Month report
December 2023
Rolled up 2026-08-09 20:45 from 370,700 CVE records
2,673 CVEs published, +13.5% on the same month last year. 202 rated critical, 11 listed by CISA as exploited. adobe led with 220; the most common weakness class was CWE-79 (442). tongda climbed 38 places, the largest move. 10 vendors ranked for the first time.
Published
2,673
Critical / high
202 / 585
Medium / low
978 / 102
Added to CISA KEV
11
Public exploit
74
Scanner template
0
Publication to KEV
How long before CISA listed them
Median days to listing
9
Listed within 7 days
44.4%
Listed within 30 days
88.9%
Detection gap
Listed as exploited, no public template
Listed this month
11
With a template
2
No template
9
- 1qualcomm4of 4 listed
- 2apple2of 2 listed
- 3fxc1of 1 listed
- 4qnap systems1of 1 listed
- 5unitronics1of 1 listed
Measured against the nuclei-templates CVE index only. No template there does not mean a CVE is undetectable by any other tool.
Vendors
Ranked by distinct CVEs this month
| # | Vendor | Top products | ||||||
|---|---|---|---|---|---|---|---|---|
| 1 | adobe | 220 | adobe experience manager (193) · substance3d sampler (6) · after effects (4) | — | ||||
| 2 | 88 | 5 | 1 | 4 | android (74) · chrome (13) · nodejs firestore (1) | ↑4 | ||
| 3 | unisoc shanghai technologies co | 83 | sc7731e sc9832e sc9863a t310 t606 t612 t616 t610 t618 t760 t770 t820 s8000 (73) · sc9863a t310 t606 t612 t616 t610 t618 t760 t770 t820 s8000 (6) · t820 (3) | ↑2 | ||||
| 4 | ibm | 54 | 1 | db2 for linux unix and windows (8) · infosphere information server (8) · aix (6) | ↑11 | |||
| 5 | microsoft | 40 | 2 | 2 | windows server 2022 23h2 edition server core installation (19) · windows server 2019 (18) · windows server 2019 server core installation (18) | ↓3 | ||
| 6 | qualcomm | 38 | 3 | 3 | 1 | snapdragon (38) · ar8035 firmware (3) · csra6620 firmware (3) | ↑6 | |
| 7 | redhat | 36 | 2 | red hat enterprise linux 9 (19) · red hat enterprise linux 8 (18) · red hat enterprise linux 6 (17) | ↓4 | |||
| 8 | dell | 35 | powerprotect dd (8) · dell powerprotect data manager dm5500 appliance (7) · vapp manager (6) | ↑11 | ||||
| 9 | apple | 33 | macos (31) · ios and ipados (11) · tvos (6) | · | ||||
| 10 | code projects | 32 | client details system (7) · e commerce website (4) · faculty management system (3) | · | ||||
| 11 | honor | 30 | 1 | magic os (11) · magic ui (7) · nth an00 (4) | new | |||
| 12 | mediatek | 30 | mt2735 mt2737 mt6297 mt6298 mt6813 mt6815 mt6833 mt6835 mt6853 mt6855 mt6873 mt6875 mt6875t mt6877 mt6879 mt6880 mt6883 mt6885 mt6886 mt6889 mt6890 mt6891 mt6893 mt6895 mt6895t mt6896 mt6897 mt6980 mt6980d mt6983 mt6985 mt6989 mt6990 (6) · mt6885 (4) · mt6761 mt6765 mt6768 mt6779 mt6781 mt6785 mt6789 mt6833 mt6835 mt6853 mt6855 mt6873 mt6877 mt6879 mt6883 mt6885 mt6886 mt6889 mt6893 mt6895 mt6983 mt6985 mt8188 mt8195 mt8673 mt8781 (3) | ↑15 | ||||
| 13 | samsung mobile | 27 | samsung mobile devices (15) · galaxy store (2) · samsung pass (2) | ↓6 | ||||
| 14 | siemens | 26 | 3 | simatic s7 1500 cpu 1518 4 pn dp mfp (9) · simatic s7 1500 cpu 1518f 4 pn dp mfp (9) · siplus s7 1500 cpu 1518 4 pn dp mfp (9) | ↓1 | |||
| 15 | ivanti | 25 | 13 | avalanche (19) · connect secure (3) · wavelink (3) | ↑10 | |||
| 16 | apache | 24 | 3 | apache airflow (4) · apache ofbiz (3) · apache superset (3) | ↓7 | |||
| 17 | sourcecodester | 24 | simple student attendance system (8) · user registration and login system (3) · free and open source inventory management system (2) | ↑11 | ||||
| 18 | mozilla | 22 | firefox (18) · firefox esr (11) · thunderbird (11) | ↑8 | ||||
| 19 | projectworlds pvt | 18 | 9 | online examination system (7) · student result management system (4) · railway reservation system (3) | ↓11 | |||
| 20 | gitlab | 17 | gitlab (17) | ↑21 | ||||
| 21 | huawei | 17 | emui (14) · harmonyos (14) · ar6000 (2) | ↓10 | ||||
| 22 | jenkins project | 16 | jenkins nexus platform plugin (4) · jenkins paaslane estimate plugin (4) · jenkins dingding json pusher plugin (2) | ↑29 | ||||
| 23 | phpgurukul | 16 | online notes sharing system (6) · nipah virus testing management system (4) · teacher subject allocation management system (3) | ↑35 | ||||
| 24 | sap se | 16 | 4 | sap xssec (2) · business objects bi platform (1) · cloud security services integration library (1) | · | |||
| 25 | fortinet | 13 | fortios (3) · fortipam (2) · fortiproxy (2) | ↓9 | ||||
| 26 | github | 13 | enterprise server (13) | · | ||||
| 27 | kashipara group | 13 | 6 | student information system (5) · hotel management (4) · job portal (4) | new | |||
| 28 | weseek | 13 | growi (13) | · | ||||
| 29 | mattermost | 12 | mattermost (12) | ↓9 | ||||
| 30 | woocommerce | 12 | 1 | automatewoo (3) · woocommerce bookings (2) · canada post shipping method (1) | · | |||
| 31 | azure rtos | 10 | 2 | usbx (5) · netxduo (4) · threadx (1) | · | |||
| 32 | mlflow | 10 | 5 | mlflow mlflow (10) | new | |||
| 33 | totolink | 10 | 2 | ex1800t firmware (4) · a7100ru (2) · a3700r firmware (1) | · | |||
| 34 | hcl software | 9 | hcl launch (4) · hcl bigfix platform (2) · hcl connections (2) | · | ||||
| 35 | thecosy | 9 | icecms (9) | new | ||||
| 36 | tongda | 9 | oa 2017 (9) | ↑38 | ||||
| 37 | campcodes | 8 | online college library system (6) · chic beauty salon (1) · web based student clearance system (1) | ↑2 | ||||
| 38 | gallagher | 8 | command centre server (2) · controller 6000 (2) · command centre (1) | · | ||||
| 39 | umbraco | 8 | umbraco cms (8) | · | ||||
| 40 | connectize | 7 | 1 | ac21000 g6 firmware (7) | new | |||
| 41 | palo alto networks | 7 | cloud ngfw (7) · pan os (7) · prisma access (7) | · | ||||
| 42 | poly | 7 | trio 8800 (7) · trio c60 (6) · ccx 400 (5) | new | ||||
| 43 | progress software | 7 | 1 | whatsup gold (6) · sitefinity (1) | · | |||
| 44 | sierrawireless | 7 | 1 | aleos (7) | new | |||
| 45 | buildroot | 6 | buildroot (6) | new | ||||
| 46 | cacti | 6 | 3 | cacti (6) | · | |||
| 47 | efacec | 6 | 1 | uc 500e (4) · bcu 500 (2) | new | |||
| 48 | elastic | 6 | kibana (2) · beats (1) · elastic agent (1) | ↓8 | ||||
| 49 | hitachi energy | 6 | 1 | rtu500 (2) · relion670 (1) · rtu500 scripting interface (1) | ↑17 | |||
| 50 | idemia | 6 | 3 | morphowave compact xp (6) · morphowave sp (6) · sigma extreme (6) | new |
One CVE is counted once per vendor, product or weakness class it lists, so a ranking column sums to more than the month's total. Only the month's top 100 keys per dimension are stored. The KEV column counts CVEs published in 2023-12 that are on the CISA KEV catalog today. The 11 in the headline is what CISA listed during the month, whenever those CVEs were published. All 50 ranked vendors are listed; a zero count renders as a dot.
Weaknesses
CWE classes by distinct CVEs
- 1CWE-794421 critical—
- 2CWE-8919937 critical↑1
- 3CWE-352782 critical↓1
- 4CWE-4345828 critical↑8
- 5CWE-20525 critical—
- 6CWE-200510 critical↓2
- 7CWE-944221 critical↑7
- 8CWE-5024016 critical↑16
- 9CWE-7874011 critical—
- 10CWE-22385 critical↑1
- 1CWE-78384 critical↑2
- 2CWE-284352 critical↓6
- 3CWE-120337 critical↓3
- 4CWE-918323 critical↑3
- 5CWE-601300 critical↑19
- 6CWE-862291 critical—
- 7CWE-863260 critical↑10
- 8CWE-125241 critical↓11
- 9CWE-400221 critical—
- 10CWE-416201 critical↓12
One CVE is counted once per vendor, product or weakness class it lists, so a ranking column sums to more than the month's total. Only the month's top 100 keys per dimension are stored.