CVE Tools
Sign in
month report

November 2020

Data as of Jun 11, 2026, 06:05 UTCSnapshot v1 Sources CVEList V5+NVD+GHSA+CSAF+FSTEC BDU+CISA KEV+EPSS+Nuclei templates Methodology →

November 2020 closed with 1,485 published CVEs. 167 criticals, microsoft led volume, mostly via windows 10. Top weakness class — CWE-79 (120 CVE). 10 vendors cracked the top-100 for the first time.

Print view
Total CVEs
1,485
— MoM— YoY
Severity mix
167 / 548
critical / high
KEV added
0
0 ransomware-linked
Nuclei coverage
3.2%
48 CVEs with templates

Time to exploit

How fast the community ships detection after a CVE drops.

Days → Nuclei (median)
1936.2
n=48
Within 7 days
0.0%
Within 30 days
0.0%
Days → KEV (median)
365
n=10
Detection gap

KEV pressure, no Nuclei coverage

November 2020 · vendors with active exploitation listed by CISA but no public detection template.

Weakness × Vendor

What's spreading where in November 2020

Cells shaded by share of vendor's hottest weakness. Click any cell to open the CWE history.

79XSS787Out-of-bounds Write20Improper Input Validation416Use After Free125Out-of-bounds Read22Path Traversal287Improper Authentication120Buffer Overflow89SQL Injection78OS Command Injectionmicrosoft56111microsoft corp56111сообщество свободного программного обеспечения119417625312intel492711debian124316614312intel corp.392711fedoraproject1204164111google2642132ао «нппкт»1841523112ао «концерн вниинс»2131522111ооо «русбитех-астра»1711031211cisco727313

Most discussed CVEs — November 2020

No CVE mentions in the news this month yet.

First time in top-100

Vendors never in top-100 in the prior 24 periods.

Top vendors

Ranked by distinct CVE count this period.

  • 1microsoft—
    114 CVE1 critCVSS 7.1
    NEWKEV 2PoC 4
    windows 10 (52) · windows 10 1909 (52) · windows 10 1903 (52)
  • 2сообщество свободного программного обеспечения—
    101 CVE11 critCVSS 7.1
    NEWKEV 5Nuclei 4PoC 22
    debian gnu/linux (85) · linux (19) · drupal (3)
  • 3intel—
    96 CVE4 critCVSS 6.2
    NEW
    2nd generation intel xeon scalable processor (11) · active management technology firmware (9) · active management technology (9)
  • 4debian—
    95 CVE10 critCVSS 7.4
    NEWKEV 4Nuclei 5PoC 15
    debian linux (95)
  • 5fedoraproject—
    82 CVE4 critCVSS 7.4
    NEWKEV 5Nuclei 3PoC 12
    fedora (82)
  • 6google—
    72 CVE9 critCVSS 8.2
    NEWKEV 3PoC 7
    chrome (46) · google chrome (42) · android (25)
  • 7ао "нппкт"—
    67 CVE5 critCVSS 7.7
    NEWKEV 4Nuclei 4PoC 14
    осон основа оnyx (67)
  • 8ао «концерн вниинс»—
    62 CVE4 critCVSS 7.8
    NEWKEV 3Nuclei 2PoC 9
    ос он «стрелец» (62)
  • 9ооо «русбитех-астра»—
    59 CVE2 critCVSS 7.5
    NEWKEV 3PoC 13
    astra linux special edition (51) · astra linux common edition (40) · astra linux special edition для «эльбрус» (12)
  • 10cisco—
    50 CVE5 critCVSS 7.5
    NEWPoC 50
    cisco sd-wan (11) · cisco iot field network director (iot-fnd) (10) · iot field network director (10)
  • 11redhat—
    50 CVE4 critCVSS 7.1
    NEWKEV 1Nuclei 2PoC 9
    red hat enterprise linux (33) · enterprise linux (5) · openshift container platform (3)
  • 12qualcomm—
    48 CVE14 critCVSS 8.3
    NEWPoC 3
    sdx55 firmware (33) · sm8150 firmware (32) · sm8250 firmware (31)
  • 13qualcomm, inc.—
    48 CVE14 critCVSS 8.3
    NEWPoC 3
    snapdragon auto, snapdragon compute, snapdragon consumer iot, snapdragon industrial iot, snapdragon mobile (5) · snapdragon auto, snapdragon compute, snapdragon connectivity, snapdragon consumer electronics connectivity, snapdragon consumer iot, snapdragon industrial iot, snapdragon mobile, snapdragon voice & music, snapdragon wired infrastructure and networking (5) · snapdragon auto, snapdragon compute, snapdragon consumer iot, snapdragon industrial iot, snapdragon mobile, snapdragon voice & music, snapdragon wearables (4)
  • 14maven—
    47 CVE6 critCVSS 6.4
    NEWNuclei 2PoC 11
    org.jenkins-ci.plugins:active-directory (5) · org.craftercms:crafter-studio (4) · org.csanchez.jenkins.plugins:kubernetes (3)
  • 15ibm—
    42 CVE2 critCVSS 5.8
    NEWPoC 1
    sterling b2b integrator (8) · cloud pak for security (5) · sterling file gateway (4)
  • 16opensuse—
    42 CVE3 critCVSS 8.2
    NEWKEV 3Nuclei 1PoC 8
    backports sle (39) · leap (10)
  • 17fedora project—
    41 CVE4 critCVSS 8.0
    NEWKEV 2Nuclei 2PoC 7
    fedora (41)
  • 18packagist—
    35 CVE1 critCVSS 6.2
    NEWKEV 2Nuclei 3PoC 9
    magento/community-edition (8) · moodle/moodle (6) · magento/project-community-edition (4)
  • 19novell inc.—
    34 CVE4 critCVSS 7.0
    NEWKEV 3Nuclei 3PoC 10
    opensuse leap (32) · suse openstack cloud crowbar (2) · suse enterprise storage (2)
  • 20npm—
    32 CVE4 critCVSS 7.2
    NEWNuclei 1PoC 9
    systeminformation (2) · axios (1) · browserless-chrome (1)
  • 21netapp—
    31 CVE3 critCVSS 6.7
    NEWKEV 1Nuclei 1PoC 3
    cloud backup (14) · hci compute node bios (6) · solidfire bios (6)
  • 22schneider-electric—
    30 CVE2 critCVSS 8.2
    NEW
    interactive graphical scada system (9) · ecostruxure control expert (5) · webreports (5)
  • 23adobe—
    25 CVE1 critCVSS 5.7
    NEW
    acrobat reader (15) · adobe acrobat reader 2017 (14) · adobe acrobat reader 2020 (14)
  • 24ао «ивк»—
    24 CVE4 critCVSS 7.7
    NEWKEV 2Nuclei 3PoC 4
    альт 8 сп (24) · альт сп 10 (1)
  • 25schneider electric—
    23 CVE2 critCVSS 7.6
    NEW
    webreports (6) · ecostruxure control expert (4) · modicon m100 (4)
  • 26jenkins—
    21 CVE3 critCVSS 5.9
    NEWPoC 7
    active directory (5) · jenkins active directory plugin (5) · kubernetes (3)
  • 27pypi—
    21 CVE6 critCVSS 7.5
    NEWKEV 2Nuclei 5PoC 8
    salt (3) · moin (2) · jupyter-server (1)
  • 28canonical—
    20 CVE5 critCVSS 7.5
    NEWKEV 1PoC 8
    ubuntu (15) · ubuntu linux (5) · pulseaudio (1)
  • 29sap—
    18 CVE4 critCVSS 7.0
    NEWPoC 4
    solution manager (4) · commerce cloud \(accelerator payment mock\) (2) · fiori launchpad \(news tile application\) (2)
  • 30sap se—
    18 CVE4 critCVSS 7.0
    NEWPoC 4
    sap solution manager (java stack) (4) · sap fiori launchpad (news tile application) (2) · sap netweaver as abap (web dynpro) (2)
  • 31linux—
    17 CVECVSS 5.9
    NEWPoC 7
    linux kernel (17)
  • 32go—
    15 CVE4 critCVSS 7.4
    NEWNuclei 1PoC 1
    github.com/ethereum/go-ethereum (3) · github.com/nats-io/jwt (2) · github.com/hashicorp/consul (2)
  • 33trendmicro—
    15 CVE1 critCVSS 7.5
    NEWPoC 3
    trend micro interscan messaging security virtual appliance (imsva) (6) · interscan messaging security virtual appliance (6) · trend micro interscan web security virtual appliance (4)
  • 34jetbrains—
    14 CVE1 critCVSS 6.0
    NEW
    youtrack (6) · teamcity (3) · toolbox (2)
  • 35gitlab—
    13 CVECVSS 5.4
    NEWPoC 1
    gitlab (12) · gitlab ce/ee (9) · gitlab ee (3)
  • 36mongodb—
    13 CVECVSS 6.8
    NEW
    mongodb (12) · ops manager (1)
  • 37mongodb inc.—
    13 CVECVSS 6.8
    NEW
    mongodb server (12) · mongodb ops manager (1)
  • 38oracle—
    12 CVE1 critCVSS 6.9
    NEWKEV 1Nuclei 3PoC 2
    jd edwards enterpriseone tools (4) · graalvm (3) · communications offline mediation controller (3)
  • 39ооо «открытая мобильная платформа»—
    11 CVECVSS 6.6
    NEWPoC 4
    ос аврора (8) · аврора центр (3)
  • 40c-data—
    10 CVE7 critCVSS 8.9
    NEWPoC 3
    72408a (10) · 9008a (10) · 9016a (10)
  • 41cdatatec—
    10 CVE7 critCVSS 8.9
    NEWPoC 3
    72408a firmware (10) · 9008a firmware (10) · 9016a firmware (10)
  • 42vmware—
    10 CVE3 critCVSS 8.4
    NEWKEV 1
    sd-wan orchestrator (6) · cloud foundation (3) · esxi (2)
  • 43apache—
    9 CVE3 critCVSS 7.6
    NEWKEV 1Nuclei 3PoC 2
    activemq (1) · airflow (1) · batik (1)
  • 44f5—
    9 CVECVSS 6.5
    NEW
    big-ip fraud protection service (7) · big-ip policy enforcement manager (7) · big-ip global traffic manager (6)
  • 45hcltech—
    9 CVECVSS 6.6
    NEW
    notes (3) · hcl domino (2) · domino (2)
  • 46mitsubishielectric—
    9 CVE3 critCVSS 7.6
    NEW
    coreos (6) · r01cpu firmware (2) · r00cpu firmware (2)
  • 47mitsubishi electric corporation—
    9 CVE3 critCVSS 7.8
    NEW
    gt14 model of got 1000 series (6) · melsec iq-r (1) · melsec iq r00 cpu (1)
  • 48moxa inc.—
    9 CVECVSS 6.4
    NEW
    moxa edr-810 (6) · mxview (2) · moxa edr-g902 series (1)
  • 49vsolcn—
    9 CVE3 critCVSS 8.3
    NEWPoC 3
    v1600d4l firmware (7) · v1600d firmware (7) · v1600d-mini firmware (7)
  • 50br-automation—
    8 CVE4 critCVSS 8.4
    NEW
    industrial automation aprol (8)

Top weaknesses

CWE classes by distinct CVE count.

1CWE-79120—
2CWE-78774—
3CWE-2059—
4CWE-41638—
5CWE-12532—
6CWE-2230—
7CWE-28728—
8CWE-12027—
9CWE-8927—
10CWE-7825—
11CWE-43422—
12CWE-26920—
13CWE-19018—
14CWE-20018—
15CWE-35218—
16CWE-52218—
17CWE-79818—
18CWE-91818—
19CWE-27617—
20CWE-86217—

Sectors

Solution categories ranked by distinct CVE count this period.

  • Operating Systems334 CVE
    120 crit112 KEV32 vendorsCVSS 8.8
    fedora (123) · debian linux (95) · debian gnu/linux (85)
  • OSS Libraries224 CVE
    28 crit18 KEV69 vendorsCVSS 7.9
    openusd (6) · go ethereum (3) · go-ethereum (3)
  • Hardware Firmware211 CVE
    1,029 crit28 vendorsCVSS 8.9
    2nd generation intel xeon scalable processor (11) · thunderbolt dch driver (10) · active management technology (9)
  • Enterprise Software178 CVE
    30 crit1 KEV48 vendorsCVSS 7.9
    cloud backup (14) · sterling b2b integrator (8) · hci compute node bios (6)
  • Web & CMS Plugins113 CVE
    24 crit5 KEV61 vendorsCVSS 8.8
    xoonips (8) · crafter cms (7) · moodle (6)
  • Networking Infrastructure107 CVE
    97 crit32 vendorsCVSS 8.3
    iot field network director (20) · cisco sd-wan (11) · cisco iot field network director (iot-fnd) (10)
  • ICS / OT / IoT91 CVE
    40 crit27 vendorsCVSS 8.5
    interactive graphical scada system (13) · webreports (11) · ecostruxure control expert (9)
  • Security Products84 CVE
    10 crit1 KEV32 vendorsCVSS 7.8
    interscan messaging security virtual appliance (6) · trend micro interscan messaging security virtual appliance (imsva) (6) · interscan web security virtual appliance (5)
  • Mobile Apps83 CVE
    14 crit6 KEV5 vendorsCVSS 8.3
    chrome (46) · google chrome (42) · android (26)
  • DevTools & CI69 CVE
    15 crit1 KEV20 vendorsCVSS 8.8
    active directory (5) · jenkins active directory plugin (5) · jenkins kubernetes plugin (3)
  • Cloud & SaaS56 CVE
    14 crit9 KEV25 vendorsCVSS 8.1
    sd-wan orchestrator (6) · qemu (5) · cloud foundation (3)
  • Consumer Software44 CVE
    8 crit18 vendorsCVSS 8.7
    magento commerce (16) · acrobat reader (15) · acrobat (14)
  • Databases34 CVE
    9 crit3 KEV15 vendorsCVSS 8.8
    postgresql (6) · jd edwards enterpriseone tools (5) · communications application session controller (3)
  • Communications19 CVE
    4 crit18 vendorsCVSS 7.2
    asterisk (2) · certified asterisk (2) · aura system manager (1)
  • AI / ML5 CVE
    1 crit3 vendorsCVSS 8.3
    nats-server (2) · scikit-learn (1)
  • Unclassified42 CVE
    7 crit32 vendorsCVSS 7.6
    marmind (3) · prolinos (3) · forklift (2)
Weakness × Sector

Which weaknesses hit which solution categories in November 2020

Cells shaded by share of the sector's hottest weakness. Click a row to open the sector history.

79XSS787Out-of-bounds Write20Improper Input Validation416Use After Free125Out-of-bounds Read22Path Traversal287Improper Authentication120Buffer Overflow89SQL Injection78OS Command InjectionOperating Systems9366211035533Hardware Firmware61216715261315OSS Libraries1918826125124Enterprise Software33184261ICS / OT / IoT6961222411Consumer Software32762431311Networking Infrastructure114964228Web & CMS Plugins3171110Security Products1036123145DevTools & CI54111