 | aspera faspex (8) · sterling secure proxy (2) · financial transaction manager for swift services (1) | ↓11 | ||||
| 20 | dlink | 19 | 1 | dir 816 a2 firmware (5) · dwl 6610ap firmware (5) · dar 8000 (4) | · | |||
| 21 | nvidia | 19 | dgx h100 bmc (15) · cumulus linux (2) · bluefield 1 (1) | · | ||||
| 22 | cacti | 18 | 1 | 2 | cacti (18) | new | ||
| 23 | apache | 17 | 1 | 2 | apache superset (8) · apache airflow (2) · airflow hdfs provider (1) | — | ||
| 24 | tenda | 16 | 1 | ac10u firmware (7) · ac10u (4) · ac10v4 (1) | ↓21 | |||
| 25 | acronis | 14 | acronis cyber protect 15 (13) · acronis cyber protect home office (1) · acronis true image oem (1) | ↑5 | ||||
| 26 | fortinet | 14 | fortitester (3) · fortianalyzer (2) · fortiap u (2) | · | ||||
| 27 | linux | 14 | 1 | 2 | kernel (10) · linux kernel (3) · android (2) | · | ||
| 28 | sap se | 14 | 2 | sap commoncryptolib (2) · sap content server (2) · sap extended application services and runtime xsa (2) | ↓2 | |||
| 29 | lg electronics | 13 | 2 | lg v60 thin q 5g lmv600vm (9) · lg led assistant (4) | · | |||
| 30 | tp link | 13 | archer a10 (2) · archer a10 firmware (2) · archer c20 (2) | ↑46 | ||||
| 31 | unisoc | 13 | sc9832e (11) · sc9863a (11) · t606 (11) | new | ||||
| 32 | fedora | 12 | red hat enterprise linux 6 (12) · red hat enterprise linux 7 (12) · red hat enterprise linux 8 (12) | ↑27 | ||||
| 33 | asus | 10 | 1 | rt ac86u (6) · rt ax55 (4) · rt ax56u v2 (3) | · | |||
| 34 | ormazabal | 10 | 2 | ekorrci (10) · ekorccp (9) · ekorccp firmware (2) | new | |||
| 35 | progress software | 10 | 2 | 1 | 1 | ws ftp server (7) · moveit transfer (3) | new | |
| 36 | dell | 9 | alienware command center awcc (1) · common event enabler (1) · data protection central (1) | ↓9 | ||||
| 37 | glpi project | 9 | glpi (9) | · | ||||
| 38 | tongda | 9 | oa 2017 (5) · oa (4) | new | ||||
| 39 | vim | 9 | vim vim (9) | · | ||||
| 40 | accusoft | 8 | 4 | imagegear (8) | · | |||
| 41 | collne | 8 | welcart e commerce (8) | · | ||||
| 42 | gpac | 8 | gpac gpac (8) | ↑42 | ||||
| 43 | ibos | 8 | 1 | oa (8) · ibos (2) | · | |||
| 44 | lf edge zededa | 8 | 1 | eve os (8) · edge virtualization engine (3) · eve (3) | new | |||
| 45 | open automation software | 8 | oas platform (8) | · | ||||
| 46 | docker | 7 | docker desktop (6) · composer (1) | · | ||||
| 47 | jumpserver | 7 | 3 | jumpserver (7) | new | |||
| 48 | librenms | 7 | 2 | librenms librenms (7) · librenms (1) | · | |||
| 49 | socomec | 7 | 1 | modulys gp mod3gp sy 120k (7) · modulys gp firmware (5) | new | |||
| 50 | linuxfoundation | 6 | android (3) · edge virtualization engine (3) · eve os (3) | new |
One CVE is counted once per vendor, product or weakness class it lists, so a ranking column sums to more than the month's total. Only the month's top 100 keys per dimension are stored. The KEV column counts CVEs published in 2023-09 that are on the CISA KEV catalog today. The 19 in the headline is what CISA listed during the month, whenever those CVEs were published. All 50 ranked vendors are listed; a zero count renders as a dot.
Weaknesses
CWE classes by distinct CVEs
- 1CWE-792675 critical—
- 2CWE-8912034 critical↑1
- 3CWE-787524 critical↑6
- 4CWE-416505 critical↑6
- 5CWE-22393 critical↑2
- 6CWE-200382 critical↑2
- 7CWE-20374 critical↓5
- 8CWE-125330 critical↓3
- 9CWE-400290 critical↑5
- 10CWE-120282 critical↑1
- 1CWE-434282 critical↑12
- 2CWE-78284 critical↓8
- 3CWE-121272 critical↑35
- 4CWE-284273 critical↓8
- 5CWE-94265 critical—
- 6CWE-269250 critical↓3
- 7CWE-862201 critical↓5
- 8CWE-863192 critical—
- 9CWE-502184 critical↑9
- 10CWE-122170 critical↓1
One CVE is counted once per vendor, product or weakness class it lists, so a ranking column sums to more than the month's total. Only the month's top 100 keys per dimension are stored.