Month report
April 2024
Rolled up 2026-08-09 20:45 from 376,493 CVE records
3,604 CVEs published, +56.6% on the same month last year. 283 rated critical, 10 listed by CISA as exploited. linux led with 360; the most common weakness class was CWE-79 (590). openharmony climbed 51 places, the largest move. 4 vendors ranked for the first time.
Published
3,604
Critical / high
283 / 1,244
Medium / low
1,692 / 185
Added to CISA KEV
10
Public exploit
120
Scanner template
0
Publication to KEV
How long before CISA listed them
Median days to listing
1
Listed within 7 days
80%
Listed within 30 days
90%
Detection gap
Listed as exploited, no public template
Listed this month
10
With a template
4
No template
6
Measured against the nuclei-templates CVE index only. No template there does not mean a CVE is undetectable by any other tool.
Vendors
Ranked by distinct CVEs this month
| # | Vendor | Top products | ||||||
|---|---|---|---|---|---|---|---|---|
| 1 | linux | 360 | 10 | 1 | linux (357) · simatic s7 1500 tm mfp gnu linux subsystem (36) · linux kernel (21) | — | ||
| 2 | microsoft | 152 | 1 | 1 | 6 | windows server 2022 23h2 edition server core installation (85) · windows server 2022 (80) · windows server 2019 (77) | ↑4 | |
| 3 | oracle | 134 | 5 | 3 | complex maintenance repair and overhaul (31) · mysql server (25) · vm virtualbox (13) | · | ||
| 4 | tenda | 102 | 6 | w15e (13) · ac500 (9) · w30e firmware (9) | ↓2 | |||
| 5 | sourcecodester | 92 | 4 | online courseware (13) · computer laboratory management system (12) · aplaya beach resort online reservation system (11) | ↓2 | |||
| 6 | foxit | 51 | pdf reader (48) · pdf editor (26) · foxit reader (3) | · | ||||
| 7 | 50 | 5 | 2 | android (28) · chrome (20) · pixel (4) | ↓2 | |||
| 8 | siemens | 48 | 1 | 1 | simatic s7 1500 tm mfp gnu linux subsystem (38) · linux (37) · simatic s7 1500 cpu 1518 4 pn dp mfp (9) | ↑11 | ||
| 9 | ibm | 40 | 1 | aspera faspex (6) · db2 for linux unix and windows (6) · security verify access appliance (5) | ↓2 | |||
| 10 | redhat | 40 | 1 | red hat enterprise linux 8 (11) · red hat enterprise linux 9 (11) · red hat enterprise linux 7 (9) | ↑8 | |||
| 11 | wordpress | 37 | 2 | 1 | adserve (2) · max addons pro for bricks (2) · royal addons for elementor addons and templates kit for elementor (2) | · | ||
| 12 | huawei | 36 | 2 | harmonyos (35) · emui (33) · gt3 (1) | · | |||
| 13 | ivanti | 32 | 2 | avalanche (27) · connect secure (5) · policy secure (5) | · | |||
| 14 | juniper networks | 32 | junos os (25) · junos os evolved (14) · junos (7) | · | ||||
| 15 | adobe | 29 | 1 | adobe experience manager (14) · experience manager (11) · animate (4) | ↓7 | |||
| 16 | apache | 27 | 5 | 1 | 3 | apache zeppelin (9) · zeppelin (6) · apache cloudstack (3) | ↓3 | |
| 17 | campcodes | 25 | church management system (9) · complete online student management system (6) · online event management system (5) | ↓8 | ||||
| 18 | brocade | 24 | brocade sannav (22) · sannav (16) · fabric os (2) | · | ||||
| 19 | cisco | 22 | 2 | 1 | cisco nexus dashboard (3) · cisco telepresence management suite tms (3) · asa (2) | ↓8 | ||
| 20 | phpgurukul | 21 | 4 | 2 | client management system (6) · cyber cafe management system (4) · student record system (3) | ↑11 | ||
| 21 | totolink | 19 | 2 | ex200 firmware (11) · ex200 (3) · n300rt (3) | ↑43 | |||
| 22 | ffmpeg | 18 | 1 | ffmpeg (18) | new | |||
| 23 | mediatek | 17 | mt6781 (7) · mt8167 (7) · mt8168 (7) | ↓6 | ||||
| 24 | mozilla | 17 | 1 | firefox (16) · firefox esr (8) · thunderbird (8) | ↓1 | |||
| 25 | unisoc shanghai technologies co | 17 | sc7731e sc9832e sc9863a t310 t606 t612 t616 t610 t618 t760 t770 t820 s8000 (10) · t760 t770 t820 s8000 (6) · s8000 (3) | · | ||||
| 26 | lenovo | 16 | printers (5) · fan power controller (4) · smm smm2 fpc (4) | · | ||||
| 27 | qualcomm | 16 | 1 | snapdragon (16) · fastconnect 6900 firmware (10) · fastconnect 7800 firmware (10) | ↓12 | |||
| 28 | wbsairback | 16 | 1 | white bear solutions (16) | new | |||
| 29 | honeywell | 14 | experion server (12) · c300 (2) · experion lx (1) | · | ||||
| 30 | juniper | 14 | junos os (11) · junos (7) · junos os evolved (6) | new | ||||
| 31 | kofax | 14 | power pdf (14) | · | ||||
| 32 | tp link | 14 | ac1350 wireless mu mimo gigabit access point eap225 v3 (12) · ac1350 firmware (11) · n300 firmware (10) | · | ||||
| 33 | esri | 13 | 1 | portal for arcgis (10) · arcgis enterprise web app builder (2) · arcgis enterprise builder (1) | · | |||
| 34 | netentsec | 13 | 3 | application security gateway (5) · ns asg (5) · ns asg application security gateway (4) | ↑1 | |||
| 35 | qnap systems | 13 | 3 | qts (9) · quts hero (9) · qutscloud (5) | ↑42 | |||
| 36 | samsung mobile | 13 | samsung mobile devices (8) · android (3) · samsung camera (1) | ↓8 | ||||
| 37 | fortinet | 12 | 1 | fortisandbox (6) · fortios (3) · forticlient (1) | ↑6 | |||
| 38 | xwiki | 12 | 10 | 1 | xwiki platform (11) · xwiki (8) · commons (1) | · | ||
| 39 | dedecms | 11 | 1 | dedecms (11) | ↓27 | |||
| 40 | derbynet | 11 | 3 | derbynet (11) | new | |||
| 41 | freerdp | 11 | 6 | 1 | freerdp (11) | · | ||
| 42 | mattermost | 11 | mattermost (11) · mattermost mobile (1) · mattermost server (1) | ↑50 | ||||
| 43 | qnap | 11 | 3 | qts (7) · quts hero (7) · qutscloud (4) | · | |||
| 44 | sap se | 11 | sap business connector (2) · sap s 4 hana cash management (2) · asset accounting (1) | ↑18 | ||||
| 45 | bdthemes | 10 | element pack widgets templates addons for elementor (5) · prime slider addons for elementor (3) · element pack elementor addons (2) | ↑1 | ||||
| 46 | dell | 10 | 1 | alienware command center (2) · alienware command center awcc (2) · dell repository manager drm (2) | ↓36 | |||
| 47 | openharmony | 10 | openharmony (10) | ↑51 | ||||
| 48 | pdf xchange | 10 | pdf xchange editor (10) | · | ||||
| 49 | stellarwp | 10 | kadence blocks page builder toolkit for gutenberg editor (4) · givewp donation plugin and fundraising platform (2) · event tickets and registration (1) | · | ||||
| 50 | combodo | 9 | 1 | itop (9) | · |
One CVE is counted once per vendor, product or weakness class it lists, so a ranking column sums to more than the month's total. Only the month's top 100 keys per dimension are stored. The KEV column counts CVEs published in 2024-04 that are on the CISA KEV catalog today. The 10 in the headline is what CISA listed during the month, whenever those CVEs were published. All 50 ranked vendors are listed; a zero count renders as a dot.
Weaknesses
CWE classes by distinct CVEs
- 1CWE-795904 critical—
- 2CWE-8921940 critical—
- 3CWE-3521995 critical↑1
- 4CWE-8621367 critical↑1
- 5CWE-1211335 critical↓2
- 6CWE-12510711 critical↑5
- 7CWE-200963 critical↓1
- 8CWE-22897 critical↑4
- 9CWE-416821 critical↑7
- 10CWE-284819 critical↓1
- 1CWE-20734 critical↓1
- 2CWE-946732 critical↑5
- 3CWE-122633 critical↑12
- 4CWE-4345620 critical↓7
- 5CWE-120524 critical↑3
- 6CWE-787522 critical↓8
- 7CWE-918505 critical↑5
- 8CWE-784915 critical↓3
- 9CWE-476462 critical↑1
- 10CWE-773910 critical↑4
One CVE is counted once per vendor, product or weakness class it lists, so a ranking column sums to more than the month's total. Only the month's top 100 keys per dimension are stored.