CVE Tools
Sign in
month report

February 2020

Data as of Jun 11, 2026, 06:05 UTCSnapshot v1 Sources CVEList V5+NVD+GHSA+CSAF+FSTEC BDU+CISA KEV+EPSS+Nuclei templates Methodology →

February 2020 closed with 1,491 published CVEs. 227 criticals, microsoft led volume, mostly via windows server 2016. Top weakness class — CWE-79 (165 CVE). 10 vendors cracked the top-100 for the first time.

Print view
Total CVEs
1,491
— MoM— YoY
Severity mix
227 / 614
critical / high
KEV added
0
0 ransomware-linked
Nuclei coverage
6.8%
101 CVEs with templates

Time to exploit

How fast the community ships detection after a CVE drops.

Days → Nuclei (median)
2213.9
n=101
Within 7 days
0.0%
Within 30 days
0.0%
Days → KEV (median)
637
n=16
Detection gap

KEV pressure, no Nuclei coverage

February 2020 · vendors with active exploitation listed by CISA but no public detection template.

Weakness × Vendor

What's spreading where in February 2020

Cells shaded by share of vendor's hottest weakness. Click any cell to open the CWE history.

79XSS787Out-of-bounds Write20Improper Input Validation78OS Command Injection352CSRF287Improper Authentication125Out-of-bounds Read89SQL Injection200Information Exposure416Use After Freemicrosoft282111microsoft corp282111сообщество свободного программного обеспечения310821117debian3742627opensuse4910254fedoraproject2854517ооо «русбитех-астра»31081613google2147237redhat3461124ibm4152141novell inc.88165apple115661

Most discussed CVEs — February 2020

No CVE mentions in the news this month yet.

First time in top-100

Vendors never in top-100 in the prior 24 periods.

Top vendors

Ranked by distinct CVE count this period.

  • 1microsoft—
    101 CVECVSS 7.3
    NEWKEV 4Nuclei 1PoC 6
    windows server 2016 (82) · windows 10 (79) · windows server 2019 (78)
  • 2сообщество свободного программного обеспечения—
    84 CVE10 critCVSS 7.5
    NEWKEV 2Nuclei 5PoC 16
    debian gnu/linux (75) · linux (6) · coturn (2)
  • 3debian—
    80 CVE12 critCVSS 7.5
    NEWKEV 2Nuclei 7PoC 22
    debian linux (80) · x11-common (1)
  • 4opensuse—
    79 CVE5 critCVSS 7.1
    NEWKEV 1Nuclei 5PoC 15
    leap (47) · backports sle (32) · backports (3)
  • 5redhat—
    77 CVE12 critCVSS 7.7
    NEWKEV 1Nuclei 3PoC 13
    red hat enterprise linux (36) · enterprise linux workstation (32) · enterprise linux server (31)
  • 6fedoraproject—
    72 CVE11 critCVSS 7.7
    NEWKEV 2Nuclei 6PoC 21
    fedora (72) · extra packages for enterprise linux (1)
  • 7google—
    67 CVE1 critCVSS 7.4
    NEWKEV 1PoC 12
    chrome (42) · google chrome (40) · android (22)
  • 8ооо «русбитех-астра»—
    67 CVE5 critCVSS 7.4
    NEWKEV 2Nuclei 3PoC 13
    astra linux special edition (51) · astra linux common edition (23) · astra linux special edition для «эльбрус» (15)
  • 9canonical—
    64 CVE3 critCVSS 6.7
    NEWNuclei 2PoC 11
    ubuntu (45) · ubuntu linux (39) · apport (4)
  • 10ibm—
    53 CVE8 critCVSS 6.7
    NEW
    spectrum protect plus (6) · security directory server (6) · db2 for linux- unix and windows (5)
  • 11novell inc.—
    52 CVE4 critCVSS 7.3
    NEWKEV 1Nuclei 2PoC 6
    opensuse leap (48) · suse package hub for suse linux enterprise (21) · suse linux enterprise server for sap applications (5)
  • 12apple—
    51 CVE1 critCVSS 7.2
    NEWKEV 1Nuclei 1PoC 5
    iphone os (34) · ipados (32) · ios (31)
  • 13ао «ивк»—
    49 CVE3 critCVSS 7.5
    NEWKEV 1Nuclei 2PoC 4
    альт 8 сп (49)
  • 14ао «концерн вниинс»—
    49 CVE4 critCVSS 7.5
    NEWKEV 2Nuclei 2PoC 7
    ос он «стрелец» (49)
  • 15cisco—
    46 CVE2 critCVSS 7.2
    NEWKEV 2PoC 41
    nx-os (8) · linksys e4200 firmware (6) · ucs manager (6)
  • 16adobe—
    45 CVE14 critCVSS 8.9
    NEWPoC 1
    adobe framemaker (21) · framemaker (21) · adobe acrobat 2015 (17)
  • 17fedora project—
    42 CVE4 critCVSS 7.6
    NEWKEV 1Nuclei 2PoC 7
    fedora (42)
  • 18maven—
    40 CVE4 critCVSS 6.7
    NEWKEV 1Nuclei 3PoC 3
    org.apache.tomcat.embed:tomcat-embed-core (3) · org.jenkins-ci.plugins:pipeline-githubnotify-step (2) · org.apache.tomcat:tomcat (2)
  • 19npm—
    37 CVE17 critCVSS 8.0
    NEWNuclei 1PoC 12
    auth0-lock (1) · bodymen (1) · codecov (1)
  • 20huawei—
    34 CVE1 critCVSS 6.9
    NEWPoC 1
    secospace usg6600 firmware (17) · usg9500 firmware (17) · nip6800 firmware (16)
  • 21jenkins—
    26 CVECVSS 6.4
    NEWNuclei 1
    jenkins pipeline github notify step plugin (3) · pipeline github notify step (3) · git parameter (2)
  • 22suse—
    23 CVECVSS 7.0
    NEWPoC 7
    package hub (20) · suse linux enterprise server (1) · suse linux enterprise server 12 (1)
  • 23nextcloud—
    21 CVECVSS 5.1
    NEWPoC 2
    nextcloud server (15) · nextcloud (4) · talk (2)
  • 24foxitsoftware—
    18 CVECVSS 7.5
    NEW
    phantompdf (18) · reader (14)
  • 25gitlab—
    18 CVE1 critCVSS 6.3
    NEW
    gitlab (18)
  • 26netapp—
    16 CVE3 critCVSS 6.9
    NEWKEV 1Nuclei 1PoC 2
    active iq unified manager (6) · data availability services (6) · steelstore cloud integrated storage (5)
  • 27packagist—
    16 CVE2 critCVSS 7.4
    NEWNuclei 3PoC 9
    silverstripe/framework (2) · moodle/moodle (2) · zendframework/zend-db (1)
  • 28ао "нппкт"—
    15 CVE1 critCVSS 7.6
    NEWNuclei 1PoC 2
    осон основа оnyx (15)
  • 29moxa—
    14 CVE1 critCVSS 7.9
    NEWPoC 4
    awk-3131a firmware (12) · iologik 2512 firmware (1) · iologik 2512-hspa firmware (1)
  • 30moxa inc.—
    14 CVE1 critCVSS 8.2
    NEWPoC 4
    moxa awk-3131a (12) · moxa ioxpress configuration utility (1) · moxa mgate 5105-mb-eip (1)
  • 31qualcomm—
    14 CVE3 critCVSS 8.3
    NEW
    qcs605 firmware (12) · sm8150 firmware (11) · sdm439 firmware (11)
  • 32qualcomm, inc.—
    14 CVE3 critCVSS 8.1
    NEW
    snapdragon auto, snapdragon compute, snapdragon consumer iot, snapdragon industrial iot, snapdragon iot, snapdragon mobile, snapdragon voice & music, snapdragon wearables (2) · snapdragon auto, snapdragon compute, snapdragon connectivity, snapdragon consumer iot, snapdragon industrial iot, snapdragon iot, snapdragon mobile, snapdragon voice & music, snapdragon wearables (2) · snapdragon auto, snapdragon compute, snapdragon consumer iot, snapdragon industrial iot, snapdragon mobile, snapdragon voice & music, snapdragon wearables (2)
  • 33sap—
    14 CVE1 critCVSS 6.5
    NEWNuclei 1
    netweaver (4) · s\/4hana (2) · host agent (2)
  • 34atlassian—
    13 CVECVSS 5.3
    NEWNuclei 5PoC 1
    jira server (10) · jira data center (7) · jira (4)
  • 35dlink—
    13 CVE5 critCVSS 8.9
    NEWPoC 6
    dir-100 firmware (5) · dch-m225 (2) · dsr-250n firmware (2)
  • 36maxum—
    13 CVECVSS 6.2
    NEWNuclei 1PoC 11
    rumpus ftp (8) · rumpus (5)
  • 37pypi—
    13 CVE8 critCVSS 8.0
    NEWNuclei 2PoC 2
    ansible (7) · django (1) · mercurial (1)
  • 38sap se—
    13 CVECVSS 6.5
    NEWNuclei 1
    sap host agent (2) · sap netweaver (sap basis) (2) · sap landscape management (2)
  • 39symantec—
    13 CVECVSS 6.0
    NEW
    endpoint protection (7) · endpoint protection manager (5) · data loss prevention enforce\/detection servers (1)
  • 40linux—
    12 CVECVSS 6.3
    NEWPoC 2
    linux kernel (12)
  • 41oracle—
    11 CVE4 critCVSS 6.7
    NEWKEV 1Nuclei 4PoC 2
    instantis enterprisetrack (3) · agile engineering data management (3) · communications instant messaging server (3)
  • 42rubygems—
    10 CVE2 critCVSS 7.5
    NEWPoC 9
    rake (1) · user_agent_parser (1) · moped (1)
  • 43apache—
    9 CVE2 critCVSS 7.2
    NEWKEV 1Nuclei 1PoC 1
    apache tomcat (3) · tomcat (3) · camel (1)
  • 44broadcom—
    9 CVE2 critCVSS 6.2
    NEWPoC 3
    unified infrastructure management (3) · bcm4339 firmware (2) · fabric operating system (2)
  • 45ibm corp.—
    9 CVE3 critCVSS 7.3
    NEW
    ibm db2 (4) · ibm db2 connect server (3) · ibm spectrum protect plus (3)
  • 46linuxfoundation—
    9 CVE1 critCVSS 7.5
    NEW
    open network operating system (6) · dojox (1) · runc (1)
  • 47netsweeper—
    9 CVE3 critCVSS 7.2
    NEWNuclei 9PoC 9
    netsweeper (9)
  • 48seling—
    9 CVE1 critCVSS 7.0
    NEWPoC 3
    visual access manager (9)
  • 49siemens—
    9 CVECVSS 7.1
    NEW
    scalance s623 (3) · scalance s612 (3) · scalance s627-2m (3)
  • 50accusoft—
    8 CVECVSS 8.8
    NEWPoC 3
    imagegear (8)

Top weaknesses

CWE classes by distinct CVE count.

1CWE-79165—
2CWE-787118—
3CWE-2067—
4CWE-7861—
5CWE-35253—
6CWE-28746—
7CWE-12545—
8CWE-8945—
9CWE-20044—
10CWE-41629—
11CWE-2228—
12CWE-40026—
13CWE-7424—
14CWE-12023—
15CWE-52221—
16CWE-43416—
17CWE-27615—
18CWE-79815—
19CWE-26913—
20CWE-86212—

Sectors

Solution categories ranked by distinct CVE count this period.

  • Operating Systems336 CVE
    124 crit99 KEV44 vendorsCVSS 8.0
    fedora (114) · debian linux (80) · debian gnu/linux (75)
  • Enterprise Software201 CVE
    54 crit2 KEV69 vendorsCVSS 9.3
    jira server (10) · jira data center (7) · active iq unified manager (6)
  • OSS Libraries200 CVE
    68 crit1 KEV72 vendorsCVSS 8.1
    php (14) · node.js (6) · imagemagick (5)
  • Mobile Apps157 CVE
    5 crit14 KEV8 vendorsCVSS 7.2
    chrome (42) · google chrome (40) · android (22)
  • Web & CMS Plugins156 CVE
    46 crit4 KEV116 vendorsCVSS 8.8
    tomcat (6) · joomla\! (4) · apache tomcat (3)
  • Networking Infrastructure137 CVE
    52 crit13 KEV44 vendorsCVSS 9.8
    nx-os (15) · cisco data center network manager (7) · linksys e4200 firmware (7)
  • Security Products102 CVE
    16 crit45 vendorsCVSS 7.7
    endpoint protection (8) · endpoint protection manager (5) · antivirus pro (2)
  • Consumer Software101 CVE
    110 crit20 vendorsCVSS 8.7
    adobe framemaker (41) · phantompdf (28) · reader (22)
  • Hardware Firmware74 CVE
    153 crit32 vendorsCVSS 8.2
    syncserver s100 firmware (7) · syncserver s200 firmware (7) · syncserver s250 firmware (7)
  • Cloud & SaaS67 CVE
    11 crit28 vendorsCVSS 7.6
    nextcloud server (15) · nextcloud (4) · moveit transfer (2)
  • ICS / OT / IoT65 CVE
    236 crit32 vendorsCVSS 9.2
    awk-3131a firmware (12) · moxa awk-3131a (12) · vantage velocity firmware (4)
  • DevTools & CI54 CVE
    5 crit15 vendorsCVSS 8.0
    jenkins (3) · jenkins pipeline github notify step plugin (3) · pipeline github notify step (3)
  • Communications35 CVE
    13 crit4 KEV31 vendorsCVSS 8.4
    zimbra collaboration suite (3) · dovecot (2) · opensmtpd (2)
  • Databases28 CVE
    33 crit21 KEV14 vendorsCVSS 9.3
    agile engineering data management (6) · communications instant messaging server (6) · mysql enterprise monitor (6)
  • AI / ML9 CVE
    1 crit1 vendorsCVSS 7.5
    open network operating system (6) · dojox (1) · runc (1)
  • Unclassified75 CVE
    16 crit2 KEV44 vendorsCVSS 7.7
    imagegear (8) · soplanning (6) · eyesofnetwork (5)
Weakness × Sector

Which weaknesses hit which solution categories in February 2020

Cells shaded by share of the sector's hottest weakness. Click a row to open the sector history.

79XSS787Out-of-bounds Write20Improper Input Validation78OS Command Injection352CSRF287Improper Authentication125Out-of-bounds Read89SQL Injection200Information Exposure416Use After FreeOperating Systems9482654202714OSS Libraries22131516310453Consumer Software116371132112518Networking Infrastructure181011186128361Enterprise Software3251097147Web & CMS Plugins53611551310Security Products144463113421Hardware Firmware77416364ICS / OT / IoT5748155212DevTools & CI103522121