CVE Tools
Sign in
month report

October 2020

Data as of Jun 11, 2026, 06:05 UTCSnapshot v1 Sources CVEList V5+NVD+GHSA+CSAF+FSTEC BDU+CISA KEV+EPSS+Nuclei templates Methodology →

October 2020 closed with 1,621 published CVEs. 207 criticals, apple led volume, mostly via macos. Biggest breakout: hp at ×13.4 their 12-month median. Top weakness class — CWE-79 (147 CVE). 10 vendors cracked the top-100 for the first time.

Print view
Total CVEs
1,621
— MoM— YoY
Severity mix
207 / 701
critical / high
KEV added
0
0 ransomware-linked
Nuclei coverage
4.6%
75 CVEs with templates

Time to exploit

How fast the community ships detection after a CVE drops.

Days → Nuclei (median)
1962.3
n=75
Within 7 days
0.0%
Within 30 days
0.0%
Days → KEV (median)
422
n=14
Detection gap

KEV pressure, no Nuclei coverage

October 2020 · vendors with active exploitation listed by CISA but no public detection template.

Weakness × Vendor

What's spreading where in October 2020

Cells shaded by share of vendor's hottest weakness. Click any cell to open the CWE history.

79XSS787Out-of-bounds Write20Improper Input Validation125Out-of-bounds Read917Expression Language Injection120Buffer Overflow400Resource Consumption22Path Traversal416Use After Free78OS Command Injectionapple467192613327oracle11111oracle corp.11oracle corporation11microsoft corp66311microsoft66311сообщество свободного программного обеспечения4454215hp1258debian56317netapp4cisco1081124cisco systems inc.1091124

Most discussed CVEs — October 2020

No CVE mentions in the news this month yet.

Breakout vendors

CVE count ≥3× their own 12-period median.

First time in top-100

Vendors never in top-100 in the prior 24 periods.

Top vendors

Ranked by distinct CVE count this period.

  • 1apple—
    242 CVE21 critCVSS 7.3
    ×11.5KEV 2PoC 2
    macos (167) · mac os x (164) · iphone os (154)
  • 2oracle—
    173 CVE10 critCVSS 6.0
    KEV 4Nuclei 12PoC 5
    mysql server (48) · mysql (48) · database (13)
  • 3microsoft—
    91 CVECVSS 7.3
    Nuclei 2PoC 3
    windows 10 (55) · windows server 2016 (52) · windows 10 version 2004 (51)
  • 4сообщество свободного программного обеспечения—
    73 CVE8 critCVSS 6.6
    Nuclei 10PoC 12
    debian gnu/linux (66) · linux (7) · cups (4)
  • 5hp—
    67 CVE41 critCVSS 9.3
    ×13.4Nuclei 1PoC 1
    intelligent management center (64) · hpe intelligent management center plat (2) · universal cmbd foundation (1)
  • 6debian—
    65 CVE8 critCVSS 6.5
    Nuclei 11PoC 9
    debian linux (65)
  • 7cisco—
    58 CVECVSS 7.0
    KEV 1Nuclei 1PoC 54
    firepower threat defense (30) · cisco adaptive security appliance (asa) software (20) · adaptive security appliance (20)
  • 8netapp—
    58 CVE1 critCVSS 4.8
    PoC 3
    oncommand insight (51) · active iq unified manager (49) · oncommand workflow automation (42)
  • 9fedoraproject—
    55 CVE6 critCVSS 6.6
    Nuclei 8PoC 7
    fedora (55)
  • 10ibm—
    52 CVE2 critCVSS 6.5
    PoC 1
    curam spm (9) · curam social program management (9) · security access manager (6)
  • 11ао "нппкт"—
    44 CVECVSS 6.0
    PoC 7
    осон основа оnyx (44)
  • 12ао «концерн вниинс»—
    43 CVE3 critCVSS 6.3
    PoC 4
    ос он «стрелец» (43)
  • 13maven—
    41 CVE4 critCVSS 6.7
    Nuclei 2PoC 1
    org.apache.nifi:nifi (3) · com.barchart.jenkins:maven-release-cascade (2) · org.biouno:uno-choice (2)
  • 14npm—
    40 CVE4 critCVSS 7.0
    Nuclei 2PoC 8
    electron (2) · npm-user-validate (2) · hermes-engine (2)
  • 15redhat—
    40 CVE2 critCVSS 6.6
    PoC 5
    red hat enterprise linux (23) · enterprise linux (5) · enterprise linux server (4)
  • 16google—
    39 CVE6 critCVSS 6.8
    PoC 1
    android (35) · tensorflow (2) · tink java (1)
  • 17opensuse—
    37 CVE3 critCVSS 6.5
    Nuclei 1PoC 4
    leap (37) · backports sle (7)
  • 18netgear—
    36 CVE16 critCVSS 7.5
    ×4.5KEV 1Nuclei 1
    rbr850 firmware (13) · rbs850 firmware (13) · rbk852 firmware (13)
  • 19ао «ивк»—
    34 CVE1 critCVSS 6.5
    PoC 5
    альт 8 сп (34)
  • 20canonical—
    32 CVE3 critCVSS 6.3
    Nuclei 2PoC 4
    ubuntu (27) · ubuntu linux (9) · aptdaemon (1)
  • 21juniper—
    30 CVECVSS 7.0
    Nuclei 1PoC 27
    junos (25) · junos os evolved (3) · mist cloud ui (3)
  • 22juniper networks—
    30 CVECVSS 7.1
    Nuclei 1PoC 27
    junos os (25) · junos (15) · junos os evolved (4)
  • 23ооо «русбитех-астра»—
    30 CVE1 critCVSS 6.8
    PoC 5
    astra linux special edition (28) · astra linux special edition для «эльбрус» (12) · astra linux common edition (10)
  • 24mozilla—
    28 CVE3 critCVSS 7.4
    PoC 2
    firefox (22) · thunderbird (10) · firefox esr (9)
  • 25netapp inc.—
    28 CVECVSS 5.2
    NEW
    snapcenter (28) · oncommand insight (28) · oncommand workflow automation (28)
  • 26fedora project—
    26 CVE6 critCVSS 6.5
    Nuclei 10PoC 5
    fedora (26)
  • 27novell inc.—
    25 CVE3 critCVSS 8.2
    Nuclei 1PoC 4
    opensuse leap (22) · suse linux enterprise server for sap applications (9) · suse linux enterprise server (9)
  • 28nvidia—
    24 CVE2 critCVSS 7.3
    ×12.0
    virtual gpu manager (11) · nvidia dgx servers (9) · nvidia vgpu software (7)
  • 29adobe—
    22 CVECVSS 7.3
    illustrator 2020 (7) · illustrator (7) · animate (4)
  • 30packagist—
    21 CVE1 critCVSS 6.3
    Nuclei 2PoC 7
    baserproject/basercms (3) · shopware/core (2) · pyrocms/pyrocms (2)
  • 31sap—
    21 CVE1 critCVSS 6.1
    Nuclei 1PoC 2
    3d visual enterprise viewer (6) · commerce cloud (2) · netweaver application server java (2)
  • 32sap se—
    20 CVE1 critCVSS 6.2
    Nuclei 1PoC 2
    sap 3d visual enterprise viewer (6) · sap netweaver application server java (2) · sap commerce cloud (2)
  • 33huawei—
    19 CVECVSS 5.9
    NEW
    taurus-an00b firmware (6) · p30 pro firmware (5) · mate 20 firmware (3)
  • 34bigbluebutton—
    15 CVE2 critCVSS 6.7
    NEWPoC 6
    bigbluebutton (14) · greenlight (1)
  • 35foxitsoftware—
    15 CVE4 critCVSS 7.9
    phantompdf (15) · foxit reader (12) · 3d (3)
  • 36gitlab—
    15 CVE1 critCVSS 5.9
    PoC 2
    gitlab (14) · gitlab runner (2) · runner (1)
  • 37intel—
    15 CVE2 critCVSS 6.3
    NEW×3.8
    bmc firmware (9) · bios (5) · 10th generation intel core i7 (5)
  • 38pulsesecure—
    14 CVE1 critCVSS 6.7
    NEWKEV 1PoC 1
    pulse secure desktop client (10) · pulse connect secure (4) · pulse policy secure (4)
  • 39pypi—
    14 CVE3 critCVSS 6.2
    PoC 3
    tensorflow (2) · tensorflow-cpu (2) · tensorflow-gpu (2)
  • 40apache—
    13 CVE1 critCVSS 6.8
    Nuclei 2PoC 1
    nifi (4) · calcite (1) · ant (1)
  • 41jenkins—
    13 CVECVSS 5.5
    jenkins maven cascade release plugin (2) · jenkins audit trail plugin (2) · active choices (2)
  • 42sonicwall—
    13 CVE1 critCVSS 7.3
    NEWKEV 1
    sonicosv (11) · sonicos (11) · sonicwall global vpn client (2)
  • 43synology—
    11 CVE1 critCVSS 7.4
    NEWPoC 3
    synology router manager (srm) (7) · router manager (7) · diskstation manager (5)
  • 44vmware—
    11 CVE1 critCVSS 6.8
    KEV 1Nuclei 1
    cloud foundation (6) · esxi (4) · fusion (3)
  • 45go—
    10 CVE1 critCVSS 6.7
    Nuclei 2PoC 2
    github.com/ory/fosite (2) · istio.io/istio (1) · code.gitea.io/gitea (1)
  • 46ао «нтц ит роса»—
    10 CVECVSS 4.0
    роса кобальт (8) · rosa virtualization (2)
  • 47facebook—
    9 CVE2 critCVSS 7.6
    NEW×4.5
    whatsapp for android (4) · whatsapp for ios (4) · whatsapp business for ios (3)
  • 48mcafee—
    9 CVECVSS 5.6
    Nuclei 1
    epolicy orchestrator (4) · epolicy orchistrator (epo) (2) · file & removable media protection (frp) (1)
  • 49siemens—
    9 CVE1 critCVSS 7.3
    ruggedcom rox rx1500 firmware (3) · ruggedcom rox rx1510 firmware (3) · ruggedcom rox rx1511 firmware (3)
  • 50wordpress—
    9 CVE5 critCVSS 8.0
    Nuclei 9
    wordpress (9)

Top weaknesses

CWE classes by distinct CVE count.

1CWE-79147—
2CWE-787136—
3CWE-2075—
4CWE-12563—
5CWE-91758—
6CWE-12036—
7CWE-40033—
8CWE-2232—
9CWE-41626—
10CWE-7825—
11CWE-8925—
12CWE-28722—
13CWE-35222—
14CWE-30618—
15CWE-42716—
16CWE-47616—
17CWE-73216—
18CWE-86216—
19CWE-26915—
20CWE-7715—

Sectors

Solution categories ranked by distinct CVE count this period.

  • Mobile Apps301 CVE
    102 crit13 KEV6 vendorsCVSS 7.3
    macos (169) · mac os x (164) · iphone os (154)
  • Enterprise Software279 CVE
    77 crit50 vendorsCVSS 8.7
    intelligent management center (64) · oncommand insight (51) · active iq unified manager (49)
  • Operating Systems264 CVE
    58 crit1 KEV38 vendorsCVSS 9.8
    fedora (81) · debian gnu/linux (66) · debian linux (65)
  • Networking Infrastructure215 CVE
    162 crit12 KEV40 vendorsCVSS 7.7
    firepower threat defense (60) · junos (40) · adaptive security appliance (30)
  • Databases188 CVE
    31 crit12 KEV14 vendorsCVSS 7.6
    mysql server (95) · mysql (50) · trade management (21)
  • OSS Libraries178 CVE
    25 crit58 vendorsCVSS 9.8
    org.apache.nifi:nifi (3) · com.barchart.jenkins:maven-release-cascade (2) · org.biouno:uno-choice (2)
  • Hardware Firmware120 CVE
    48 crit9 KEV26 vendorsCVSS 8.9
    virtual gpu manager (11) · bmc firmware (9) · nvidia dgx servers (9)
  • Web & CMS Plugins87 CVE
    30 crit57 vendorsCVSS 9.8
    wordpress (18) · basercms (6) · nifi (4)
  • Consumer Software85 CVE
    21 crit20 vendorsCVSS 8.1
    phantompdf (17) · foxit reader (12) · animate (8)
  • Security Products78 CVE
    6 crit1 KEV35 vendorsCVSS 8.1
    antivirus (7) · trend micro antivirus for mac (consumer) (7) · epolicy orchestrator (5)
  • Cloud & SaaS63 CVE
    9 crit4 KEV32 vendorsCVSS 7.8
    cloud foundation (6) · vmware cloud foundation (6) · esxi (4)
  • DevTools & CI52 CVE
    4 crit23 vendorsCVSS 7.7
    octopus deploy (3) · active choices (2) · audit trail (2)
  • ICS / OT / IoT42 CVE
    246 crit26 vendorsCVSS 8.9
    melsec iq-r series (6) · melsec iq-rd81dl96 firmware (6) · melsec iq-rd81mes96n firmware (6)
  • Communications41 CVE
    15 crit18 vendorsCVSS 7.5
    bigbluebutton (14) · greenlight (1) · trueconf client (1)
  • AI / ML4 CVE
    3 vendorsCVSS 5.8
    tensorflow (2) · containerd (1) · ros_comm ros communications packages (1)
  • Unclassified41 CVE
    5 crit33 vendorsCVSS 7.0
    antsword (2) · eyesofnetwork (2) · mintegraladsdk (2)
Weakness × Sector

Which weaknesses hit which solution categories in October 2020

Cells shaded by share of the sector's hottest weakness. Click a row to open the sector history.

79XSS787Out-of-bounds Write20Improper Input Validation125Out-of-bounds Read917Expression Language Injection120Buffer Overflow400Resource Consumption22Path Traversal416Use After Free78OS Command InjectionOperating Systems14922936156617Enterprise Software288112581513Networking Infrastructure23518471869OSS Libraries29910525723Hardware Firmware5101387327Consumer Software10446181117Databases52111Cloud & SaaS12242102117Security Products1176111Web & CMS Plugins31142