CVE Tools
Sign in
month report

September 2020

Data as of Jun 11, 2026, 06:05 UTCSnapshot v1 Sources CVEList V5+NVD+GHSA+CSAF+FSTEC BDU+CISA KEV+EPSS+Nuclei templates Methodology →

September 2020 closed with 2,258 published CVEs. 197 criticals, npm led volume, mostly via swagger-ui. Top weakness class — CWE-506 (322 CVE). 10 vendors cracked the top-100 for the first time.

Print view
Total CVEs
2,258
— MoM— YoY
Severity mix
197 / 634
critical / high
KEV added
0
0 ransomware-linked
Nuclei coverage
3.1%
69 CVEs with templates

Time to exploit

How fast the community ships detection after a CVE drops.

Days → Nuclei (median)
1999.2
n=69
Within 7 days
0.0%
Within 30 days
0.0%
Days → KEV (median)
424
n=8
Detection gap

KEV pressure, no Nuclei coverage

September 2020 · vendors with active exploitation listed by CISA but no public detection template.

Weakness × Vendor

What's spreading where in September 2020

Cells shaded by share of vendor's hottest weakness. Click any cell to open the CWE history.

506CWE-50679XSS787Out-of-bounds Write20Improper Input Validation89SQL Injection125Out-of-bounds Read22Path Traversal416Use After Free1321Prototype Pollution862Missing Authorizationnpm3227015631841google262242282625microsoft136211microsoft corp136211сообщество свободного программного обеспечения42723122debian52744120cisco3243132cisco systems inc.3243132fedoraproject8253217opensuse41910514maven202417ооо «русбитех-астра»22221115

Most discussed CVEs — September 2020

No CVE mentions in the news this month yet.

First time in top-100

Vendors never in top-100 in the prior 24 periods.

Top vendors

Ranked by distinct CVE count this period.

  • 1npm—
    644 CVE19 critCVSS 8.6
    NEWPoC 17
    swagger-ui (8) · handlebars (6) · serve (4)
  • 2google—
    235 CVE18 critCVSS 7.1
    NEWPoC 15
    android (159) · chrome (47) · google chrome (38)
  • 3microsoft—
    131 CVE2 critCVSS 7.0
    NEWKEV 1PoC 1
    windows server 2016 (78) · windows server 2019 (75) · windows server 2004 (server core installation) (75)
  • 4сообщество свободного программного обеспечения—
    110 CVE9 critCVSS 6.9
    NEWKEV 1Nuclei 3PoC 25
    debian gnu/linux (99) · linux (21) · mediawiki (4)
  • 5debian—
    104 CVE7 critCVSS 6.9
    NEWNuclei 1PoC 21
    debian linux (103) · freedombox (1)
  • 6cisco—
    101 CVE2 critCVSS 6.6
    NEWKEV 1PoC 101
    cisco ios xe (45) · ios xe (45) · cisco ios xe software (33)
  • 7fedoraproject—
    95 CVE4 critCVSS 7.1
    NEWNuclei 3PoC 23
    fedora (95)
  • 8opensuse—
    88 CVE7 critCVSS 6.9
    NEWPoC 12
    leap (86) · backports sle (27) · opensuse leap 15.2 (1)
  • 9maven—
    78 CVE3 critCVSS 6.2
    NEWNuclei 5PoC 5
    org.jenkins-ci.plugins:elastest (3) · org.jenkins-ci.plugins:database (3) · org.keycloak:keycloak-parent (3)
  • 10ооо «русбитех-астра»—
    76 CVE4 critCVSS 7.0
    NEWNuclei 2PoC 14
    astra linux special edition (70) · astra linux common edition (49) · astra linux special edition для «эльбрус» (26)
  • 11ао «концерн вниинс»—
    67 CVE4 critCVSS 7.2
    NEWPoC 16
    ос он «стрелец» (67)
  • 12ао "нппкт"—
    67 CVE4 critCVSS 7.1
    NEWNuclei 2PoC 12
    осон основа оnyx (67)
  • 13qualcomm—
    59 CVE8 critCVSS 7.6
    NEW
    sm7150 firmware (49) · sm6150 firmware (49) · sm8150 firmware (47)
  • 14qualcomm, inc.—
    58 CVE8 critCVSS 7.6
    NEW
    snapdragon auto, snapdragon compute, snapdragon connectivity, snapdragon consumer electronics connectivity, snapdragon consumer iot, snapdragon industrial iot, snapdragon mobile, snapdragon voice & music, snapdragon wearables, snapdragon wired infrastructure and networking (10) · snapdragon auto, snapdragon compute, snapdragon consumer iot, snapdragon industrial iot, snapdragon mobile, snapdragon voice & music, snapdragon wearables (7) · snapdragon auto, snapdragon compute, snapdragon connectivity, snapdragon consumer electronics connectivity, snapdragon consumer iot, snapdragon industrial iot, snapdragon mobile, snapdragon voice & music, snapdragon wired infrastructure and networking (6)
  • 15ibm—
    53 CVE1 critCVSS 6.3
    NEW
    data risk manager (12) · infosphere guardium (5) · maximo asset management (4)
  • 16redhat—
    51 CVE1 critCVSS 6.5
    NEWNuclei 1PoC 3
    red hat enterprise linux (22) · enterprise linux (11) · jboss enterprise application platform (4)
  • 17jenkins—
    48 CVE1 critCVSS 5.9
    NEWPoC 3
    elastest (3) · liquibase runner (3) · jenkins liquibase runner plugin (3)
  • 18sap—
    48 CVECVSS 4.8
    NEWPoC 1
    3d visual enterprise viewer (38) · businessobjects business intelligence platform (2) · bank analyzer (1)
  • 19sap se—
    48 CVECVSS 4.8
    NEWPoC 1
    sap 3d visual enterprise viewer (38) · s/4hana fin prod subldgr (1) · sap business objects business intelligence platform (web intelligence html interface) (1)
  • 20novell inc.—
    45 CVE3 critCVSS 6.4
    NEWPoC 7
    opensuse leap (39) · suse linux enterprise server (11) · suse linux enterprise server for sap applications (11)
  • 21fedora project—
    44 CVE3 critCVSS 7.5
    NEWPoC 13
    fedora (44)
  • 22pypi—
    41 CVE4 critCVSS 6.7
    NEWNuclei 2PoC 6
    tensorflow (25) · tensorflow-gpu (25) · tensorflow-cpu (25)
  • 23gitlab—
    39 CVECVSS 5.5
    NEWPoC 4
    gitlab (39)
  • 24canonical—
    38 CVE2 critCVSS 6.5
    NEWNuclei 3PoC 6
    ubuntu linux (33) · ubuntu (19) · ubuntu-ui-toolkit (1)
  • 25os4ed—
    28 CVE8 critCVSS 9.1
    NEWNuclei 8PoC 14
    opensis (28)
  • 26ао «ивк»—
    26 CVE1 critCVSS 7.2
    NEWNuclei 1PoC 4
    альт 8 сп (25) · альт 8 сп сервер (1)
  • 27packagist—
    25 CVE1 critCVSS 6.8
    NEWNuclei 4PoC 13
    mediawiki/core (6) · mantisbt/mantisbt (3) · shopware/core (2)
  • 28tensorflow—
    25 CVE3 critCVSS 6.6
    NEWPoC 5
    tensorflow (25)
  • 29adobe—
    21 CVE5 critCVSS 7.5
    NEW
    experience manager (11) · adobe experience manager (8) · indesign (5)
  • 30linux—
    20 CVECVSS 5.9
    NEWPoC 2
    linux kernel (20)
  • 31observium—
    20 CVE2 critCVSS 7.5
    NEWPoC 5
    observium (20)
  • 32cpanel—
    18 CVE5 critCVSS 7.8
    NEWNuclei 13
    cpanel (18)
  • 33go—
    17 CVE1 critCVSS 5.8
    NEWPoC 3
    helm.sh/helm (4) · helm.sh/helm/v3 (4) · github.com/u-root/u-root (2)
  • 34mcafee—
    17 CVE1 critCVSS 6.0
    NEW
    web gateway (5) · mcafee web gateway (mwg) (5) · mcafee agent (4)
  • 35oracle—
    17 CVE2 critCVSS 7.2
    NEWNuclei 5PoC 4
    communications cloud native core network function cloud native environment (4) · zfs storage appliance kit (4) · mysql enterprise monitor (3)
  • 36trendmicro—
    17 CVE1 critCVSS 7.1
    NEWKEV 1
    apex one (12) · trend micro apex one (12) · trend micro worry-free business security (4)
  • 37apache—
    15 CVE3 critCVSS 7.5
    NEWNuclei 4PoC 3
    superset (2) · struts (2) · activemq (2)
  • 38hyland—
    14 CVE8 critCVSS 8.7
    NEW
    onbase (14)
  • 39philips—
    13 CVECVSS 6.1
    NEW
    patient information center ix (8) · patient information center ix (picix) (7) · clinical collaboration platform (5)
  • 40siemens—
    12 CVE2 critCVSS 7.3
    NEW
    simatic rtls locating manager (3) · simatic hmi united comfort panels firmware (2) · polarion subversion webclient (2)
  • 41broadcom—
    11 CVE4 critCVSS 8.0
    NEW
    fabric operating system (9) · brocade sannav (2)
  • 42crates.io—
    11 CVE3 critCVSS 7.9
    NEWNuclei 1
    sized-chunks (6) · failure (1) · http (1)
  • 43gogogate—
    11 CVE4 critCVSS 8.1
    NEWPoC 2
    ismartgate pro firmware (11)
  • 44ozeki—
    11 CVECVSS 7.0
    NEWPoC 11
    ozeki ng sms gateway (11)
  • 45gradle—
    10 CVECVSS 6.8
    NEW
    enterprise (10) · enterprise cache node (2)
  • 46ingenico—
    10 CVECVSS 6.5
    NEWPoC 4
    telium 2 firmware (10)
  • 47mcafee llc—
    10 CVECVSS 6.8
    NEW
    endpoint security for windows (4) · ma for windows (3) · mvision endpoint (2)
  • 48pexip—
    10 CVE2 critCVSS 7.7
    NEW
    pexip infinity (10) · reverse proxy and turn server (1)
  • 49vbulletin—
    10 CVECVSS 4.8
    NEWPoC 3
    vbulletin (10)
  • 50xen—
    10 CVECVSS 6.2
    NEW
    xen (10)

Top weaknesses

CWE classes by distinct CVE count.

1CWE-506322—
2CWE-79269—
3CWE-787144—
4CWE-20125—
5CWE-8976—
6CWE-12563—
7CWE-2258—
8CWE-41646—
9CWE-132142—
10CWE-86241—
11CWE-35240—
12CWE-40037—
13CWE-43436—
14CWE-7732—
15CWE-28729—
16CWE-11928—
17CWE-12026—
18CWE-19025—
19CWE-7820—
20CWE-86320—

Sectors

Solution categories ranked by distinct CVE count this period.

  • OSS Libraries897 CVE
    49 crit74 vendorsCVSS 9.0
    swagger-ui (8) · handlebars (6) · serve (4)
  • Operating Systems411 CVE
    98 crit10 KEV37 vendorsCVSS 7.6
    fedora (139) · debian linux (103) · debian gnu/linux (99)
  • Mobile Apps249 CVE
    21 crit6 vendorsCVSS 6.8
    android (165) · chrome (47) · google chrome (38)
  • Enterprise Software234 CVE
    39 crit43 vendorsCVSS 8.6
    data risk manager (12) · infosphere guardium (5) · business automation workflow (4)
  • Networking Infrastructure166 CVE
    34 crit41 KEV30 vendorsCVSS 8.7
    cisco ios xe (45) · ios xe (45) · cisco ios xe software (33)
  • Web & CMS Plugins118 CVE
    28 crit49 vendorsCVSS 8.0
    mediawiki (9) · halo (6) · jdownloads (4)
  • DevTools & CI113 CVE
    4 crit11 vendorsCVSS 7.2
    database (3) · elastest (3) · jenkins database plugin (3)
  • Security Products103 CVE
    21 crit10 KEV40 vendorsCVSS 8.4
    apex one (14) · trend micro apex one (12) · worry-free business security (6)
  • Hardware Firmware99 CVE
    291 crit17 vendorsCVSS 7.6
    sm6150 firmware (49) · sm7150 firmware (49) · sm8150 firmware (47)
  • Cloud & SaaS57 CVE
    7 crit22 vendorsCVSS 8.1
    fabric operating system (9) · horizon client (5) · omnissa horizon client (5)
  • ICS / OT / IoT54 CVE
    43 crit19 vendorsCVSS 8.4
    n-tron 702-w firmware (4) · n-tron 702m12-w firmware (4) · scadapack 7x remote connect (4)
  • Communications52 CVE
    13 crit19 vendorsCVSS 8.1
    ozeki ng sms gateway (11) · inspircd (5) · whatsapp (4)
  • Consumer Software48 CVE
    18 crit1 KEV17 vendorsCVSS 8.8
    experience manager (11) · adobe experience manager (8) · adobe indesign (5)
  • AI / ML28 CVE
    3 crit2 vendorsCVSS 6.7
    tensorflow (25) · harbor (1) · nats.deno (1)
  • Databases21 CVE
    14 crit5 vendorsCVSS 7.2
    communications cloud native core network function cloud native environment (4) · communications diameter signaling router (4) · mysql enterprise monitor (4)
  • Unclassified78 CVE
    23 crit57 vendorsCVSS 7.6
    edna enterprise data historian (5) · stock management system (4) · helios glinq (3)
Weakness × Sector

Which weaknesses hit which solution categories in September 2020

Cells shaded by share of the sector's hottest weakness. Click a row to open the sector history.

506CWE-50679XSS787Out-of-bounds Write20Improper Input Validation89SQL Injection125Out-of-bounds Read22Path Traversal416Use After Free1321Prototype Pollution862Missing AuthorizationOSS Libraries322106151268273429Operating Systems227426230433128Enterprise Software5519113357411Networking Infrastructure1944741102Consumer Software105911211211Web & CMS Plugins56216181DevTools & CI24349Hardware Firmware514714371Security Products72818211ICS / OT / IoT7261