Month report
January 2024
Rolled up 2026-08-09 20:45 from 370,700 CVE records
2,591 CVEs published, +10.2% on the same month last year. 295 rated critical, 21 listed by CISA as exploited. apple led with 84; the most common weakness class was CWE-79 (377). codeastro climbed 65 places, the largest move. 9 vendors ranked for the first time.
Published
2,591
-3.1%on the previous month
Critical / high
295 / 916
of the 2,584 scored
Medium / low
1,228 / 145
the rest of the scored bands
Added to CISA KEV
21
listed as exploited this month
Public exploit
105
exploit code indexed publicly
Scanner template
0
0% of the month
Publication to KEV
How long before CISA listed them
15 published this month and listed since — not the 21 listed during it.
Median days to listing
8
from publication to CISA's date added
Listed within 7 days
46.7%
of the 15
Listed within 30 days
60%
of the 15
Detection gap
Listed as exploited, no public template
CVEs CISA listed this month
Listed this month
21
added to the CISA KEV catalog
With a template
12
57.1% covered
No template
9
nothing in the public index
- 1apple3of 3 listed
- 2google2of 2 listed
- 3cloud software group1of 2 listed
- 4citrix1of 1 listed
- 5debian1of 1 listed
- 6douglas wilson1of 1 listed
- 7fedoraproject1of 1 listed
- 8jmcnamara1of 1 listed
Measured against the nuclei-templates CVE index only. No template there does not mean a CVE is undetectable by any other tool.
Vendors
Ranked by distinct CVEs this month
Δ is the move against last month's rank.
| # | Vendor | Top products | ||||||
|---|---|---|---|---|---|---|---|---|
| 1 | apple | 84 | 1 | 3 | 5 | macos (76) · ios and ipados (52) · watchos (22) | ↑8 | |
| 2 | gtkwave | 82 | gtkwave (82) | new | ||||
| 3 | microsoft | 57 | 2 | 9 | windows 11 version 22h2 (35) · windows 11 version 23h2 (35) · windows server 2022 (35) | ↑2 | ||
| 4 | redhat | 52 | 1 | 3 | red hat enterprise linux 8 (46) · red hat enterprise linux 9 (46) · red hat enterprise linux 7 (44) | ↑3 | ||
| 5 | totolink | 50 | 8 | lr1200gb (13) · n200re (12) · n350rt (6) | ↑28 | |||
| 6 | oracle | 43 | mysql server (12) · java se jdk and jre (5) · audit vault and database firewall (3) | · | ||||
| 7 | cups easy | 41 | cups easy purchase inventory (41) | new | ||||
| 8 | tenda | 35 | 5 | ac10u (11) · w9 (7) · a15 (4) | ↑60 | |||
| 9 | trend micro | 34 | trend micro apex one (16) · trend micro apex one as a service (16) · trend micro apex central (12) | · | ||||
| 10 | siemens | 32 | 2 | 1 | solid edge se2023 (11) · simatic s7 1500 tm mfp gnu linux subsystem (5) · jt2go (4) | ↑4 | ||
| 11 | kashipara | 29 | food management system (19) · billing software (5) · dynamic lab management system (2) | new | ||||
| 12 | code projects | 28 | fighting cock information system (9) · dormitory management system (4) · online faculty clearance (4) | ↓2 | ||||
| 13 | 26 | 4 | 1 | 1 | chrome (22) · fedora (2) · pixel watch (2) | ↓11 | ||
| 14 | ibm | 26 | 1 | db2 for linux unix and windows (8) · aix (4) · security verify access appliance (3) | ↓10 | |||
| 15 | qualcomm | 26 | 3 | snapdragon (26) · qcn7606 firmware (1) | ↓9 | |||
| 16 | sourcecodester | 26 | engineers online portal (7) · employee management system (5) · house rental management system (4) | ↑1 | ||||
| 17 | hathway | 25 | skyworth router cm5100 (25) | new | ||||
| 18 | juniper networks | 25 | 1 | junos os (21) · junos os evolved (8) · junos (1) | · | |||
| 19 | rexroth | 25 | nexo cordless nutrunner nxa011s 36v 0608842011 (25) · nexo cordless nutrunner nxa011s 36v b 0608842012 (25) · nexo cordless nutrunner nxa015s 36v 0608842001 (25) | · | ||||
| 20 | huawei | 22 | 2 | harmonyos (22) · emui (18) | ↑1 | |||
| 21 | unisoc shanghai technologies co | 21 | sc7731e sc9832e sc9863a t310 t606 t612 t616 t610 t618 t760 t770 t820 s8000 (21) | ↓18 | ||||
| 22 | mediatek | 20 | 1 | mt6762 mt6765 mt6833 mt6879 mt6883 mt6885 mt6983 mt8167 mt8168 mt8188 mt8321 mt8765 mt8766 mt8768 mt8781 mt8786 mt8788 mt8789 mt8791t mt8797 mt8798 (6) · mt2735 mt6813 mt6833 mt6833p mt6835 mt6853 mt6853t mt6855 mt6873 mt6875 mt6877 mt6877t mt6878 mt6879 mt6880 mt6883 mt6885 mt6886 mt6889 mt6890 mt6891 mt6893 mt6895 mt6895t mt6896 mt6897 mt6980 mt6980d mt6983t mt6983w mt6983z mt6985 mt6985t mt6989 mt6990 (3) · mt6580 mt6731 mt6735 mt6737 mt6739 mt6753 mt6757 mt6757c mt6757cd mt6757ch mt6761 mt6762 mt6763 mt6765 mt6768 mt6769 mt6771 mt6779 mt6781 mt6785 mt6789 mt6833 mt6835 mt6853 mt6853t mt6855 mt6873 mt6875 mt6877 mt6879 mt6883 mt6885 mt6886 mt6889 mt6891 mt6893 mt6895 mt6983 mt6985 mt8185 mt8321 mt8385 mt8666 mt8667 mt8673 mt8675 mt8765 mt8766 mt8768 mt8781 mt8786 mt8788 mt8789 mt8791 mt8791t mt8797 mt8798 (3) | ↓10 | |||
| 23 | paddlepaddle | 19 | 4 | paddlepaddle (18) · paddlepaddle paddle (1) | · | |||
| 24 | kashipara group | 18 | 17 | billing software (8) · travel website (6) · online notice board system (4) | ↑3 | |||
| 25 | mozilla | 17 | 1 | firefox (15) · thunderbird (10) · firefox esr (9) | ↓7 | |||
| 26 | codeastro | 16 | internet banking system (3) · online food ordering system (2) · real estate management system (2) | ↑65 | ||||
| 27 | hcl software | 16 | dryice myxalytics (12) · hcl bigfix osd bare metal server webui (3) · bigfix bare osd metal server webui (1) | ↑7 | ||||
| 28 | apache | 15 | 3 | 3 | apache airflow (3) · apache inlong (2) · apache servicecomb service center (2) | ↓12 | ||
| 29 | qnap systems | 14 | qts (8) · quts hero (8) · qumagie (3) | ↑52 | ||||
| 30 | wwbn | 14 | 4 | avideo (14) | · | |||
| 31 | cisco | 12 | 1 | cisco prime infrastructure (4) · cisco evolved programmable network manager epnm (3) · cisco unity connection (3) | · | |||
| 32 | delta electronics | 12 | dopsoft (10) · ispsoft (1) · wplsoft (1) | · | ||||
| 33 | tianocore | 12 | edk2 (12) | · | ||||
| 34 | nvidia | 11 | 3 | dgx a100 (9) · bluefield 2 dpu bmc bluefield 3 dpu bmc (1) · dgx a100 firmware (1) | · | |||
| 35 | adobe | 10 | substance3d stager (6) · acrobat for edge (2) · adobe experience manager (2) | ↓34 | ||||
| 36 | gitlab | 10 | 2 | 1 | 3 | gitlab (10) | ↓16 | |
| 37 | hongdian | 10 | 3 | h8951 4g esp (10) · h8951 4g esp firmware (1) | new | |||
| 38 | xen | 10 | xen (10) | · | ||||
| 39 | jenkins project | 9 | 1 | 1 | 2 | jenkins gitlab branch source plugin (3) · jenkins (2) · jenkins git server plugin (1) | ↓17 | |
| 40 | phpgurukul | 9 | hospital management system (6) · company visitor management system (2) · dairy farm shop management system (1) | ↓17 | ||||
| 41 | rrj | 9 | nueva ecija engineer online portal (9) | new | ||||
| 42 | ami | 8 | 2 | megarac spx (8) | · | |||
| 43 | deshang | 8 | dsmall (3) · dsshop (2) · dscms (1) | new | ||||
| 44 | linux | 8 | 2 | 2 | linux kernel (5) · kernel (4) · linux (3) | ↑34 | ||
| 45 | samsung mobile | 8 | samsung mobile devices (5) · nearby device scanning (2) · samsung email (1) | ↓32 | ||||
| 46 | splunk | 8 | splunk enterprise (4) · splunk cloud (3) · splunk add on builder (2) | · | ||||
| 47 | cxbsoft | 7 | url shorting (4) · post office (3) | new | ||||
| 48 | fireeye | 7 | fireeye central management (2) · fireeye hxtool (2) · fireeye endpoint security (1) | new | ||||
| 49 | lenovo | 7 | tablet (2) · vantage (2) · lenovo app store application (1) | · | ||||
| 50 | nextcloud | 7 | 1 | security advisories (7) | ↑30 |
One CVE is counted once per vendor, product or weakness class it lists, so a ranking column sums to more than the month's total. Only the month's top 100 keys per dimension are stored. The KEV column counts CVEs published in 2024-01 that are on the CISA KEV catalog today. The 21 in the headline is what CISA listed during the month, whenever those CVEs were published. All 50 ranked vendors are listed; a zero count renders as a dot.
Weaknesses
CWE classes by distinct CVEs
- 1CWE-793775 critical—
- 2CWE-8917641 critical—
- 3CWE-78710136 critical↑6
- 4CWE-352802 critical↓1
- 5CWE-121767 critical↑20
- 6CWE-200763 critical—
- 7CWE-284714 critical↑5
- 8CWE-20695 critical↓3
- 9CWE-786727 critical↑2
- 10CWE-119665 critical↑27
- 1CWE-416664 critical↑9
- 2CWE-22545 critical↓2
- 3CWE-4345312 critical↓9
- 4CWE-190526 critical↑19
- 5CWE-862494 critical↑1
- 6CWE-125482 critical↑2
- 7CWE-94388 critical↓10
- 8CWE-120366 critical↓5
- 9CWE-773620 critical↑5
- 10CWE-400350 critical↓1
One CVE is counted once per vendor, product or weakness class it lists, so a ranking column sums to more than the month's total. Only the month's top 100 keys per dimension are stored.