April 2022
April 2022 closed with 2,106 published CVEs. 301 criticals, 45 added to CISA KEV (10 ransomware-linked). сообщество свободного программного обеспечения led volume, mostly via debian gnu/linux. Top weakness class — CWE-79 (270 CVE). 10 vendors cracked the top-100 for the first time.
Time to exploit
How fast the community ships detection after a CVE drops.
KEV pressure, no Nuclei coverage
April 2022 · vendors with active exploitation listed by CISA but no public detection template.
- KEV 2microsoft181 CVE
- KEV 1google136 CVE
- KEV 1ао «концерн вниинс»57 CVE
What's spreading where in April 2022
Cells shaded by share of vendor's hottest weakness. Click any cell to open the CWE history.
Most discussed CVEs — April 2022
First time in top-100
Vendors never in top-100 in the prior 24 periods.
- #1сообщество свободного программного обеспечения182 CVE
- #2microsoft181 CVE
- #3ооо «русбитех-астра»138 CVE
- #4google136 CVE
- #5ао "нппкт"111 CVE
- #6debian108 CVE
- #7unknown99 CVE
- #8oracle98 CVE
- #9ао «ивк»78 CVE
- #10ооо «ред софт»72 CVE
Top vendors
Ranked by distinct CVE count this period.
- 182 CVE22 critCVSS 8.0NEWKEV 1Nuclei 5PoC 53debian gnu/linux (146) · cgal (38) · linux (16)
- 181 CVE6 critCVSS 7.6NEWKEV 2PoC 5windows server 2022 (98) · windows server 2016 (97) · windows server version 20h2 (96)
- 138 CVE6 critCVSS 8.0NEWKEV 1Nuclei 1PoC 42astra linux special edition (138) · astra linux special edition для «эльбрус» (49) · astra linux common edition (4)
- 136 CVE4 critCVSS 7.7NEWKEV 1PoC 2android (80) · google chrome (56) · chrome (47)
- 111 CVE10 critCVSS 7.7NEWKEV 2Nuclei 3PoC 24осон основа оnyx (111)
- 108 CVE6 critCVSS 7.8NEWNuclei 2PoC 41debian linux (108)
- 99 CVE12 critCVSS 6.3NEWNuclei 99PoC 49mycred (3) · visual form builder (3) · salon booking system pro (2)
- 98 CVE5 critCVSS 6.6NEWKEV 3Nuclei 10PoC 3mysql server (24) · mysql (16) · weblogic server (8)
- 78 CVE2 critCVSS 6.4NEWPoC 15альт 8 сп (70) · альт сп 10 (14)
- 72 CVE14 critCVSS 7.6NEWNuclei 3PoC 18ред ос (72)
- 61 CVECVSS 5.7NEWNuclei 1PoC 3oncommand insight (44) · active iq unified manager (42) · snapcenter (32)
- 59 CVE4 critCVSS 6.3NEWKEV 1Nuclei 1PoC 59cisco ios xe (22) · ios xe (20) · cisco ios (15)
- 58 CVE3 critCVSS 6.9NEWNuclei 2PoC 11fedora (58) · extra packages for enterprise linux (3)
- 58 CVE7 critCVSS 6.7NEWKEV 3Nuclei 10PoC 8com.liferay.portal:release.dxp.bom (5) · net.sourceforge.htmlunit:neko-htmlunit (2) · org.owasp.antisamy:antisamy (2)
- 57 CVE3 critCVSS 8.0NEWKEV 1PoC 5ос он «стрелец» (57)
- 55 CVECVSS 5.7NEWsamsung mobile devices (38) · galaxy store (3) · samsung flow (2)
- 53 CVE4 critCVSS 7.0NEWNuclei 7PoC 18pimcore/pimcore (4) · remdex/livehelperchat (3) · shopware/shopware (3)
- 49 CVE2 critCVSS 7.1NEWPoC 9red hat enterprise linux (26) · enterprise linux (16) · red hat software collections (8)
- 48 CVE3 critCVSS 6.4NEWqradar security information and event manager (7) · qradar siem (7) · cognos analytics (7)
- 38 CVECVSS 8.8NEWPoC 19computational geometry algorithms library (38)
- 38 CVECVSS 8.8NEWPoC 19libcgal (38)
- 38 CVE1 critCVSS 6.9NEWPoC 15роса хром (29) · роса кобальт (5) · rosa virtualization (4)
- 33 CVE1 critCVSS 6.5NEWemc powerscale onefs (20) · powerscale onefs (20) · vnx2 (4)
- 29 CVE9 critCVSS 7.7NEWNuclei 5PoC 9fullpage.js (2) · ghost (2) · urijs (2)
- 28 CVE3 critCVSS 7.7NEWPoC 5gt.m (28)
- 26 CVE3 critCVSS 7.5NEWKEV 1Nuclei 1PoC 2scalance x310fe (9) · scalance x307-3 (9) · scalance x308-2m poe (9)
- 25 CVECVSS 7.3NEWPoC 10mariadb (25)
- 24 CVE1 critCVSS 5.0NEWNuclei 1PoC 3gitlab (24) · gitlab pages (1)
- 24 CVE2 critCVSS 7.2NEWNuclei 1PoC 1github.com/mattermost/mattermost-server/v6 (4) · github.com/rancher/rancher (3) · github.com/beego/beego (3)
- 24 CVECVSS 7.5NEWPoC 10mariadb (24)
- 21 CVE1 critCVSS 6.2NEWPoC 7fedora (20) · 389 directory server (1)
- 21 CVECVSS 6.3NEWmt6580, mt6731, mt6735, mt6750s, mt6753, mt6755s, mt6757, mt6757c, mt6757cd, mt6757ch, mt6761, mt6762, mt6763, mt6765, mt6768, mt6769, mt6771, mt6779, mt6781, mt6785, mt6833, mt6853, mt6853t, mt6873, mt6875, mt6877, mt6883, mt6885, mt6889, mt6891, mt6893, mt8127, mt8135, mt8163, mt8167, mt8167s, mt8168, mt8173, mt8175, mt8176, mt8183, mt8312c, mt8312d, mt8321, mt8362a, mt8365, mt8382, mt8385, mt8389, mt8392, mt8392_90, mt8665, mt8685, mt8693, mt8735, mt8735b, mt8735m, mt8752, mt8765, mt8783, mt8785, mt8788 (2) · mt6781, mt6785, mt6833, mt6853, mt6853t, mt6873, mt6877, mt6883, mt6885, mt6889, mt6891, mt6893, mt8185, mt8789, mt8791, mt8797 (2) · mt6580, mt6735, mt6737, mt6739, mt6753, mt6755, mt6755s, mt6761, mt6765, mt6768, mt6769, mt6771, mt6779, mt6781, mt6785, mt6789, mt6795, mt6797, mt6799, mt6833, mt6853, mt6853t, mt6873, mt6875, mt6877, mt6879, mt6880, mt6883, mt6885, mt6889, mt6890, mt6891, mt6893, mt6895, mt6983, mt6985, mt8167, mt8167s, mt8168, mt8173, mt8175, mt8183, mt8185, mt8321, mt8362a, mt8365, mt8385, mt8675, mt8765, mt8766, mt8768, mt8786, mt8788, mt8791, mt8797 (1)
- 20 CVE10 critCVSS 8.5NEWPoC 2ос аврора (20)
- 19 CVECVSS 6.5NEWNuclei 5PoC 23d visual enterprise viewer (6) · businessobjects business intelligence platform (5) · netweaver (2)
- 19 CVECVSS 6.5NEWNuclei 5PoC 2sap 3d visual enterprise viewer (6) · sap businessobjects business intelligence platform (4) · sap web dispatcher (2)
- 18 CVE18 critCVSS 9.8NEWPoC 8baby care system (18)
- 17 CVECVSS 7.8NEWautocad (8) · autocad electrical (7) · autocad lt (7)
- 17 CVECVSS 5.4NEWpromoted builds (2) · subversion (2) · jenkins subversion plugin (2)
- 17 CVECVSS 5.4NEWgalaxy store (3) · samsung flow (2) · recovery (1)
- 17 CVE2 critCVSS 7.7NEWPoC 5yottadb (15) · gt.m (2)
- 17 CVE10 critCVSS 8.8NEWос тд аис фссп россии (17)
- 16 CVE2 critCVSS 7.1NEWfortiwan (6) · fortinet fortiwan (6) · forticlient (3)
- 16 CVECVSS 5.4NEWintellij idea (9) · youtrack (3) · pycharm (2)
- 16 CVECVSS 7.2NEWNuclei 1PoC 15junos (10) · junos os evolved (6) · identity management service (1)
- 16 CVECVSS 7.4NEWNuclei 1PoC 15junos os (13) · junos os evolved (6) · junos (4)
- 16 CVE5 critCVSS 7.4NEWKEV 4Nuclei 5PoC 7vrealize automation (8) · workspace one access (8) · identity manager (8)
- 15 CVECVSS 8.8NEWPoC 5attendance and payroll system (15)
- 15 CVE4 critCVSS 7.5NEWNuclei 1PoC 4ubuntu (15)
- 15 CVE2 critCVSS 8.1NEWPoC 8dir-619 firmware (8) · dir-619 ax firmware (2) · dir-825ac g1 (2)
- 15 CVE2 critCVSS 6.8NEWlegion y540-15irh firmware (4) · ideapad 3-15are05 firmware (4) · l340-17iwl firmware (4)
| # | Vendor | CVEs | Crit | KEV | Nuclei | Signals | Top products | Δ | |
|---|---|---|---|---|---|---|---|---|---|
| 1 | сообщество свободного программного обеспечения | 182 | 22 | 1 | 5 | NEWKEV 1Nuclei 5PoC 53 | debian gnu/linux (146) · cgal (38) · linux (16) | — | |
| 2 | microsoft | 181 | 6 | 2 | · | NEWKEV 2PoC 5 | windows server 2022 (98) · windows server 2016 (97) · windows server version 20h2 (96) | — | |
| 3 | ооо «русбитех-астра» | 138 | 6 | 1 | 1 | NEWKEV 1Nuclei 1PoC 42 | astra linux special edition (138) · astra linux special edition для «эльбрус» (49) · astra linux common edition (4) | — | |
| 4 | 136 | 4 | 1 | · | NEWKEV 1PoC 2 | android (80) · google chrome (56) · chrome (47) | — | ||
| 5 | ао "нппкт" | 111 | 10 | 2 | 3 | NEWKEV 2Nuclei 3PoC 24 | осон основа оnyx (111) | — | |
| 6 | debian | 108 | 6 | · | 2 | NEWNuclei 2PoC 41 | debian linux (108) | — | |
| 7 | unknown | 99 | 12 | · | 99 | NEWNuclei 99PoC 49 | mycred (3) · visual form builder (3) · salon booking system pro (2) | — | |
| 8 | oracle | 98 | 5 | 3 | 10 | NEWKEV 3Nuclei 10PoC 3 | mysql server (24) · mysql (16) · weblogic server (8) | — | |
| 9 | ао «ивк» | 78 | 2 | · | · | NEWPoC 15 | альт 8 сп (70) · альт сп 10 (14) | — | |
| 10 | ооо «ред софт» | 72 | 14 | · | 3 | NEWNuclei 3PoC 18 | ред ос (72) | — | |
| 11 | netapp | 61 | · | · | 1 | NEWNuclei 1PoC 3 | oncommand insight (44) · active iq unified manager (42) · snapcenter (32) | — | |
| 12 | cisco | 59 | 4 | 1 | 1 | NEWKEV 1Nuclei 1PoC 59 | cisco ios xe (22) · ios xe (20) · cisco ios (15) | — | |
| 13 | fedoraproject | 58 | 3 | · | 2 | NEWNuclei 2PoC 11 | fedora (58) · extra packages for enterprise linux (3) | — | |
| 14 | maven | 58 | 7 | 3 | 10 | NEWKEV 3Nuclei 10PoC 8 | com.liferay.portal:release.dxp.bom (5) · net.sourceforge.htmlunit:neko-htmlunit (2) · org.owasp.antisamy:antisamy (2) | — | |
| 15 | ао «концерн вниинс» | 57 | 3 | 1 | · | NEWKEV 1PoC 5 | ос он «стрелец» (57) | — | |
| 16 | samsung mobile | 55 | · | · | · | NEW | samsung mobile devices (38) · galaxy store (3) · samsung flow (2) | — | |
| 17 | packagist | 53 | 4 | · | 7 | NEWNuclei 7PoC 18 | pimcore/pimcore (4) · remdex/livehelperchat (3) · shopware/shopware (3) | — | |
| 18 | redhat | 49 | 2 | · | · | NEWPoC 9 | red hat enterprise linux (26) · enterprise linux (16) · red hat software collections (8) | — | |
| 19 | ibm | 48 | 3 | · | · | NEW | qradar security information and event manager (7) · qradar siem (7) · cognos analytics (7) | — | |
| 20 | cgal | 38 | · | · | · | NEWPoC 19 | computational geometry algorithms library (38) | — | |
| 21 | cgal project | 38 | · | · | · | NEWPoC 19 | libcgal (38) | — | |
| 22 | ао «нтц ит роса» | 38 | 1 | · | · | NEWPoC 15 | роса хром (29) · роса кобальт (5) · rosa virtualization (4) | — | |
| 23 | dell | 33 | 1 | · | · | NEW | emc powerscale onefs (20) · powerscale onefs (20) · vnx2 (4) | — | |
| 24 | npm | 29 | 9 | · | 5 | NEWNuclei 5PoC 9 | fullpage.js (2) · ghost (2) · urijs (2) | — | |
| 25 | fisglobal | 28 | 3 | · | · | NEWPoC 5 | gt.m (28) | — | |
| 26 | siemens | 26 | 3 | 1 | 1 | NEWKEV 1Nuclei 1PoC 2 | scalance x310fe (9) · scalance x307-3 (9) · scalance x308-2m poe (9) | — | |
| 27 | mariadb | 25 | · | · | · | NEWPoC 10 | mariadb (25) | — | |
| 28 | gitlab | 24 | 1 | · | 1 | NEWNuclei 1PoC 3 | gitlab (24) · gitlab pages (1) | — | |
| 29 | go | 24 | 2 | · | 1 | NEWNuclei 1PoC 1 | github.com/mattermost/mattermost-server/v6 (4) · github.com/rancher/rancher (3) · github.com/beego/beego (3) | — | |
| 30 | mariadb foundation | 24 | · | · | · | NEWPoC 10 | mariadb (24) | — | |
| 31 | fedora project | 21 | 1 | · | · | NEWPoC 7 | fedora (20) · 389 directory server (1) | — | |
| 32 | mediatek, inc. | 21 | · | · | · | NEW | mt6580, mt6731, mt6735, mt6750s, mt6753, mt6755s, mt6757, mt6757c, mt6757cd, mt6757ch, mt6761, mt6762, mt6763, mt6765, mt6768, mt6769, mt6771, mt6779, mt6781, mt6785, mt6833, mt6853, mt6853t, mt6873, mt6875, mt6877, mt6883, mt6885, mt6889, mt6891, mt6893, mt8127, mt8135, mt8163, mt8167, mt8167s, mt8168, mt8173, mt8175, mt8176, mt8183, mt8312c, mt8312d, mt8321, mt8362a, mt8365, mt8382, mt8385, mt8389, mt8392, mt8392_90, mt8665, mt8685, mt8693, mt8735, mt8735b, mt8735m, mt8752, mt8765, mt8783, mt8785, mt8788 (2) · mt6781, mt6785, mt6833, mt6853, mt6853t, mt6873, mt6877, mt6883, mt6885, mt6889, mt6891, mt6893, mt8185, mt8789, mt8791, mt8797 (2) · mt6580, mt6735, mt6737, mt6739, mt6753, mt6755, mt6755s, mt6761, mt6765, mt6768, mt6769, mt6771, mt6779, mt6781, mt6785, mt6789, mt6795, mt6797, mt6799, mt6833, mt6853, mt6853t, mt6873, mt6875, mt6877, mt6879, mt6880, mt6883, mt6885, mt6889, mt6890, mt6891, mt6893, mt6895, mt6983, mt6985, mt8167, mt8167s, mt8168, mt8173, mt8175, mt8183, mt8185, mt8321, mt8362a, mt8365, mt8385, mt8675, mt8765, mt8766, mt8768, mt8786, mt8788, mt8791, mt8797 (1) | — | |
| 33 | ооо «открытая мобильная платформа» | 20 | 10 | · | · | NEWPoC 2 | ос аврора (20) | — | |
| 34 | sap | 19 | · | · | 5 | NEWNuclei 5PoC 2 | 3d visual enterprise viewer (6) · businessobjects business intelligence platform (5) · netweaver (2) | — | |
| 35 | sap se | 19 | · | · | 5 | NEWNuclei 5PoC 2 | sap 3d visual enterprise viewer (6) · sap businessobjects business intelligence platform (4) · sap web dispatcher (2) | — | |
| 36 | janobe | 18 | 18 | · | · | NEWPoC 8 | baby care system (18) | — | |
| 37 | autodesk | 17 | · | · | · | NEW | autocad (8) · autocad electrical (7) · autocad lt (7) | — | |
| 38 | jenkins | 17 | · | · | · | NEW | promoted builds (2) · subversion (2) · jenkins subversion plugin (2) | — | |
| 39 | samsung | 17 | · | · | · | NEW | galaxy store (3) · samsung flow (2) · recovery (1) | — | |
| 40 | yottadb | 17 | 2 | · | · | NEWPoC 5 | yottadb (15) · gt.m (2) | — | |
| 41 | фссп россии | 17 | 10 | · | · | NEW | ос тд аис фссп россии (17) | — | |
| 42 | fortinet | 16 | 2 | · | · | NEW | fortiwan (6) · fortinet fortiwan (6) · forticlient (3) | — | |
| 43 | jetbrains | 16 | · | · | · | NEW | intellij idea (9) · youtrack (3) · pycharm (2) | — | |
| 44 | juniper | 16 | · | · | 1 | NEWNuclei 1PoC 15 | junos (10) · junos os evolved (6) · identity management service (1) | — | |
| 45 | juniper networks | 16 | · | · | 1 | NEWNuclei 1PoC 15 | junos os (13) · junos os evolved (6) · junos (4) | — | |
| 46 | vmware | 16 | 5 | 4 | 5 | NEWKEV 4Nuclei 5PoC 7 | vrealize automation (8) · workspace one access (8) · identity manager (8) | — | |
| 47 | attendance and payroll system project | 15 | · | · | · | NEWPoC 5 | attendance and payroll system (15) | — | |
| 48 | canonical | 15 | 4 | · | 1 | NEWNuclei 1PoC 4 | ubuntu (15) | — | |
| 49 | dlink | 15 | 2 | · | · | NEWPoC 8 | dir-619 firmware (8) · dir-619 ax firmware (2) · dir-825ac g1 (2) | — | |
| 50 | lenovo | 15 | 2 | · | · | NEW | legion y540-15irh firmware (4) · ideapad 3-15are05 firmware (4) · l340-17iwl firmware (4) | — |
Sectors
Solution categories ranked by distinct CVE count this period.
- Operating Systems570 CVE241 crit107 KEV33 vendorsCVSS 7.8debian gnu/linux (146) · astra linux special edition (138) · осон основа оnyx (111)
- Enterprise Software356 CVE173 crit7 KEV81 vendorsCVSS 9.4oncommand insight (44) · active iq unified manager (42) · snapcenter (32)
- OSS Libraries352 CVE74 crit19 KEV101 vendorsCVSS 8.4computational geometry algorithms library (38) · libcgal (38) · gpac (7)
- Web & CMS Plugins313 CVE79 crit3 KEV206 vendorsCVSS 8.6zbzcms (7) · mediawiki (6) · atomcms (5)
- Networking Infrastructure178 CVE51 crit1 KEV40 vendorsCVSS 7.9cisco ios xe (22) · ios xe (20) · cisco ios (17)
- Mobile Apps174 CVE13 crit2 KEV8 vendorsCVSS 7.4android (82) · google chrome (56) · chrome (47)
- Databases161 CVE68 crit56 KEV15 vendorsCVSS 8.1mysql server (61) · mariadb (49) · gt.m (30)
- ICS / OT / IoT156 CVE220 crit61 vendorsCVSS 8.3cc612 (8) · cc613 (8) · icc15xx (8)
- DevTools & CI122 CVE19 crit36 vendorsCVSS 7.8radare2 (15) · radareorg/radare2 (15) · a4sp (7)
- Hardware Firmware113 CVE137 crit33 vendorsCVSS 7.9ideapad 3-14are05 (4) · ideapad 3-14are05 firmware (4) · ideapad 3-14igl05 (4)
- Cloud & SaaS83 CVE39 crit39 KEV40 vendorsCVSS 8.1identity manager (8) · omnissa workspace one access connector (8) · vrealize automation (8)
- Security Products80 CVE20 crit48 vendorsCVSS 7.1fortinet fortiwan (6) · fortiwan (6) · forticlient (3)
- Consumer Software48 CVE4 crit20 vendorsCVSS 7.8autocad (8) · advance steel (7) · autocad architecture (7)
- Communications44 CVE10 crit7 KEV29 vendorsCVSS 8.8live helper chat (5) · livehelperchat/livehelperchat (5) · mattermost (4)
- Unclassified192 CVE50 crit1 KEV116 vendorsCVSS 7.6ос тд аис фссп россии (17) · imagegear (11) · aveva system platform (6)
| Sector | CVEs | Crit | KEV | Vendors | Products | Avg CVSS | Top products |
|---|---|---|---|---|---|---|---|
| Operating Systems▸ 3 | 570 | 241 | 107 | 33 | 375 | 7.8 | debian gnu/linux (146) · astra linux special edition (138) · осон основа оnyx (111) |
| Enterprise Software▸ 7 | 356 | 173 | 7 | 81 | 476 | 9.4 | oncommand insight (44) · active iq unified manager (42) · snapcenter (32) |
| OSS Libraries▸ 11 | 352 | 74 | 19 | 101 | 262 | 8.4 | computational geometry algorithms library (38) · libcgal (38) · gpac (7) |
| Web & CMS Plugins▸ 6 | 313 | 79 | 3 | 206 | 254 | 8.6 | zbzcms (7) · mediawiki (6) · atomcms (5) |
| Networking Infrastructure▸ 5 | 178 | 51 | 1 | 40 | 279 | 7.9 | cisco ios xe (22) · ios xe (20) · cisco ios (17) |
| Mobile Apps▸ 2 | 174 | 13 | 2 | 8 | 27 | 7.4 | android (82) · google chrome (56) · chrome (47) |
| Databases▸ 4 | 161 | 68 | 56 | 15 | 104 | 8.1 | mysql server (61) · mariadb (49) · gt.m (30) |
| ICS / OT / IoT▸ 6 | 156 | 220 | · | 61 | 295 | 8.3 | cc612 (8) · cc613 (8) · icc15xx (8) |
| DevTools & CI▸ 5 | 122 | 19 | · | 36 | 73 | 7.8 | radare2 (15) · radareorg/radare2 (15) · a4sp (7) |
| Hardware Firmware▸ 5 | 113 | 137 | · | 33 | 956 | 7.9 | ideapad 3-14are05 (4) · ideapad 3-14are05 firmware (4) · ideapad 3-14igl05 (4) |
| Cloud & SaaS▸ 5 | 83 | 39 | 39 | 40 | 106 | 8.1 | identity manager (8) · omnissa workspace one access connector (8) · vrealize automation (8) |
| Security Products▸ 6 | 80 | 20 | · | 48 | 93 | 7.1 | fortinet fortiwan (6) · fortiwan (6) · forticlient (3) |
| Consumer Software▸ 3 | 48 | 4 | · | 20 | 46 | 7.8 | autocad (8) · advance steel (7) · autocad architecture (7) |
| Communications▸ 4 | 44 | 10 | 7 | 29 | 42 | 8.8 | live helper chat (5) · livehelperchat/livehelperchat (5) · mattermost (4) |
| Unclassified | 192 | 50 | 1 | 116 | 123 | 7.6 | ос тд аис фссп россии (17) · imagegear (11) · aveva system platform (6) |
Which weaknesses hit which solution categories in April 2022
Cells shaded by share of the sector's hottest weakness. Click a row to open the sector history.