CVE Tools
Sign in
month report

September 2022

Data as of Jun 11, 2026, 06:05 UTCSnapshot v1 Sources CVEList V5+NVD+GHSA+CSAF+FSTEC BDU+CISA KEV+EPSS+Nuclei templates Methodology →

September 2022 closed with 2,210 published CVEs. 299 criticals, 24 added to CISA KEV (5 ransomware-linked). google led volume, mostly via android. Top weakness class — CWE-787 (268 CVE). 10 vendors cracked the top-100 for the first time.

Print view
Total CVEs
2,210
— MoM— YoY
Severity mix
299 / 905
critical / high
KEV added
24
5 ransomware-linked
Nuclei coverage
10.0%
221 CVEs with templates

Time to exploit

How fast the community ships detection after a CVE drops.

Days → Nuclei (median)
1267.5
n=221
Within 7 days
0.0%
Within 30 days
0.0%
Days → KEV (median)
97
n=8
Detection gap

KEV pressure, no Nuclei coverage

September 2022 · vendors with active exploitation listed by CISA but no public detection template.

Weakness × Vendor

What's spreading where in September 2022

Cells shaded by share of vendor's hottest weakness. Click any cell to open the CWE history.

787Out-of-bounds Write79XSS89SQL Injection125Out-of-bounds Read352CSRF20Improper Input Validation416Use After Free22Path Traversal287Improper Authentication200Information Exposuregoogle3516119202сообщество свободного программного обеспечения2231962211ао «нппкт»26151728ооо «русбитех-астра»19251732pypi31151631maven7187134fedoraproject17512162011microsoft corp4111129ооо «ред софт»17436481debian161174111apple16110424adobe151326151

Most discussed CVEs — September 2022

No CVE mentions in the news this month yet.

First time in top-100

Vendors never in top-100 in the prior 24 periods.

Top vendors

Ranked by distinct CVE count this period.

  • 1google—
    186 CVE10 critCVSS 7.2
    KEV 3PoC 4
    android (84) · tensorflow (59) · chrome (42)
  • 2сообщество свободного программного обеспечения—
    128 CVE9 critCVSS 7.0
    KEV 1Nuclei 3PoC 31
    debian gnu/linux (81) · linux (36) · vim (11)
  • 3ао "нппкт"—
    115 CVE2 critCVSS 7.2
    KEV 3PoC 22
    осон основа оnyx (115)
  • 4ооо «русбитех-астра»—
    115 CVE3 critCVSS 7.1
    KEV 3PoC 28
    astra linux special edition (108) · astra linux special edition для «эльбрус» (16) · astra linux common edition (2)
  • 5pypi—
    114 CVE4 critCVSS 6.1
    PoC 10
    tensorflow (58) · tensorflow-cpu (56) · tensorflow-gpu (56)
  • 6maven—
    108 CVE14 critCVSS 7.0
    Nuclei 1PoC 6
    com.fasterxml.woodstox:woodstox-core (5) · com.liferay.portal:release.dxp.bom (5) · org.yaml:snakeyaml (4)
  • 7fedoraproject—
    98 CVE3 critCVSS 7.5
    KEV 3Nuclei 1PoC 19
    fedora (98) · extra packages for enterprise linux (4)
  • 8microsoft—
    90 CVE4 critCVSS 8.0
    KEV 4PoC 3
    windows server 2022 (44) · windows server 2022 (server core installation) (44) · windows server 2019 (server core installation) (43)
  • 9ооо «ред софт»—
    83 CVE8 critCVSS 6.6
    KEV 1Nuclei 2PoC 18
    ред ос (83)
  • 10debian—
    80 CVE3 critCVSS 6.5
    Nuclei 1PoC 18
    debian linux (79) · logcheck (1)
  • 11apple—
    72 CVE5 critCVSS 7.2
    KEV 1
    macos (64) · iphone os (42) · ipados (38)
  • 12adobe—
    66 CVECVSS 6.7
    Nuclei 1
    indesign (17) · adobe indesign (17) · experience manager (14)
  • 13tensorflow—
    59 CVECVSS 6.0
    tensorflow (59)
  • 14redhat—
    58 CVE2 critCVSS 6.7
    Nuclei 1PoC 12
    red hat enterprise linux (36) · enterprise linux (9) · red hat virtualization (6)
  • 15unknown—
    55 CVE2 critCVSS 5.9
    Nuclei 55PoC 20
    classified listing pro - classified ads & business directory plugin (2) · wp popup builder – popup forms , marketing popup & newsletter (2) · post smtp mailer/email log (2)
  • 16qualcomm—
    54 CVE5 critCVSS 7.8
    wcd9370 firmware (41) · wcd9375 firmware (40) · wsa8835 firmware (40)
  • 17qualcomm, inc.—
    54 CVE5 critCVSS 7.9
    snapdragon auto, snapdragon compute, snapdragon connectivity, snapdragon consumer iot, snapdragon industrial iot, snapdragon mobile, snapdragon voice & music, snapdragon wearables (10) · snapdragon auto (8) · snapdragon connectivity, snapdragon mobile (5)
  • 18packagist—
    51 CVE6 critCVSS 6.2
    Nuclei 8PoC 18
    typo3/cms-core (7) · typo3/cms (6) · moodle/moodle (5)
  • 19go—
    47 CVE6 critCVSS 7.2
    Nuclei 2PoC 11
    github.com/rancher/rancher (3) · github.com/grafana/grafana (2) · github.com/elrondnetwork/elrond-go (2)
  • 20ао «концерн вниинс»—
    44 CVE1 critCVSS 8.0
    KEV 3PoC 5
    ос он «стрелец» (44)
  • 21npm—
    43 CVE10 critCVSS 7.4
    PoC 11
    steal (8) · matrix-js-sdk (4) · parse-server (3)
  • 22samsung mobile—
    40 CVECVSS 4.5
    NEW
    samsung mobile devices (21) · samsung pay (3) · com.samsung.android.waterplugin (2)
  • 23tenda—
    39 CVE21 critCVSS 8.7
    NEWPoC 23
    ac21 firmware (10) · i9 firmware (8) · ac18 firmware (8)
  • 24huawei—
    37 CVE9 critCVSS 7.8
    emui (32) · harmonyos (27) · magic ui (20)
  • 25linux—
    36 CVECVSS 6.2
    PoC 8
    linux kernel (36) · kernel (6)
  • 26ао «ивк»—
    36 CVECVSS 6.7
    PoC 11
    альт 8 сп (33) · альт сп 10 (5)
  • 27samsung—
    35 CVECVSS 5.8
    NEWPoC 3
    mtower (11) · tizenrt (4) · samsung pay (3)
  • 28jenkins—
    32 CVE4 critCVSS 6.9
    jenkins cons3rt plugin (4) · cons3rt (4) · jenkins build-publisher plugin (3)
  • 29apache software foundation—
    30 CVE5 critCVSS 7.3
    Nuclei 2PoC 1
    apache ofbiz (5) · apache airflow (4) · apache pulsar (4)
  • 30ibm—
    29 CVECVSS 6.4
    cognos analytics (7) · websphere application server (3) · aix (2)
  • 31otfcc project—
    29 CVECVSS 6.5
    NEWPoC 29
    otfcc (29)
  • 32apache—
    26 CVE5 critCVSS 7.3
    Nuclei 2PoC 1
    ofbiz (5) · pulsar (4) · airflow (4)
  • 33arubanetworks—
    26 CVECVSS 7.3
    NEW
    clearpass policy manager (14) · aos-cx (12)
  • 34canonical—
    26 CVECVSS 7.0
    PoC 10
    ubuntu (25) · ubuntu linux (3)
  • 35dell—
    23 CVE3 critCVSS 6.5
    vostro 3710 firmware (11) · inspiron 3910 firmware (11) · cpg bios (11)
  • 36fedora project—
    23 CVE2 critCVSS 6.8
    PoC 7
    fedora (23) · fedora epel (1)
  • 37mediatek, inc.—
    23 CVE1 critCVSS 6.5
    NEW
    mt6833, mt6853, mt6855, mt6873, mt6877, mt6879, mt6883, mt6885, mt6889, mt6893, mt6895, mt6983, mt8791, mt8797 (6) · mt6879, mt6895, mt6983 (2) · mt6761, mt6765, mt6768, mt6771, mt6779, mt6781, mt6785, mt6833, mt6853, mt6875, mt6877, mt6879, mt6885, mt6893, mt6895, mt6983 (2)
  • 38siemens—
    23 CVE1 critCVSS 6.6
    parasolid v35.0 (20) · parasolid (20) · parasolid v33.1 (20)
  • 39ikus060—
    22 CVE2 critCVSS 6.5
    NEWPoC 8
    ikus060/rdiffweb (20) · ikus060/minarca (2)
  • 40ikus-soft—
    22 CVE2 critCVSS 6.5
    NEWPoC 8
    rdiffweb (20) · minarca (2)
  • 41cisco—
    21 CVECVSS 5.5
    KEV 1PoC 19
    cisco ios xe (9) · ios xe (8) · catalyst sd-wan manager (6)
  • 42jflyfox—
    21 CVE2 critCVSS 7.8
    NEWPoC 13
    jfinal cms (21)
  • 43ansys—
    19 CVECVSS 7.8
    NEW
    spaceclaim (19)
  • 44crates.io—
    19 CVECVSS 6.9
    PoC 1
    axum-core (2) · cargo (2) · lz4-sys (1)
  • 45netapp—
    19 CVE2 critCVSS 6.6
    PoC 3
    oncommand insight (8) · h410s firmware (4) · active iq unified manager (4)
  • 46ао «нтц ит роса»—
    18 CVECVSS 6.8
    PoC 6
    rosa virtualization (8) · роса хром (7) · роса кобальт (3)
  • 47swftools—
    17 CVE2 critCVSS 6.0
    NEWPoC 16
    swftools (17)
  • 48totolink—
    17 CVE12 critCVSS 9.1
    NEWPoC 2
    a860r firmware (6) · a3002r firmware (4) · t6 firmware (4)
  • 49rocket.chat—
    16 CVECVSS 5.4
    NEWNuclei 1PoC 3
    rocket.chat (16)
  • 50фссп россии—
    16 CVE2 critCVSS 7.3
    NEWPoC 4
    ос тд аис фссп россии (16)

Top weaknesses

CWE classes by distinct CVE count.

1CWE-787268—
2CWE-79252—
3CWE-89162—
4CWE-12590—
5CWE-35267—
6CWE-2064—
7CWE-41660—
8CWE-2257—
9CWE-28753—
10CWE-20045—
11CWE-43438—
12CWE-61738—
13CWE-86238—
14CWE-28436—
15CWE-7836—
16CWE-12035—
17CWE-47632—
18CWE-12231—
19CWE-40031—
20CWE-26928—

Sectors

Solution categories ranked by distinct CVE count this period.

  • OSS Libraries552 CVE
    93 crit124 vendorsCVSS 7.7
    swftools (17) · bento4 (11) · libraw (10)
  • Operating Systems475 CVE
    225 crit76 KEV44 vendorsCVSS 8.0
    fedora (121) · осон основа оnyx (115) · astra linux special edition (108)
  • Web & CMS Plugins353 CVE
    57 crit215 vendorsCVSS 7.2
    jfinal cms (21) · xwiki (13) · xwiki-platform (13)
  • Mobile Apps333 CVE
    49 crit13 KEV11 vendorsCVSS 8.3
    android (84) · tensorflow (59) · chrome (42)
  • Enterprise Software290 CVE
    530 crit2 KEV95 vendorsCVSS 8.6
    glpi (14) · cpg bios (11) · inspiron 3910 firmware (11)
  • Networking Infrastructure200 CVE
    94 crit15 KEV54 vendorsCVSS 7.8
    ac18 firmware (14) · ac21 firmware (10) · ac15 firmware (9)
  • Consumer Software139 CVE
    25 vendorsCVSS 7.1
    adobe indesign (17) · indesign (17) · photoshop (16)
  • Hardware Firmware137 CVE
    298 crit3 KEV41 vendorsCVSS 8.8
    wcd9370 firmware (41) · wcd9375 firmware (40) · wcd9380 firmware (40)
  • DevTools & CI124 CVE
    16 crit33 vendorsCVSS 8.0
    ikus060/rdiffweb (20) · rdiffweb (20) · rizin (6)
  • ICS / OT / IoT107 CVE
    100 crit43 vendorsCVSS 9.8
    otfcc (29) · cpy car park server (22) · uwp 3.0 monitoring gateway and controller (11)
  • Security Products91 CVE
    14 crit6 KEV50 vendorsCVSS 7.4
    apex one (10) · trend micro apex one (6) · deep security agent (4)
  • Cloud & SaaS76 CVE
    13 crit48 vendorsCVSS 7.6
    security-advisories (6) · appsmith (3) · emias os (3)
  • AI / ML64 CVE
    1 crit4 vendorsCVSS 8.1
    tensorflow (59) · indy-node (2) · besu (1)
  • Communications56 CVE
    9 crit2 KEV29 vendorsCVSS 8.8
    rocket.chat (16) · javascript sdk (4) · matrix-js-sdk (4)
  • Databases20 CVE
    5 crit13 vendorsCVSS 8.4
    sqlite (3) · oracle exadata (2) · aix (1)
  • Unclassified136 CVE
    20 crit103 vendorsCVSS 6.9
    ос тд аис фссп россии (16) · online tours \& travels management system (5) · 802.2 (4)
Weakness × Sector

Which weaknesses hit which solution categories in September 2022

Cells shaded by share of the sector's hottest weakness. Click a row to open the sector history.

787Out-of-bounds Write79XSS89SQL Injection125Out-of-bounds Read352CSRF20Improper Input Validation416Use After Free22Path Traversal287Improper Authentication200Information ExposureOperating Systems881253711846567OSS Libraries516531216171115195Web & CMS Plugins138523431466Enterprise Software667893797Consumer Software6276323628411Networking Infrastructure4558543751Hardware Firmware31310389142ICS / OT / IoT4464652334DevTools & CI201213122342Security Products648535555