Month report
December 2024
Rolled up 2026-09-22 22:46 from 376,476 CVE records
3,433 CVEs published, +28.4% on the same month last year. 302 rated critical, 16 listed by CISA as exploited. linux led with 354; the most common weakness class was CWE-79 (680). apple climbed 74 places, the largest move. 7 vendors ranked for the first time.
Published
3,433
Critical / high
302 / 1,194
Medium / low
1,712 / 142
Added to CISA KEV
16
Public exploit
119
Scanner template
27
Publication to KEV
How long before CISA listed them
Median days to listing
28
Listed within 7 days
36.4%
Listed within 30 days
54.5%
Detection gap
Listed as exploited, no public template
Listed this month
16
With a template
6
No template
10
- 1microsoft2of 2 listed
- 2beyondtrust1of 1 listed
- 3north grid1of 1 listed
- 4northgrid1of 1 listed
- 5palo alto networks1of 1 listed
- 6zyxel1of 1 listed
Measured against the nuclei-templates CVE index only. No template there does not mean a CVE is undetectable by any other tool.
Vendors
Ranked by distinct CVEs this month
| # | Vendor | Top products | ||||||
|---|---|---|---|---|---|---|---|---|
| 1 | linux | 354 | 14 | 3 | 1 | linux (354) · simatic s7 1500 cpu 1518 4 pn dp mfp (6) · simatic s7 1500 cpu 1518f 4 pn dp mfp (6) | — | |
| 2 | adobe | 174 | 3 | adobe experience manager (90) · adobe connect (19) · acrobat reader (16) | ↑5 | |||
| 3 | microsoft | 84 | 2 | 1 | 4 | windows server 2025 (58) · windows server 2025 server core installation (58) · windows server 2019 (57) | ↑1 | |
| 4 | apple | 62 | 5 | 1 | macos (60) · ios and ipados (28) · watchos (18) | ↑74 | ||
| 5 | ibm | 56 | 1 | 2 | cognos controller (10) · cognos analytics (5) · security guardium key lifecycle manager (5) | ↑10 | ||
| 6 | code projects | 55 | job recruitment (10) · simple admin panel (10) · online class and exam scheduling system (7) | ↑4 | ||||
| 7 | huawei | 54 | 1 | harmonyos (26) · ips module (7) · ngfw module (7) | ↑18 | |||
| 8 | 48 | 5 | 1 | android (40) · pixel (20) · chrome (7) | ↓6 | |||
| 9 | dell | 35 | 1 | recoverpoint for virtual machines (7) · avamar (3) · ecs (3) | ↑34 | |||
| 10 | phpgurukul | 30 | 1 | land record system (12) · maid hiring management system (7) · complaint management system (5) | ↑7 | |||
| 11 | gstreamer | 29 | gstreamer (29) | · | ||||
| 12 | 1000 projects | 27 | portfolio management system mca (11) · attendance tracking management system (9) · beauty parlour management system (2) | ↑10 | ||||
| 13 | abb | 24 | 14 | 8 | aspect enterprise (24) · matrix series (24) · nexus series (24) | · | ||
| 14 | siemens | 21 | 3 | linux (7) · simatic s7 1500 cpu 1518 4 pn dp mfp (6) · simatic s7 1500 cpu 1518f 4 pn dp mfp (6) | ↓8 | |||
| 15 | qnap systems | 19 | 3 | 2 | qts (10) · quts hero (10) · qulog center (2) | ↑3 | ||
| 16 | autodesk | 18 | navisworks freedom (14) · navisworks manage (14) · navisworks simulate (14) | · | ||||
| 17 | vibethemes | 18 | 11 | wplms (15) · vibebp (3) | new | |||
| 18 | apache | 17 | 6 | 3 | 2 | apache superset (4) · apache tomcat (3) · apache hive (2) | ↑1 | |
| 19 | ivanti | 16 | 5 | connect secure (5) · cloud services application (3) · security controls (2) | ↓11 | |||
| 20 | jetbrains | 15 | 1 | teamcity (9) · youtrack (6) | · | |||
| 21 | mediatek | 15 | 1 | mt6985 (11) · mt6989 (11) · mt6879 (10) | ↑9 | |||
| 22 | image access | 14 | scan2net (14) | new | ||||
| 23 | codezips | 13 | 1 | e commerce site (3) · hospital management system (2) · project management system (2) | ↑19 | |||
| 24 | qualcomm | 13 | snapdragon (13) · fastconnect 6900 firmware (12) · wsa8830 firmware (12) | ↓11 | ||||
| 25 | samsung mobile | 13 | samsung mobile devices (7) · android (4) · gaminghub (3) | ↑6 | ||||
| 26 | gitlab | 12 | gitlab (12) | ↑27 | ||||
| 27 | honor | 12 | magic os (11) · magicos (1) | · | ||||
| 28 | veeam | 12 | 1 | 1 | backup replication (8) · backup and replication (3) · service provider console (3) | · | ||
| 29 | rockwell automation | 11 | 3 | arena (8) · pm1k 1408 bc3a 485 (3) · pm1k 1408 bc3a ent (3) | · | |||
| 30 | sap se | 11 | 1 | sap netweaver as for java adobe document services (3) · sap businessobjects business intelligence platform (1) · sap commerce cloud (1) | ↑41 | |||
| 31 | synology | 11 | synology router manager srm (8) · router manager (5) · surveillance station (2) | · | ||||
| 32 | fortinet | 10 | 2 | 1 | 1 | forticlientlinux (2) · fortimanager (2) · fortios (2) | ↑5 | |
| 33 | progress software | 10 | 4 | whatsup gold (9) · telerik ui for wpf (1) | · | |||
| 34 | qnap | 10 | 3 | 1 | qts (6) · quts hero (6) · hbs 3 (1) | ↑29 | ||
| 35 | redhat | 10 | red hat build of keycloak (3) · red hat jboss enterprise application platform 8 (3) · cryostat 3 (2) | ↓21 | ||||
| 36 | rti | 10 | 1 | connext professional (10) | · | |||
| 37 | ruijie | 10 | 3 | reyee os (10) | · | |||
| 38 | trend micro | 9 | trend micro apex one (7) · trend micro apex one as a service (7) · trend micro deep security (1) | · | ||||
| 39 | ashlar vellum | 8 | cobalt (6) · graphite (2) | · | ||||
| 40 | drupal | 8 | 3 | drupal core (8) | · | |||
| 41 | open robotics | 8 | 3 | nav2 humble (8) · ros2 humble (4) · ros2 navigation2 (4) | · | |||
| 42 | plextrac | 8 | 1 | plextrac (8) | new | |||
| 43 | codeastro | 7 | house rental management system (2) · online food ordering system (2) · blood donor management system (1) | ↑24 | ||||
| 44 | sourcecodester | 7 | phone contact manager system (3) · best house rental management system (1) · kortex lite advocate office management system (1) | ↓3 | ||||
| 45 | tecnick | 7 | 2 | tcpdf (5) · tcexam (2) | new | |||
| 46 | wpdeveloper | 7 | essential blocks for gutenberg (4) · betterdocs (1) · essential addons for elementor (1) | · | ||||
| 47 | brandtoss | 6 | wp mailster (6) · mailster (1) · wpmailster (1) | new | ||||
| 48 | chunghwa telecom | 6 | 1 | 1 | tbm client (2) · tenderdoctransfer (2) · topm client (2) | · | ||
| 49 | element hq | 6 | synapse (6) | new | ||||
| 50 | hanwha vision co | 6 | xrn 420s (6) | new |
One CVE is counted once per vendor, product or weakness class it lists, so a ranking column sums to more than the month's total. Only the month's top 100 keys per dimension are stored. The KEV column counts CVEs published in 2024-12 that are on the CISA KEV catalog today. The 16 in the headline is what CISA listed during the month, whenever those CVEs were published. All 50 ranked vendors are listed; a zero count renders as a dot.
Weaknesses
CWE classes by distinct CVEs
- 1CWE-796809 critical—
- 2CWE-86242011 critical—
- 3CWE-8924058 critical—
- 4CWE-3521693 critical↑7
- 5CWE-9411118 critical↑7
- 6CWE-741050 critical↑2
- 7CWE-1251013 critical↓3
- 8CWE-41610113 critical↑2
- 9CWE-4761011 critical↑7
- 10CWE-787853 critical↓5
- 1CWE-22557 critical↓2
- 2CWE-200491 critical↑7
- 3CWE-4344717 critical—
- 4CWE-120406 critical↓7
- 5CWE-284402 critical↑3
- 6CWE-20391 critical↓2
- 7CWE-78385 critical↓11
- 8CWE-122331 critical↓3
- 9CWE-863335 critical↑6
- 10CWE-639300 critical↑4
One CVE is counted once per vendor, product or weakness class it lists, so a ranking column sums to more than the month's total. Only the month's top 100 keys per dimension are stored.