CVE Tools
Sign in
month report

December 2020

Data as of Jun 11, 2026, 06:05 UTCSnapshot v1 Sources CVEList V5+NVD+GHSA+CSAF+FSTEC BDU+CISA KEV+EPSS+Nuclei templates Methodology →

December 2020 closed with 1,618 published CVEs. 292 criticals, сообщество свободного программного обеспечения led volume, mostly via debian gnu/linux. Top weakness class — CWE-79 (198 CVE). 10 vendors cracked the top-100 for the first time.

Print view
Total CVEs
1,618
— MoM— YoY
Severity mix
292 / 573
critical / high
KEV added
0
0 ransomware-linked
Nuclei coverage
4.4%
71 CVEs with templates

Time to exploit

How fast the community ships detection after a CVE drops.

Days → Nuclei (median)
1904.1
n=71
Within 7 days
0.0%
Within 30 days
0.0%
Days → KEV (median)
330
n=9
Detection gap

KEV pressure, no Nuclei coverage

December 2020 · vendors with active exploitation listed by CISA but no public detection template.

Weakness × Vendor

What's spreading where in December 2020

Cells shaded by share of vendor's hottest weakness. Click any cell to open the CWE history.

79XSS787Out-of-bounds Write125Out-of-bounds Read89SQL Injection416Use After Free20Improper Input Validation78OS Command Injection862Missing Authorization190Integer Overflow306Missing Auth for Critical Func…сообщество свободного программного обеспечения61281163324google223194143debian464181222crates.io64141ооо «русбитех-астра»17714124apple11288121netgear38111ао «нппкт»58419124ао «концерн вниинс»35312121microsoft21fedoraproject84361122microsoft corp11

Most discussed CVEs — December 2020

No CVE mentions in the news this month yet.

First time in top-100

Vendors never in top-100 in the prior 24 periods.

Top vendors

Ranked by distinct CVE count this period.

  • 1сообщество свободного программного обеспечения—
    130 CVE4 critCVSS 6.2
    KEV 1Nuclei 2PoC 25
    debian gnu/linux (110) · linux (13) · mediawiki (5)
  • 2google—
    117 CVE7 critCVSS 6.1
    PoC 1
    android (96) · asylo (10) · tensorflow (6)
  • 3debian—
    96 CVE3 critCVSS 5.7
    KEV 1Nuclei 3PoC 22
    debian linux (94) · advanced package tool (2)
  • 4crates.io—
    85 CVE31 critCVSS 7.6
    PoC 15
    rusqlite (8) · lock_api (5) · arr (3)
  • 5ооо «русбитех-астра»—
    80 CVECVSS 5.0
    PoC 17
    astra linux special edition (73) · astra linux special edition для «эльбрус» (48) · astra linux common edition (36)
  • 6apple—
    68 CVECVSS 7.1
    NEWKEV 3PoC 6
    macos (57) · iphone os (44) · ipados (43)
  • 7netgear—
    66 CVE4 critCVSS 7.4
    NEWNuclei 1PoC 1
    r7800 firmware (46) · r9000 firmware (42) · r8900 firmware (42)
  • 8ао "нппкт"—
    66 CVECVSS 6.3
    Nuclei 1PoC 10
    осон основа оnyx (66)
  • 9ао «концерн вниинс»—
    62 CVECVSS 5.4
    Nuclei 1PoC 16
    ос он «стрелец» (62)
  • 10microsoft—
    61 CVE2 critCVSS 7.2
    KEV 1PoC 2
    windows server 2016 (22) · windows 10 (21) · windows server 2004 (server core installation) (20)
  • 11fedoraproject—
    58 CVE2 critCVSS 6.1
    KEV 1Nuclei 5PoC 8
    fedora (58) · extra packages for enterprise linux (1)
  • 12redhat—
    54 CVE1 critCVSS 6.1
    Nuclei 2PoC 13
    enterprise linux (22) · red hat enterprise linux (20) · openshift container platform (8)
  • 13maven—
    35 CVE7 critCVSS 7.2
    KEV 1Nuclei 7PoC 5
    com.fasterxml.jackson.core:jackson-databind (4) · com.thoughtworks.xstream:xstream (2) · io.jenkins.plugins:chaos-monkey (2)
  • 14imagemagick—
    34 CVECVSS 4.5
    PoC 14
    imagemagick (34)
  • 15netapp—
    34 CVE4 critCVSS 6.5
    Nuclei 1PoC 4
    cloud backup (8) · ontap select deploy administration utility (6) · solidfire baseboard management controller firmware (6)
  • 16npm—
    33 CVE14 critCVSS 8.1
    PoC 10
    multi-ini (2) · corenlp-js-interface (1) · corenlp-js-prefab (1)
  • 17imagemagick studio llc—
    31 CVECVSS 4.4
    NEWPoC 13
    imagemagick (31)
  • 18pypi—
    30 CVE1 critCVSS 6.7
    Nuclei 1PoC 5
    tensorflow-cpu (6) · tensorflow (6) · tensorflow-gpu (6)
  • 19oracle—
    29 CVE1 critCVSS 7.1
    KEV 1Nuclei 2PoC 5
    communications cloud native core policy (9) · peoplesoft enterprise peopletools (7) · zfs storage appliance kit (7)
  • 20siemens—
    28 CVE1 critCVSS 7.1
    PoC 2
    logo\! 8 bm firmware (8) · logo! 8 bm (incl. siplus variants) (8) · xhq (7)
  • 21fedora project—
    27 CVECVSS 6.2
    KEV 1PoC 5
    fedora (27)
  • 22packagist—
    27 CVE2 critCVSS 6.6
    Nuclei 4PoC 9
    moodle/moodle (5) · opencart/opencart (3) · shopware/core (3)
  • 23ibm—
    25 CVE2 critCVSS 6.1
    financial transaction manager (6) · financial transaction manager for multiplatform (5) · security secret server (4)
  • 24go—
    24 CVE4 critCVSS 6.7
    Nuclei 1PoC 3
    github.com/dhowden/tag (4) · github.com/kubernetes/kubernetes (3) · k8s.io/kubernetes (2)
  • 25novell inc.—
    24 CVE1 critCVSS 6.8
    Nuclei 1PoC 9
    opensuse leap (19) · suse linux enterprise server (16) · suse linux enterprise server for sap applications (10)
  • 26schneider-electric—
    22 CVE4 critCVSS 7.6
    modicon m340 bmxp342000 firmware (10) · modicon m340 bmxp3420302 firmware (10) · modicon m340 bmxp3420102 firmware (10)
  • 27apache—
    21 CVE6 critCVSS 7.3
    KEV 1Nuclei 6PoC 3
    airflow (4) · struts (3) · nuttx (2)
  • 28f5—
    21 CVE2 critCVSS 7.0
    big-ip access policy manager (11) · big-ip advanced firewall manager (8) · big-ip domain name system (8)
  • 29mozilla—
    21 CVECVSS 7.0
    PoC 1
    firefox (20) · thunderbird (12) · firefox esr (11)
  • 30canonical—
    19 CVECVSS 6.1
    PoC 2
    ubuntu (11) · ubuntu linux (5) · aptdaemon (2)
  • 31huawei—
    17 CVECVSS 7.3
    NEW
    cloudengine 5800 firmware (4) · cloudengine 12800 firmware (4) · cloudengine 6800 firmware (4)
  • 32ао «ивк»—
    17 CVECVSS 6.3
    PoC 3
    альт 8 сп (17)
  • 33apache software foundation—
    16 CVE4 critCVSS 7.0
    KEV 1Nuclei 5PoC 2
    apache airflow (4) · apache nuttx (incubating) (2) · apache apisix (1)
  • 34qnap—
    16 CVE3 critCVSS 7.0
    NEW
    qts (9) · quts hero (7) · qes (4)
  • 35xen—
    15 CVECVSS 6.5
    NEW
    xen (14) · xapi (1)
  • 36docker—
    14 CVE13 critCVSS 9.5
    NEWPoC 13
    adminer (1) · composer docker image (1) · crux linux docker image (1)
  • 37hcltech—
    14 CVE4 critCVSS 7.5
    NEW
    domino (6) · notes (4) · bigfix platform (2)
  • 38schneider electric—
    14 CVE4 critCVSS 8.4
    modicon quantum (5) · modicon premium (5) · modicon quantum with integrated ethernet copro (5)
  • 39odoo—
    13 CVE1 critCVSS 6.5
    NEW
    odoo (13) · odoo community (13) · odoo enterprise (13)
  • 40trendmicro—
    13 CVE2 critCVSS 6.1
    NEWPoC 2
    trend micro interscan web security virtual appliance (7) · interscan web security virtual appliance (7) · trend micro apex one (5)
  • 41linux—
    12 CVECVSS 6.9
    PoC 3
    linux kernel (12)
  • 42sap—
    12 CVE4 critCVSS 7.5
    Nuclei 2PoC 5
    solution manager (3) · netweaver application server java (3) · netweaver application server abap (2)
  • 43sap se—
    12 CVE4 critCVSS 7.5
    Nuclei 2PoC 5
    sap solution manager (user experience monitoring) (2) · sap business warehouse (1) · sap bw4hana (1)
  • 44solarwinds—
    12 CVE1 critCVSS 7.3
    NEWKEV 1Nuclei 1PoC 1
    n-central (6) · webhelpdesk (3) · help desk (1)
  • 45the linux foundation—
    12 CVECVSS 6.4
    NEW
    xen (12)
  • 46google llc—
    11 CVECVSS 5.1
    NEW
    asylo (10) · guava (1)
  • 47mediawiki—
    11 CVECVSS 6.6
    NEWPoC 2
    mediawiki (11)
  • 48mitel—
    11 CVECVSS 6.7
    NEW
    micollab (7) · micontact center business (1) · mivoice 6930 firmware (1)
  • 49nzxt—
    11 CVECVSS 7.5
    NEWPoC 9
    cam (11)
  • 50zammad—
    11 CVE1 critCVSS 5.9
    NEW
    zammad (11)

Top weaknesses

CWE classes by distinct CVE count.

1CWE-79198—
2CWE-78799—
3CWE-12578—
4CWE-8961—
5CWE-41654—
6CWE-2051—
7CWE-7844—
8CWE-86244—
9CWE-19036—
10CWE-30636—
11CWE-35232—
12CWE-2231—
13CWE-12027—
14CWE-26927—
15CWE-28727—
16CWE-40021—
17CWE-20019—
18CWE-43419—
19CWE-40117—
20CWE-36216—

Sectors

Solution categories ranked by distinct CVE count this period.

  • OSS Libraries441 CVE
    93 crit1 KEV110 vendorsCVSS 7.9
    imagemagick (65) · asylo (10) · picotcp (10)
  • Enterprise Software280 CVE
    62 crit2 KEV76 vendorsCVSS 8.0
    cam (11) · business workflow (8) · cloud backup (8)
  • Operating Systems270 CVE
    34 crit7 KEV31 vendorsCVSS 8.4
    debian gnu/linux (110) · debian linux (94) · fedora (85)
  • Mobile Apps202 CVE
    7 crit31 KEV5 vendorsCVSS 7.1
    android (96) · asylo (10) · tensorflow (6)
  • Web & CMS Plugins159 CVE
    40 crit3 KEV83 vendorsCVSS 7.3
    mediawiki (11) · joomla! cms (7) · joomla\! (7)
  • Networking Infrastructure131 CVE
    354 crit60 KEV38 vendorsCVSS 9.6
    r7800 firmware (46) · r8900 firmware (42) · r9000 firmware (42)
  • Cloud & SaaS103 CVE
    21 crit37 vendorsCVSS 8.0
    xen (14) · kubernetes (4) · containerd (2)
  • Security Products101 CVE
    25 crit1 KEV45 vendorsCVSS 7.9
    big-ip access policy manager (11) · big-ip advanced firewall manager (8) · big-ip domain name system (8)
  • ICS / OT / IoT94 CVE
    446 crit27 vendorsCVSS 9.8
    modicon m340 bmxp341000 firmware (10) · modicon m340 bmxp342000 firmware (10) · modicon m340 bmxp3420102 firmware (10)
  • Hardware Firmware56 CVE
    21 crit23 vendorsCVSS 8.1
    qts (19) · quts hero (15) · qes (12)
  • Consumer Software56 CVE
    8 crit24 vendorsCVSS 8.7
    firefox (22) · thunderbird (15) · firefox esr (11)
  • Databases38 CVE
    16 crit14 KEV11 vendorsCVSS 8.6
    communications cloud native core policy (11) · blockchain platform (9) · communications pricing design center (9)
  • Communications36 CVE
    4 crit2 KEV23 vendorsCVSS 7.8
    micollab (7) · express accounts (2) · 6873i sip firmware (1)
  • DevTools & CI27 CVE
    5 crit13 vendorsCVSS 8.1
    gitlab (10) · gitlab ce/ee (6) · gerrit (2)
  • AI / ML16 CVE
    1 crit6 vendorsCVSS 6.5
    tensorflow (6) · containerd (1) · dex (1)
  • Unclassified117 CVE
    75 crit68 vendorsCVSS 8.0
    rest\/json (8) · mailsherlock msr45/ssr45 (7) · msr45 isherlock-user (7)
Weakness × Sector

Which weaknesses hit which solution categories in December 2020

Cells shaded by share of the sector's hottest weakness. Click a row to open the sector history.

79XSS787Out-of-bounds Write125Out-of-bounds Read89SQL Injection416Use After Free20Improper Input Validation78OS Command Injection862Missing Authorization190Integer Overflow306Missing Auth for Critical Func…Operating Systems1249381305219321OSS Libraries203432623983283Enterprise Software46821866128Networking Infrastructure45581391312Web & CMS Plugins4922019424ICS / OT / IoT8971014413Security Products51093132112Hardware Firmware12461645121Cloud & SaaS532271518Consumer Software515111221