CVE Tools
Sign in
month report

March 2020

Data as of Jun 11, 2026, 06:05 UTCSnapshot v1 Sources CVEList V5+NVD+GHSA+CSAF+FSTEC BDU+CISA KEV+EPSS+Nuclei templates Methodology →

March 2020 closed with 1,810 published CVEs. 323 criticals, google led volume, mostly via android. Top weakness class — CWE-79 (278 CVE). 10 vendors cracked the top-100 for the first time.

Print view
Total CVEs
1,810
— MoM— YoY
Severity mix
323 / 732
critical / high
KEV added
0
0 ransomware-linked
Nuclei coverage
4.0%
72 CVEs with templates

Time to exploit

How fast the community ships detection after a CVE drops.

Days → Nuclei (median)
2183.9
n=72
Within 7 days
0.0%
Within 30 days
0.0%
Days → KEV (median)
603
n=20
Detection gap

KEV pressure, no Nuclei coverage

March 2020 · vendors with active exploitation listed by CISA but no public detection template.

Weakness × Vendor

What's spreading where in March 2020

Cells shaded by share of vendor's hottest weakness. Click any cell to open the CWE history.

79XSS787Out-of-bounds Write78OS Command Injection125Out-of-bounds Read352CSRF89SQL Injection20Improper Input Validation120Buffer Overflow306Missing Auth for Critical Func…200Information Exposuregoogle1422375795chadhaajay83127microsoft8201microsoft corp7202сообщество свободного программного обеспечения412342723maven1213243debian21233234ооо «русбитех-астра»1941513gitlab8112qualcomm108314qualcomm, inc.108314ао «концерн вниинс»18311

Most discussed CVEs — March 2020

No CVE mentions in the news this month yet.

First time in top-100

Vendors never in top-100 in the prior 24 periods.

Top vendors

Ranked by distinct CVE count this period.

  • 1google—
    183 CVE43 critCVSS 7.3
    NEWKEV 2PoC 3
    android (170) · google chrome (11) · chrome (10)
  • 2microsoft—
    119 CVE4 critCVSS 7.5
    NEWKEV 2Nuclei 1PoC 3
    windows 10 (80) · windows server 2016 (80) · windows 10 1909 (78)
  • 3chadhaajay—
    118 CVECVSS 4.8
    NEWPoC 62
    phpkb (118)
  • 4сообщество свободного программного обеспечения—
    92 CVE16 critCVSS 7.4
    NEWKEV 3Nuclei 7PoC 24
    debian gnu/linux (74) · linux (5) · rconfig (3)
  • 5maven—
    82 CVE16 critCVSS 7.4
    NEWKEV 1Nuclei 10PoC 4
    com.fasterxml.jackson.core:jackson-databind (12) · org.igniterealtime.openfire:parent (3) · fr.edf.jenkins.plugins:mac (3)
  • 6debian—
    77 CVE16 critCVSS 7.5
    NEWNuclei 4PoC 17
    debian linux (75) · python-apt (2)
  • 7redhat—
    76 CVE9 critCVSS 7.2
    NEWNuclei 3PoC 11
    red hat enterprise linux (22) · ansible (11) · ansible tower (11)
  • 8ооо «русбитех-астра»—
    65 CVE9 critCVSS 7.2
    NEWKEV 2Nuclei 3PoC 18
    astra linux special edition (51) · astra linux common edition (27) · astra linux special edition для «эльбрус» (18)
  • 9gitlab—
    51 CVE7 critCVSS 6.5
    NEW
    gitlab (51)
  • 10qualcomm—
    47 CVE23 critCVSS 8.8
    NEW
    sm8150 firmware (43) · sxr1130 firmware (40) · qcs605 firmware (39)
  • 11qualcomm, inc.—
    47 CVE23 critCVSS 8.6
    NEW
    snapdragon auto, snapdragon compute, snapdragon consumer iot, snapdragon industrial iot, snapdragon iot, snapdragon mobile, snapdragon voice & music, snapdragon wearables (8) · snapdragon auto, snapdragon compute, snapdragon connectivity, snapdragon consumer electronics connectivity, snapdragon consumer iot, snapdragon industrial iot, snapdragon iot, snapdragon mobile, snapdragon voice & music, snapdragon wired infrastructure and networking (4) · snapdragon auto, snapdragon compute, snapdragon connectivity, snapdragon consumer electronics connectivity, snapdragon consumer iot, snapdragon industrial iot, snapdragon mobile, snapdragon voice & music, snapdragon wired infrastructure and networking (4)
  • 12ао «концерн вниинс»—
    47 CVE8 critCVSS 7.9
    NEWKEV 1Nuclei 2PoC 14
    ос он «стрелец» (47)
  • 13fedoraproject—
    46 CVE6 critCVSS 7.0
    NEWNuclei 1PoC 13
    fedora (46)
  • 14adobe—
    42 CVE17 critCVSS 8.8
    NEW
    photoshop 2020 (22) · photoshop cc (22) · adobe photoshop (22)
  • 15opensuse—
    39 CVE3 critCVSS 7.0
    NEWPoC 10
    leap (29) · backports sle (17) · factory (3)
  • 16jenkins—
    38 CVECVSS 6.3
    NEWNuclei 1
    jenkins (4) · mac (3) · jenkins mac plugin (3)
  • 17npm—
    34 CVE11 critCVSS 7.8
    NEWNuclei 1PoC 6
    bson (2) · vp-toolkit (2) · blamer (2)
  • 18ibm—
    33 CVE1 critCVSS 6.6
    NEW
    tivoli netcool\/impact (6) · spectrum protect plus (6) · tivoli netcool impact (6)
  • 19packagist—
    32 CVE6 critCVSS 6.9
    NEWNuclei 6PoC 14
    moodle/moodle (5) · dolibarr/dolibarr (4) · froxlor/froxlor (3)
  • 20wago—
    32 CVE2 critCVSS 7.3
    NEWPoC 13
    pfc200 firmware (28) · wago pfc200 (13) · wago pfc200 firmware (12)
  • 21canonical—
    31 CVE6 critCVSS 7.2
    NEWKEV 1Nuclei 1PoC 5
    ubuntu linux (26) · ubuntu (16) · python-apt (2)
  • 22pypi—
    31 CVE6 critCVSS 6.7
    NEWNuclei 1PoC 7
    ansible (11) · twisted (3) · python-apt (2)
  • 23intel—
    29 CVECVSS 5.8
    NEWPoC 1
    intel graphics driver (17) · graphics driver (17) · intel(r) graphics drivers (16)
  • 24novell inc.—
    29 CVE1 critCVSS 7.5
    NEWNuclei 1PoC 5
    opensuse leap (25) · suse package hub for suse linux enterprise (10) · suse linux enterprise server for sap applications (4)
  • 25fedora project—
    25 CVE4 critCVSS 7.8
    NEWNuclei 1PoC 6
    fedora (25)
  • 26moxa inc.—
    25 CVE10 critCVSS 8.2
    NEW
    moxa mgate mb3270 (10) · moxa mgate mb3170 (10) · moxa mgate mb3180 (10)
  • 27mozilla—
    25 CVE2 critCVSS 7.7
    NEWKEV 1PoC 5
    firefox (19) · thunderbird (15) · firefox esr (13)
  • 28moxa—
    24 CVE9 critCVSS 8.4
    NEW
    mb3480 firmware (9) · mb3280 firmware (9) · mb3270 firmware (9)
  • 29oracle—
    24 CVE10 critCVSS 8.9
    NEWNuclei 2PoC 3
    jd edwards enterpriseone tools (11) · oracle agile plm (11) · weblogic server (11)
  • 30onap—
    21 CVE17 critCVSS 9.4
    NEWPoC 9
    open network automation platform (21)
  • 31dlink—
    20 CVE1 critCVSS 8.2
    NEWKEV 2PoC 14
    dsl-2680 firmware (5) · dir-825 firmware (4) · dir-825 (4)
  • 32ао «ивк»—
    20 CVE1 critCVSS 6.6
    NEWKEV 1PoC 4
    альт 8 сп (20)
  • 33cisco—
    19 CVE1 critCVSS 6.8
    NEWPoC 18
    sd-wan firmware (5) · cisco sd-wan (5) · cisco webex meetings (4)
  • 34cpanel—
    19 CVE5 critCVSS 7.1
    NEW
    cpanel (19)
  • 35nuget—
    19 CVE1 critCVSS 7.7
    NEW
    microsoft.chakracore (15) · sustainsys.saml2 (1) · umbracocms (1)
  • 36ао "нппкт"—
    18 CVE4 critCVSS 6.7
    NEWPoC 3
    осон основа оnyx (18)
  • 37ооо «ред софт»—
    18 CVE6 critCVSS 7.7
    NEWNuclei 2PoC 10
    ред ос (18) · goslinux (1)
  • 38netapp—
    17 CVE4 critCVSS 7.9
    NEWNuclei 3PoC 1
    steelstore cloud integrated storage (10) · active iq unified manager (4) · cloud backup (2)
  • 39sap—
    17 CVE3 critCVSS 6.8
    NEWKEV 1Nuclei 3PoC 2
    commerce cloud (2) · sap solution manager (2) · solution manager (2)
  • 40siemens—
    17 CVECVSS 7.1
    NEW
    sinvr 3 central control server (10) · sinvr 3 video server (10) · control center server (ccs) (6)
  • 41suse—
    17 CVECVSS 7.6
    NEWPoC 6
    suse linux enterprise server (7) · suse linux enterprise desktop (7) · suse linux enterprise server 15 (5)
  • 42sap se—
    16 CVE3 critCVSS 6.3
    NEWKEV 1Nuclei 3PoC 1
    sap enable now (2) · sap businessobjects mobile (mobilebiservice) (1) · sap cloud platform integration for data services (1)
  • 43fortinet—
    15 CVE1 critCVSS 7.6
    NEWNuclei 1
    fortiweb (3) · fortibalancer 1000 firmware (3) · fortibalancer 2000 firmware (3)
  • 44go—
    15 CVE1 critCVSS 7.1
    NEWPoC 3
    github.com/goharbor/harbor (4) · github.com/hashicorp/vault (2) · github.com/facebook/fbthrift (1)
  • 45apache—
    14 CVE8 critCVSS 8.0
    NEWNuclei 1
    traffic server (3) · tika (2) · geode (2)
  • 46dell—
    14 CVE2 critCVSS 7.3
    NEW
    xtremio management server (3) · xtremio (3) · rsa authentication manager (2)
  • 47huawei—
    14 CVECVSS 6.5
    NEWKEV 1
    mate 30 pro firmware (4) · mate 20 firmware (4) · osca-550a firmware (1)
  • 48[unknown]—
    13 CVE1 critCVSS 5.9
    NEWNuclei 2
    moodle (5) · pki-core (3) · openshift/mediawiki (1)
  • 49fasterxml—
    12 CVE5 critCVSS 9.2
    NEWNuclei 2PoC 1
    jackson-databind (12)
  • 50kyocera—
    12 CVE4 critCVSS 8.3
    NEW
    ecosys m5526cdw firmware (12)

Top weaknesses

CWE classes by distinct CVE count.

1CWE-79278—
2CWE-787143—
3CWE-7875—
4CWE-12564—
5CWE-35260—
6CWE-8956—
7CWE-2053—
8CWE-12050—
9CWE-30646—
10CWE-20040—
11CWE-2237—
12CWE-28731—
13CWE-86230—
14CWE-41629—
15CWE-43429—
16CWE-26926—
17CWE-50224—
18CWE-31923—
19CWE-47623—
20CWE-9419—

Sectors

Solution categories ranked by distinct CVE count this period.

  • Operating Systems369 CVE
    236 crit106 KEV41 vendorsCVSS 8.1
    debian linux (75) · debian gnu/linux (74) · fedora (71)
  • OSS Libraries297 CVE
    72 crit1 KEV65 vendorsCVSS 7.8
    com.fasterxml.jackson.core:jackson-databind (12) · fr.edf.jenkins.plugins:mac (3) · org.igniterealtime.openfire:parent (3)
  • Enterprise Software272 CVE
    49 crit5 KEV61 vendorsCVSS 7.9
    otrs (13) · steelstore cloud integrated storage (10) · centreon (9)
  • Web & CMS Plugins230 CVE
    102 crit1 KEV70 vendorsCVSS 9.8
    phpkb (118) · phpbb (2) · bookstack (1)
  • Mobile Apps201 CVE
    48 crit32 KEV5 vendorsCVSS 7.2
    android (175) · google chrome (11) · chrome (10)
  • Hardware Firmware169 CVE
    1,276 crit32 vendorsCVSS 9.2
    sm8150 firmware (43) · sxr1130 firmware (40) · qcs605 firmware (39)
  • Consumer Software108 CVE
    128 crit5 KEV26 vendorsCVSS 8.6
    photoshop 2020 (36) · adobe photoshop (22) · photoshop cc (22)
  • DevTools & CI108 CVE
    13 crit23 vendorsCVSS 9.8
    gitlab (52)
  • Networking Infrastructure107 CVE
    106 crit72 KEV30 vendorsCVSS 9.7
    ac1750 firmware (8) · archer a7 (8) · vigor2960 firmware (6)
  • ICS / OT / IoT106 CVE
    296 crit26 vendorsCVSS 9.8
    pfc200 firmware (28) · wago pfc200 (13) · wago pfc200 firmware (12)
  • Security Products88 CVE
    22 crit15 KEV40 vendorsCVSS 8.2
    apex one (7) · worry-free business security (6) · officescan (5)
  • Cloud & SaaS76 CVE
    21 crit6 KEV28 vendorsCVSS 8.7
    open network automation platform (21) · vmware harbor registry (4) · reactor netty (2)
  • Communications43 CVE
    13 crit2 KEV18 vendorsCVSS 7.4
    openfire (4) · facebook thrift (3) · hhvm (3)
  • Databases40 CVE
    157 crit13 vendorsCVSS 8.9
    jd edwards enterpriseone tools (22) · primavera unifier (21) · weblogic server (21)
  • AI / ML7 CVE
    1 crit1 vendorsCVSS 7.7
    harbor (4) · dojo (1) · dojox (1)
  • Unclassified61 CVE
    11 crit1 KEV30 vendorsCVSS 7.2
    libmicrodns (7) · moodle (5) · bitcoin core (4)
Weakness × Sector

Which weaknesses hit which solution categories in March 2020

Cells shaded by share of the sector's hottest weakness. Click a row to open the sector history.

79XSS787Out-of-bounds Write78OS Command Injection125Out-of-bounds Read352CSRF89SQL Injection20Improper Input Validation120Buffer Overflow306Missing Auth for Critical Func…200Information ExposureOperating Systems1776228111311914OSS Libraries29181367131136Enterprise Software6941119147810Web & CMS Plugins111433931Hardware Firmware11216115182936Consumer Software6522183112DevTools & CI206446115ICS / OT / IoT717151115312Networking Infrastructure1110201536253Security Products1812122212