Month report
September 2024
Rolled up 2026-08-29 17:40 from 376,493 CVE records
2,514 CVEs published, +17% on the same month last year. 274 rated critical, 25 listed by CISA as exploited. linux led with 277; the most common weakness class was CWE-79 (364). fortinet climbed 35 places, the largest move. 7 vendors ranked for the first time.
Published
2,514
Critical / high
274 / 904
Medium / low
1,060 / 109
Added to CISA KEV
25
Public exploit
96
Scanner template
48
Publication to KEV
How long before CISA listed them
Median days to listing
40
Listed within 7 days
46.2%
Listed within 30 days
46.2%
Weakness × vendor
Where the two overlap
| Vendor | CWE-79 | CWE-89 | CWE-120 | CWE-125 | CWE-200 | CWE-22 | CWE-862 | CWE-284 |
|---|---|---|---|---|---|---|---|---|
| linux | ||||||||
| apple | 3 | 5 | 15 | 3 | 1 | 1 | ||
| microsoft | 2 | 4 | 5 | |||||
| sourcecodester | 17 | 24 | 1 | 1 | 2 | |||
| 1 | 1 | 1 | 1 | 1 | ||||
| siemens | 1 | 1 | ||||||
| open networking foundation | 27 | |||||||
| open networking foundation onf | 27 |
Detection gap
Listed as exploited, no public template
Listed this month
25
With a template
10
No template
15
Measured against the nuclei-templates CVE index only. No template there does not mean a CVE is undetectable by any other tool.
Vendors
Ranked by distinct CVEs this month
| # | Vendor | Top products | ||||||
|---|---|---|---|---|---|---|---|---|
| 1 | linux | 277 | 14 | 1 | linux (277) · simatic s7 1500 tm mfp gnu linux subsystem (16) · ruggedcom rst2428p (11) | — | ||
| 2 | apple | 91 | 2 | 3 | macos (74) · ios and ipados (35) · visionos (15) | · | ||
| 3 | microsoft | 90 | 3 | 4 | 2 | windows server 2016 (38) · windows server 2022 (38) · windows server 2022 23h2 edition server core installation (38) | — | |
| 4 | sourcecodester | 53 | 1 | 2 | best house rental management system (7) · food ordering management system (6) · online railway reservation system (5) | ↓2 | ||
| 5 | 51 | 1 | 1 | chrome (26) · android (20) · angular js (2) | ↑1 | |||
| 6 | siemens | 39 | 4 | linux (17) · simatic s7 1500 tm mfp gnu linux subsystem (16) · ruggedcom rst2428p (12) | ↑2 | |||
| 7 | open networking foundation | 37 | libfluid (37) | new | ||||
| 8 | open networking foundation onf | 37 | libfluid (37) | new | ||||
| 9 | cisco | 32 | 1 | 1 | 1 | 2 | cisco ios xe software (10) · cisco ios xr software (9) · ios xe (6) | ↑14 |
| 10 | redhat | 31 | 4 | 1 | 2 | red hat enterprise linux 10 (15) · red hat enterprise linux 8 (15) · red hat enterprise linux 9 (15) | ↑18 | |
| 11 | adobe | 28 | 1 | after effects (5) · illustrator (5) · media encoder (5) | ↓7 | |||
| 12 | qnap systems | 26 | 1 | qts (16) · quts hero (16) · qutscloud (4) | · | |||
| 13 | samsung mobile | 26 | samsung mobile devices (19) · android (15) · notes (4) | — | ||||
| 14 | code projects | 25 | 1 | student record system (4) · blood bank management system (3) · blood bank system (3) | ↑11 | |||
| 15 | ivanti | 24 | 11 | 2 | 3 | 1 | endpoint manager (16) · epm (11) · workspace control (6) | ↑15 |
| 16 | ibm | 21 | 1 | aspera faspex (3) · webmethods integration (3) · aspera console (2) | ↓1 | |||
| 17 | qualcomm | 21 | snapdragon (21) · fastconnect 7800 firmware (20) · wcd9370 firmware (19) | ↓3 | ||||
| 18 | gitlab | 20 | 1 | 1 | gitlab (20) | ↑11 | ||
| 19 | samsung | 20 | android (15) · samsung mobile devices (15) · notes (4) | · | ||||
| 20 | sap se | 20 | sap netweaver application server for abap and abap platform (8) · business objects business intelligence platform (1) · sap business warehouse bex analyzer (1) | ↑7 | ||||
| 21 | gotenna | 19 | pro (10) · pro atak plugin (9) · pro app (6) | new | ||||
| 22 | huawei | 18 | harmonyos (18) · emui (17) | ↑15 | ||||
| 23 | veeam | 18 | 5 | 1 | 1 | 1 | backup and recovery (7) · one (6) · backup replication (5) | · |
| 24 | d link | 15 | 9 | dir x4860 a1 (5) · dir x4860 firmware (3) · di 8300 (2) | ↓6 | |||
| 25 | zyxel | 15 | 2 | atp series firmware (7) · usg flex series firmware (7) · usg20 w vpn series firmware (6) | · | |||
| 26 | apache | 14 | 2 | 1 | 3 | 3 | airflow (2) · apache airflow (2) · apache druid (2) | ↓5 |
| 27 | dell | 14 | powerscale insightiq (5) · smartfabric os10 software (4) · smartfabric os10 (3) | ↓3 | ||||
| 28 | mozilla | 14 | 5 | 1 | firefox (11) · firefox esr (9) · thunderbird (9) | ↓2 | ||
| 29 | mautic | 13 | mautic (13) | · | ||||
| 30 | phpgurukul | 13 | 8 | 2 | job portal (11) · dairy farm shop management system (1) · online shopping portal (1) | · | ||
| 31 | totolink | 13 | 2 | 1 | ac1200 t8 firmware (11) · ac1200 t8 (8) · ac1200 t10 (3) | ↓21 | ||
| 32 | lenovo | 12 | hx1021 edge certified node 3yr thinkagile xcc (5) · hx1320 appliance thinkagile xcc (5) · hx1321 certified node thinkagile xcc (5) | ↑12 | ||||
| 33 | mindsdb | 12 | 2 | 1 | mindsdb (12) | new | ||
| 34 | phoenix contact | 12 | fl mguard 2102 (12) · fl mguard 2105 (12) · fl mguard 4102 pci (12) | · | ||||
| 35 | planet technology | 12 | 1 | gs 4210 24p2s hardware 3 0 (12) · gs 4210 24pl4c hardware 2 0 (12) · gs 4210 24pl4c hardware 3 0 (7) | new | |||
| 36 | dlink | 11 | 4 | dir x4860 a1 (5) · di 7003gv2 firmware (3) · di 7100g v2 firmware (3) | ↓19 | |||
| 37 | fortinet | 10 | forticlientems (3) · forticlientios (2) · forticlientlinux (2) | ↑35 | ||||
| 38 | freebsd | 10 | 4 | freebsd (10) | · | |||
| 39 | synology | 10 | synology drive client (6) · synology active backup for business agent (4) · active backup for business agent (3) | · | ||||
| 40 | tenda | 10 | 1 | fh451 firmware (3) · ch22 firmware (2) · ac15 firmware (1) | ↓35 | |||
| 41 | mattermost | 9 | mattermost (9) | ↓21 | ||||
| 42 | rockwell automation | 9 | 1 | pavilion8 (2) · 1756 en4 (1) · 1756 en4 firmware (1) | ↓9 | |||
| 43 | rockwellautomation | 9 | 1 | pavilion8 (2) · 1756 en4 (1) · 1756 en4 firmware (1) | ↓2 | |||
| 44 | loftware | 8 | 3 | spectrum (8) | new | |||
| 45 | nodejs | 8 | node (8) · nodejs (7) | · | ||||
| 46 | openharmony | 8 | openharmony (8) | · | ||||
| 47 | opentext | 8 | edirectory (6) · identity manager azuread driver (1) · identity manager rest driver 1 1 2 0200 (1) | ↓28 | ||||
| 48 | za internet | 8 | c mor video surveillance (8) | new | ||||
| 49 | hewlett packard enterprise hpe | 7 | 4 | aruba os (6) · arubaos (6) · hp ux (1) | ↑24 | |||
| 50 | qnap | 7 | qts (5) · quts hero (5) · qutscloud (3) | · |
One CVE is counted once per vendor, product or weakness class it lists, so a ranking column sums to more than the month's total. Only the month's top 100 keys per dimension are stored. The KEV column counts CVEs published in 2024-09 that are on the CISA KEV catalog today. The 25 in the headline is what CISA listed during the month, whenever those CVEs were published. All 50 ranked vendors are listed; a zero count renders as a dot.
Weaknesses
CWE classes by distinct CVEs
- 1CWE-7936410 critical—
- 2CWE-8913953 critical—
- 3CWE-120695 critical↑10
- 4CWE-125680 critical↑12
- 5CWE-200673 critical↑1
- 6CWE-226710 critical↓1
- 7CWE-862582 critical↑1
- 8CWE-284556 critical↓4
- 9CWE-78558 critical↑3
- 10CWE-945415 critical↑4
- 1CWE-20435 critical↓1
- 2CWE-774110 critical↑3
- 3CWE-416394 critical↓2
- 4CWE-269386 critical↑5
- 5CWE-352381 critical↓12
- 6CWE-121348 critical↓9
- 7CWE-787341 critical—
- 8CWE-122334 critical—
- 9CWE-5023011 critical↑3
- 10CWE-4342810 critical↓11
One CVE is counted once per vendor, product or weakness class it lists, so a ranking column sums to more than the month's total. Only the month's top 100 keys per dimension are stored.