CVE Tools
Sign in
month report

December 2019

Data as of Jun 11, 2026, 06:05 UTCSnapshot v1 Sources CVEList V5+NVD+GHSA+CSAF+FSTEC BDU+CISA KEV+EPSS+Nuclei templates Methodology →

December 2019 closed with 1,881 published CVEs. 254 criticals, apple led volume, mostly via iphone os. Top weakness class — CWE-787 (229 CVE). 10 vendors cracked the top-100 for the first time.

Print view
Total CVEs
1,881
— MoM— YoY
Severity mix
254 / 664
critical / high
KEV added
0
0 ransomware-linked
Nuclei coverage
4.1%
77 CVEs with templates

Time to exploit

How fast the community ships detection after a CVE drops.

Days → Nuclei (median)
2262.8
n=77
Within 7 days
0.0%
Within 30 days
0.0%
Days → KEV (median)
849
n=20
Detection gap

KEV pressure, no Nuclei coverage

December 2019 · vendors with active exploitation listed by CISA but no public detection template.

Weakness × Vendor

What's spreading where in December 2019

Cells shaded by share of vendor's hottest weakness. Click any cell to open the CWE history.

787Out-of-bounds Write79XSS125Out-of-bounds Read20Improper Input Validation416Use After Free287Improper Authentication200Information Exposure352CSRF476NULL Pointer Dereference120Buffer Overflowapple109111924145314сообщество свободного программного обеспечения6111177293219novell inc.6368524225debian2111106143471ооо «русбитех-астра»22115210227fedoraproject1949262542redhat2674442233ао «концерн вниинс»232957124siemens2222115713opensuse111739151red hat inc.201334222ао «ивк»111716123

Most discussed CVEs — December 2019

No CVE mentions in the news this month yet.

First time in top-100

Vendors never in top-100 in the prior 24 periods.

Top vendors

Ranked by distinct CVE count this period.

  • 1apple—
    248 CVE16 critCVSS 8.0
    NEWKEV 5
    iphone os (165) · ios (162) · mac os x (144)
  • 2сообщество свободного программного обеспечения—
    214 CVE13 critCVSS 7.1
    NEWKEV 2Nuclei 8PoC 44
    debian gnu/linux (175) · linux (40) · webkitgtk (32)
  • 3novell inc.—
    165 CVE5 critCVSS 7.9
    NEWKEV 1Nuclei 1PoC 17
    opensuse leap (149) · suse linux enterprise desktop (58) · suse linux enterprise server (56)
  • 4debian—
    159 CVE18 critCVSS 6.8
    NEWNuclei 6PoC 28
    debian linux (159) · devscripts (1) · debian edu (1)
  • 5redhat—
    133 CVE9 critCVSS 7.3
    NEWKEV 2Nuclei 1PoC 9
    red hat enterprise linux (70) · enterprise linux workstation (56) · enterprise linux desktop (56)
  • 6ооо «русбитех-астра»—
    116 CVE8 critCVSS 7.0
    NEWNuclei 1PoC 25
    astra linux special edition (109) · astra linux special edition для «эльбрус» (38) · astra linux common edition (12)
  • 7fedoraproject—
    111 CVE4 critCVSS 6.8
    NEWKEV 1Nuclei 2PoC 15
    fedora (110) · sectool (1) · sssd (1)
  • 8ао «концерн вниинс»—
    96 CVE4 critCVSS 6.9
    NEWKEV 1Nuclei 1PoC 9
    ос он «стрелец» (96)
  • 9siemens—
    78 CVE26 critCVSS 7.2
    NEWPoC 25
    sppa-t3000 ms3000 migration server (35) · sppa-t3000 application server (18) · sinec infrastructure network services (9)
  • 10opensuse—
    74 CVE6 critCVSS 7.0
    NEWNuclei 1PoC 18
    leap (64) · backports sle (18) · opensuse (7)
  • 11canonical—
    67 CVE6 critCVSS 6.7
    NEWKEV 1Nuclei 3PoC 15
    ubuntu linux (45) · ubuntu (44) · ubuntu cobbler (1)
  • 12ао «ивк»—
    65 CVE1 critCVSS 6.7
    NEWPoC 5
    альт 8 сп (65)
  • 13fedora project—
    61 CVE2 critCVSS 6.9
    NEWKEV 1Nuclei 1PoC 4
    fedora (61)
  • 14google—
    59 CVE1 critCVSS 6.8
    NEWNuclei 1PoC 2
    chrome (41) · google chrome (37) · android (16)
  • 15qualcomm—
    48 CVE12 critCVSS 8.2
    NEW
    qcs605 firmware (42) · sdm660 firmware (41) · sm8150 firmware (40)
  • 16qualcomm, inc.—
    48 CVE12 critCVSS 8.0
    NEW
    snapdragon auto, snapdragon compute, snapdragon consumer iot, snapdragon industrial iot, snapdragon iot, snapdragon mobile, snapdragon voice & music, snapdragon wearables (8) · snapdragon auto, snapdragon consumer electronics connectivity, snapdragon consumer iot, snapdragon industrial iot, snapdragon mobile, snapdragon voice & music (4) · snapdragon auto, snapdragon compute, snapdragon consumer electronics connectivity, snapdragon consumer iot, snapdragon industrial iot, snapdragon mobile, snapdragon voice & music, snapdragon wearables (3)
  • 17maven—
    47 CVE4 critCVSS 7.1
    NEWKEV 1Nuclei 2PoC 4
    org.jenkins-ci.plugins:teamconcert (3) · org.jenkins-ci.plugins:websphere-deployer (3) · com.sonyericsson.jenkins.plugins.bfa:build-failure-analyzer (3)
  • 18linux—
    41 CVECVSS 5.9
    NEWPoC 16
    linux kernel (41)
  • 19intel—
    40 CVE2 critCVSS 6.2
    NEW
    intel converged security and manageability engine (13) · converged security management engine firmware (12) · trusted execution engine firmware (11)
  • 20ibm—
    34 CVE4 critCVSS 6.3
    NEWKEV 1Nuclei 1PoC 1
    cloud pak system (8) · financial transaction manager (4) · cognos analytics (4)
  • 21microsoft—
    31 CVECVSS 6.5
    NEWKEV 1PoC 3
    windows (19) · windows server (17) · windows 10 (16)
  • 22oracle—
    30 CVE3 critCVSS 7.7
    NEWKEV 1Nuclei 2PoC 6
    mysql workbench (10) · mysql enterprise monitor (3) · graalvm enterprise edition (3)
  • 23huawei—
    28 CVE1 critCVSS 5.9
    NEW
    s5700 firmware (7) · svn5800-c firmware (5) · svn5600 firmware (5)
  • 24jenkins—
    28 CVECVSS 6.7
    NEW
    websphere deployer (3) · team concert (3) · jenkins websphere deployer plugin (3)
  • 25adobe—
    27 CVE19 critCVSS 9.1
    NEWPoC 1
    acrobat reader dc (21) · acrobat dc (21) · adobe acrobat and reader (21)
  • 26ао "нппкт"—
    27 CVE2 critCVSS 7.1
    NEWPoC 4
    осон основа оnyx (27)
  • 27netapp—
    25 CVE3 critCVSS 6.2
    NEWNuclei 1PoC 6
    cloud backup (18) · steelstore cloud integrated storage (12) · active iq unified manager (12)
  • 28gitlab—
    24 CVECVSS 6.0
    NEWNuclei 4PoC 7
    gitlab (24)
  • 29npm—
    24 CVE6 critCVSS 7.5
    NEWKEV 1Nuclei 2PoC 6
    cli (4) · npm (3) · connect (2)
  • 30apache—
    19 CVE2 critCVSS 7.4
    NEWKEV 1Nuclei 2PoC 4
    olingo (3) · bookkeeper (3) · apache spamassassin (2)
  • 31pypi—
    19 CVE4 critCVSS 6.7
    NEWNuclei 1PoC 3
    waitress (4) · django (2) · python-keystoneclient (2)
  • 32f5—
    16 CVECVSS 5.9
    NEW
    big-ip application security manager (13) · big-ip local traffic manager (13) · big-ip access policy manager (12)
  • 33packagist—
    16 CVE4 critCVSS 6.9
    NEWPoC 12
    contao/core-bundle (3) · typo3/cms (3) · contao/contao (3)
  • 34gpac—
    13 CVECVSS 5.5
    NEWPoC 11
    gpac (13)
  • 35qnap—
    12 CVE7 critCVSS 8.2
    NEWKEV 4Nuclei 3PoC 4
    qts (4) · photo station (3) · music station (2)
  • 36dlink—
    11 CVE2 critCVSS 8.6
    NEWKEV 1Nuclei 1PoC 6
    dba-1510p (2) · dba-1510p firmware (2) · dir-601 firmware (2)
  • 37saitoha—
    11 CVE4 critCVSS 8.5
    NEWPoC 3
    libsixel (11)
  • 38sonicwall—
    11 CVE4 critCVSS 8.3
    NEWKEV 2Nuclei 2
    sma100 (6) · sma 100 firmware (6) · email security appliance (2)
  • 39tenable—
    11 CVE2 critCVSS 5.7
    NEWPoC 3
    securitycenter (5) · tenable.sc (3) · nessus (2)
  • 40barco—
    10 CVE2 critCVSS 7.4
    NEWPoC 1
    clickshare cse-200 firmware (6) · clickshare cse-800 firmware (5) · clickshare cs-100 firmware (5)
  • 41mfscripts—
    10 CVE1 critCVSS 7.0
    NEWPoC 5
    yetishare (10)
  • 42trendmicro—
    10 CVE2 critCVSS 7.8
    NEW
    premium security 2020 (3) · internet security 2020 (3) · trend micro security (consumer) (3)
  • 43amazon—
    9 CVE3 critCVSS 8.7
    NEWPoC 3
    blink xt2 sync module firmware (7) · audible (1) · firecracker (1)
  • 44apache software foundation—
    9 CVE1 critCVSS 7.7
    NEWKEV 1Nuclei 2PoC 3
    spamassassin (2) · tomcat (2) · apache tomcat (2)
  • 45dell—
    9 CVE1 critCVSS 6.6
    NEW
    rsa identity governance and lifecycle (3) · rsa identity governance & lifecycle (3) · command update (2)
  • 46intesync—
    9 CVE5 critCVSS 8.2
    NEWPoC 6
    solismed (9)
  • 47petwant—
    9 CVE7 critCVSS 9.4
    NEWPoC 4
    pf-103 firmware (9)
  • 48sap—
    9 CVE1 critCVSS 7.9
    NEW
    enable now (3) · sap treasury and risk management (2) · businessobjects business intelligence platform (2)
  • 49sap se—
    9 CVE1 critCVSS 7.5
    NEW
    sap enable now (3) · sap treasury and risk management (s4core) (2) · sap treasury and risk management (ea-finserv) (2)
  • 50skymee—
    9 CVE7 critCVSS 9.4
    NEWPoC 4
    petalk ai firmware (9)

Top weaknesses

CWE classes by distinct CVE count.

1CWE-787229—
2CWE-79165—
3CWE-12583—
4CWE-2079—
5CWE-41659—
6CWE-28753—
7CWE-20044—
8CWE-35242—
9CWE-47634—
10CWE-12033—
11CWE-7831—
12CWE-2230—
13CWE-26928—
14CWE-19027—
15CWE-8927—
16CWE-11923—
17CWE-30623—
18CWE-12222—
19CWE-27621—
20CWE-43421—

Sectors

Solution categories ranked by distinct CVE count this period.

  • Operating Systems473 CVE
    141 crit49 KEV47 vendorsCVSS 8.1
    debian gnu/linux (175) · fedora (171) · debian linux (159)
  • Mobile Apps338 CVE
    71 crit38 KEV6 vendorsCVSS 7.9
    ios (218) · tvos (189) · macos (182)
  • OSS Libraries271 CVE
    52 crit3 KEV88 vendorsCVSS 7.5
    gpac (13) · php (12) · libsixel (11)
  • Enterprise Software242 CVE
    61 crit1 KEV60 vendorsCVSS 7.8
    cloud backup (18) · active iq unified manager (12) · steelstore cloud integrated storage (12)
  • Web & CMS Plugins142 CVE
    30 crit2 KEV78 vendorsCVSS 7.5
    wordpress (10) · a-blog cms (4) · backdrop cms (4)
  • Hardware Firmware124 CVE
    588 crit9 KEV20 vendorsCVSS 8.6
    qcs605 firmware (42) · sdm660 firmware (41) · sm8150 firmware (40)
  • ICS / OT / IoT85 CVE
    240 crit2 KEV32 vendorsCVSS 9.2
    pfc 100 firmware (8) · pfc 200 firmware (8) · pb610 panel builder 600 (4)
  • DevTools & CI83 CVE
    3 crit1 KEV19 vendorsCVSS 9.8
    build failure analyzer (3) · jenkins build failure analyzer plugin (3) · jenkins team concert plugin (3)
  • Security Products79 CVE
    11 crit48 vendorsCVSS 8.2
    tigervnc (5) · internet security 2020 (3) · maximum security 2020 (3)
  • Networking Infrastructure75 CVE
    69 crit31 KEV29 vendorsCVSS 8.8
    dl4343 firmware (7) · dba-1510p (4) · zxcloud goldendata vap (3)
  • Cloud & SaaS68 CVE
    22 crit9 KEV31 vendorsCVSS 8.4
    xen (7) · workstation (2) · amanda (1)
  • Consumer Software67 CVE
    107 crit26 vendorsCVSS 8.9
    acrobat dc (21) · acrobat reader dc (21) · adobe acrobat and reader (21)
  • Databases39 CVE
    23 crit5 KEV11 vendorsCVSS 9.8
    sqlite (17) · mysql workbench (12) · mysql enterprise monitor (5)
  • Communications37 CVE
    21 crit28 vendorsCVSS 9.1
    hhvm (3) · armeria (2) · ircd-ratbox (2)
  • AI / ML3 CVE
    3 vendorsCVSS 4.5
    harbor (1) · open source computer vision library (opencv) (1) · tensorflow (1)
  • Unclassified80 CVE
    9 crit52 vendorsCVSS 7.0
    elog (5) · securitycenter (5) · imagegear (4)
Weakness × Sector

Which weaknesses hit which solution categories in December 2019

Cells shaded by share of the sector's hottest weakness. Click a row to open the sector history.

787Out-of-bounds Write79XSS125Out-of-bounds Read20Improper Input Validation416Use After Free287Improper Authentication200Information Exposure352CSRF476NULL Pointer Dereference120Buffer OverflowOperating Systems1503145404414194176OSS Libraries4823216126811133Consumer Software9718131017524Hardware Firmware155152573131213ICS / OT / IoT30544198353Cloud & SaaS73163886612Web & CMS Plugins1472142811Enterprise Software133149Networking Infrastructure784116325DevTools & CI3942251061