Month report
November 2023
Rolled up 2026-08-09 20:45 from 370,700 CVE records
2,443 CVEs published, +20.9% on the same month last year. 193 rated critical, 18 listed by CISA as exploited. adobe led with 77; the most common weakness class was CWE-79 (308). cisco climbed 56 places, the largest move. 7 vendors ranked for the first time.
Published
2,443
-9.2%on the previous month
Critical / high
193 / 590
of the 1,944 scored
Medium / low
1,041 / 120
the rest of the scored bands
Added to CISA KEV
18
listed as exploited this month
Public exploit
91
exploit code indexed publicly
Scanner template
0
0% of the month
Publication to KEV
How long before CISA listed them
11 published this month and listed since — not the 18 listed during it.
Median days to listing
4
from publication to CISA's date added
Listed within 7 days
63.6%
of the 11
Listed within 30 days
72.7%
of the 11
Weakness × vendor
Where the two overlap
CVEs carrying both. Each row is shaded against its own worst class.
| Vendor | CWE-79 | CWE-352 | CWE-89 | CWE-200 | CWE-20 | CWE-284 | CWE-125 | CWE-416 |
|---|---|---|---|---|---|---|---|---|
| adobe | 1 | 2 | 4 | 1 | 34 | 8 | ||
| microsoft | 5 | 1 | 5 | 1 | 2 | 3 | ||
| redhat | 1 | 2 | 9 | |||||
| cisco | 5 | 2 | 1 | 2 | ||||
| unisoc shanghai technologies co | ||||||||
| 5 | ||||||||
| samsung mobile | 2 | |||||||
| projectworlds pvt | 26 |
Detection gap
Listed as exploited, no public template
CVEs CISA listed this month
Listed this month
18
added to the CISA KEV catalog
With a template
8
44.4% covered
No template
10
nothing in the public index
- 1microsoft4of 4 listed
- 2juniper networks3of 5 listed
- 3google1of 1 listed
- 4redhat1of 1 listed
- 5siemens1of 1 listed
Measured against the nuclei-templates CVE index only. No template there does not mean a CVE is undetectable by any other tool.
Vendors
Ranked by distinct CVEs this month
Δ is the move against last month's rank.
| # | Vendor | Top products | ||||||
|---|---|---|---|---|---|---|---|---|
| 1 | adobe | 77 | 4 | acrobat reader (17) · audition (9) · after effects (8) | ↑25 | |||
| 2 | microsoft | 68 | 2 | 4 | 4 | windows server 2022 (29) · windows server 2022 23h2 edition server core installation (29) · windows 11 version 21h2 (28) | — | |
| 3 | redhat | 44 | 2 | 1 | red hat enterprise linux 8 (37) · red hat enterprise linux 7 (36) · red hat enterprise linux 9 (36) | ↑3 | ||
| 4 | cisco | 39 | 1 | 1 | cisco firepower threat defense software (17) · cisco firepower management center (10) · cisco adaptive security appliance asa software (7) | ↑56 | ||
| 5 | unisoc shanghai technologies co | 34 | sc7731e sc9832e sc9863a t310 t606 t612 t616 t610 t618 t760 t770 t820 s8000 (31) · t760 t770 t820 s8000 (2) · s8000 (1) | ↑8 | ||||
| 6 | 30 | 2 | 1 | 1 | chrome (22) · android (8) · mt2713 (2) | ↓5 | ||
| 7 | samsung mobile | 30 | samsung mobile devices (13) · samsung account (7) · samsung push service (2) | ↑30 | ||||
| 8 | projectworlds pvt | 29 | 26 | online food ordering system (13) · online matrimonial project (6) · online bus booking system (4) | new | |||
| 9 | apache | 26 | 2 | 2 | apache superset (6) · apache dolphinscheduler (3) · apache airflow (2) | ↑3 | ||
| 10 | lenovo | 26 | desktop bios (15) · bios (5) · 1lenovo preload directory (1) | ↑5 | ||||
| 11 | huawei | 23 | emui (22) · harmonyos (22) | ↑3 | ||||
| 12 | qualcomm | 23 | 4 | snapdragon (23) · ar8035 firmware (2) · csr8811 firmware (2) | ↑4 | |||
| 13 | siemens | 22 | 4 | ruggedcom rm1224 lte 4g eu (8) · ruggedcom rm1224 lte 4g nam (8) · scalance m804pb (8) | ↓2 | |||
| 14 | amd | 21 | 1 | 3rd gen amd epyc processors (10) · amd epyc embedded 7003 (8) · amd ryzen 6000 series processors with radeon graphics rembrandt (7) | · | |||
| 15 | ibm | 18 | cics tx advanced (6) · cics tx standard (3) · qradar wincollect agent (2) | ↓11 | ||||
| 16 | fortinet | 17 | 2 | fortiadc (3) · forticlientwindows (3) · fortisiem (3) | ↓8 | |||
| 17 | zyxel | 17 | 3 | usg flex series firmware (9) · atp series firmware (8) · usg20 w vpn series firmware (8) | · | |||
| 18 | pkp | 16 | pkp pkp lib (14) · pkp customlocale (1) · pkp ojs (1) | new | ||||
| 19 | dell | 15 | dell command configure dcc (2) · dell os recovery tool (2) · dell repository manager drm (2) | ↑8 | ||||
| 20 | mattermost | 15 | 1 | mattermost (12) · mattermost desktop (3) | ↑41 | |||
| 21 | bigprof | 14 | online inventory manager (6) · online clinic management system (4) · online invoicing system (4) | new | ||||
| 22 | fedora | 14 | fedora (14) · red hat enterprise linux 6 (14) · red hat enterprise linux 7 (14) | ↑50 | ||||
| 23 | hewlett packard enterprise hpe | 14 | 3 | aruba access points 100 series 103 series 110 series 120 series 130 series 200 series 207 series 210 series 220 series 260 series 300 series 303 series 310 series 318 series hardened access points 320 series 330 series 340 series 370 series 500 series 510 series 530 series 550 series 630 series 650 series (14) · arubaos (2) · instantos (2) | ↑30 | |||
| 24 | pandora fms | 14 | 1 | pandora fms (14) | new | |||
| 25 | ivanti | 12 | 2 | avalanche (4) · epmm (2) · secure access client windows (2) | · | |||
| 26 | mozilla | 12 | firefox (10) · firefox esr (7) · thunderbird (7) | ↓3 | ||||
| 27 | mediatek | 11 | mt6895 (4) · mt8673 (4) · mt8798 (4) | ↑5 | ||||
| 28 | sourcecodester | 11 | loan management system (3) · best courier management system (2) · free and open source inventory management system (2) | ↓7 | ||||
| 29 | voovi social networking script | 11 | 9 | voovi social networking script (11) | new | |||
| 30 | chamilo | 10 | 3 | 2 | chamilo (10) | · | ||
| 31 | funnelforms | 10 | interactive contact form and multi step form builder with drag drop editor funnelforms free (10) | new | ||||
| 32 | nvidia | 10 | nvidia gpu display driver vgpu driver and cloud gaming driver (7) · gpu display driver (4) · vgpu driver and cloud gaming driver (3) | · | ||||
| 33 | ox software | 10 | ox app suite (10) | · | ||||
| 34 | zoom video communications | 10 | zoom clients (6) · zoom rooms client for windows and zoom vdi client (2) · zoom rooms for macos (2) | · | ||||
| 35 | autodesk | 9 | 1 | autocad advance steel and civil 3d (6) · customer portal (2) · desktop connector (1) | · | |||
| 36 | intel | 9 | aptio v uefi firmware integrator tools (3) · intel r aptio v uefi firmware integrator tools (3) · intel r fpga products (1) | · | ||||
| 37 | schweitzer engineering laboratories | 9 | sel 451 (5) · sel 411l (4) · sel 451 firmware (1) | · | ||||
| 38 | bitrix24 | 8 | 4 | 1 | bitrix24 (8) | new | ||
| 39 | campcodes | 8 | simple student information system (8) | · | ||||
| 40 | elastic | 8 | kibana (3) · elasticsearch (2) · elastic apm java agent (1) | ↑4 | ||||
| 41 | gitlab | 8 | gitlab (8) | · | ||||
| 42 | nextcloud | 8 | security advisories (8) | ↑20 | ||||
| 43 | qnap systems | 8 | 2 | qts (4) · qumagie (3) · quts hero (3) | ↓18 | |||
| 44 | salesagility | 8 | salesagility suitecrm (7) · suitecrm (2) · suitecrm core (1) | · | ||||
| 45 | solarwinds | 8 | network configuration manager (5) · solarwinds platform (3) | ↑5 | ||||
| 46 | tenda | 8 | 4 | ax1803 firmware (5) · ax1806 firmware (2) · ac10 (1) | · | |||
| 47 | vim | 8 | vim (8) | · | ||||
| 48 | becton dickinson and company bd | 7 | facschorus (7) | · | ||||
| 49 | fuji electric co ltd and hakko electronics co | 7 | tellus (3) · tellus lite (3) · v server (3) | · | ||||
| 50 | gpac | 7 | gpac (6) · gpac gpac (1) | ↑44 |
One CVE is counted once per vendor, product or weakness class it lists, so a ranking column sums to more than the month's total. Only the month's top 100 keys per dimension are stored. The KEV column counts CVEs published in 2023-11 that are on the CISA KEV catalog today. The 18 in the headline is what CISA listed during the month, whenever those CVEs were published. All 50 ranked vendors are listed; a zero count renders as a dot.
Weaknesses
CWE classes by distinct CVEs
- 1CWE-793086 critical—
- 2CWE-3522341 critical—
- 3CWE-8913751 critical—
- 4CWE-200894 critical—
- 5CWE-20638 critical—
- 6CWE-284614 critical↑1
- 7CWE-125571 critical↑10
- 8CWE-416400 critical↑6
- 9CWE-787402 critical↓3
- 10CWE-120385 critical↑6
- 1CWE-22368 critical—
- 2CWE-434324 critical↑7
- 3CWE-783112 critical↓5
- 4CWE-943013 critical↑1
- 5CWE-269282 critical↓6
- 6CWE-862281 critical↓6
- 7CWE-918284 critical↑9
- 8CWE-287266 critical↑3
- 9CWE-400260 critical↓7
- 10CWE-1236250 critical·
One CVE is counted once per vendor, product or weakness class it lists, so a ranking column sums to more than the month's total. Only the month's top 100 keys per dimension are stored.