CVE Tools
Sign in
month report

November 2022

Data as of Jun 11, 2026, 06:05 UTCSnapshot v1 Sources CVEList V5+NVD+GHSA+CSAF+FSTEC BDU+CISA KEV+EPSS+Nuclei templates Methodology →

November 2022 closed with 2,135 published CVEs. 284 criticals, 10 added to CISA KEV (2 ransomware-linked). сообщество свободного программного обеспечения led volume, mostly via debian gnu/linux. Top weakness class — CWE-79 (294 CVE). 10 vendors cracked the top-100 for the first time.

Print view
Total CVEs
2,135
— MoM— YoY
Severity mix
284 / 748
critical / high
KEV added
10
2 ransomware-linked
Nuclei coverage
11.8%
251 CVEs with templates

Time to exploit

How fast the community ships detection after a CVE drops.

Days → Nuclei (median)
1204.1
n=251
Within 7 days
0.0%
Within 30 days
0.0%
Days → KEV (median)
91
n=8
Detection gap

KEV pressure, no Nuclei coverage

November 2022 · vendors with active exploitation listed by CISA but no public detection template.

Weakness × Vendor

What's spreading where in November 2022

Cells shaded by share of vendor's hottest weakness. Click any cell to open the CWE history.

79XSS787Out-of-bounds Write89SQL Injection352CSRF20Improper Input Validation22Path Traversal200Information Exposure416Use After Free707CWE-707434Unrestricted File Uploadсообщество свободного программного обеспечения527161125ао «нппкт»12351130google1815130ооо «русбитех-астра»1265124microsoft corp7312apple11721127maven927311051packagist4433131fedoraproject26132ооо «ред софт»77115324debian19214microsoft4

Most discussed CVEs — November 2022

No CVE mentions in the news this month yet.

First time in top-100

Vendors never in top-100 in the prior 24 periods.

Top vendors

Ranked by distinct CVE count this period.

  • 1сообщество свободного программного обеспечения—
    148 CVE8 critCVSS 6.9
    NEWNuclei 5PoC 24
    debian gnu/linux (118) · linux (19) · webkitgtk (10)
  • 2ао "нппкт"—
    139 CVE3 critCVSS 6.9
    NEWKEV 2PoC 19
    осон основа оnyx (139)
  • 3google—
    137 CVE2 critCVSS 7.0
    NEWKEV 2PoC 14
    chrome (65) · google chrome (58) · android (47)
  • 4ооо «русбитех-астра»—
    111 CVE4 critCVSS 7.0
    NEWKEV 2PoC 15
    astra linux special edition (110) · astra linux special edition для «эльбрус» (12)
  • 5microsoft—
    103 CVE3 critCVSS 7.3
    NEWKEV 7PoC 6
    windows server 2022 (39) · windows 11 (38) · windows server 2019 (37)
  • 6apple—
    95 CVE3 critCVSS 7.0
    NEWKEV 1PoC 5
    macos (79) · iphone os (74) · ipados (53)
  • 7maven—
    93 CVE20 critCVSS 6.9
    NEWNuclei 6PoC 10
    com.liferay.portal:release.portal.bom (11) · com.liferay.portal:release.dxp.bom (8) · org.jeecgframework.boot:jeecg-module-system (4)
  • 8packagist—
    80 CVE8 critCVSS 6.2
    NEWNuclei 9PoC 23
    concrete5/concrete5 (12) · librenms/librenms (8) · tribalsystems/zenario (7)
  • 9fedoraproject—
    69 CVE5 critCVSS 6.6
    NEWNuclei 1PoC 13
    fedora (69) · extra packages for enterprise linux (2)
  • 10ооо «ред софт»—
    67 CVE8 critCVSS 6.6
    NEWKEV 1Nuclei 3PoC 12
    ред ос (67)
  • 11debian—
    65 CVE4 critCVSS 7.1
    NEWPoC 15
    debian linux (65)
  • 12unknown—
    64 CVE7 critCVSS 6.6
    NEWNuclei 64PoC 48
    wp user merger (3) · booster for woocommerce (2) · booster elite for woocommerce (2)
  • 13pypi—
    59 CVE6 critCVSS 5.8
    NEWNuclei 1PoC 13
    tensorflow (25) · tensorflow-gpu (24) · tensorflow-cpu (24)
  • 14intel—
    58 CVECVSS 6.7
    NEW
    xmm 7560 firmware (9) · nuc kit wireless adapter driver installer (4) · active management technology firmware (4)
  • 15cisco—
    47 CVECVSS 6.0
    NEWPoC 46
    cisco firepower management center (21) · secure firewall management center (21) · cisco firepower threat defense software (13)
  • 16redhat—
    45 CVE5 critCVSS 7.7
    NEWPoC 9
    red hat enterprise linux (41) · migration toolkit for applications (5) · migration toolkit for runtimes (5)
  • 17ibm—
    43 CVE3 critCVSS 5.7
    NEW
    cics tx (11) · infosphere information server (10) · robotic process automation for cloud pak (3)
  • 18novell inc.—
    39 CVE5 critCVSS 7.5
    NEWPoC 6
    opensuse leap (32) · opensuse tumbleweed (17) · suse linux enterprise server for sap applications (11)
  • 19ао «нтц ит роса»—
    37 CVE1 critCVSS 6.9
    NEWPoC 11
    роса хром (22) · rosa virtualization 3.0 (11) · rosa virtualization (7)
  • 20npm—
    35 CVE4 critCVSS 6.6
    NEWKEV 1Nuclei 2PoC 4
    hummus (4) · muhammara (4) · sweetalert2 (4)
  • 21fedora project—
    34 CVE4 critCVSS 6.8
    NEWNuclei 1PoC 3
    fedora (33) · coreos (1)
  • 22go—
    34 CVE8 critCVSS 7.1
    NEWNuclei 2PoC 3
    github.com/ibax-io/go-ibax (5) · github.com/grafana/grafana (3) · github.com/hashicorp/nomad (2)
  • 23tenda—
    34 CVE18 critCVSS 8.5
    NEWNuclei 3PoC 9
    w15e firmware (10) · ac18 firmware (9) · ac23 firmware (8)
  • 24ао «ивк»—
    33 CVE1 critCVSS 6.8
    NEWPoC 6
    альт 8 сп (25) · альт сп 10 (9)
  • 25arubanetworks—
    29 CVE1 critCVSS 6.6
    NEW
    sd-wan (16) · arubaos (16) · edgeconnect enterprise (13)
  • 26apache software foundation—
    28 CVE8 critCVSS 7.9
    NEWNuclei 1PoC 1
    apache airflow (8) · apache dolphinscheduler (3) · ivy (2)
  • 27canonical—
    28 CVECVSS 6.7
    NEWPoC 8
    ubuntu (28)
  • 28unspecified—
    28 CVECVSS 4.3
    NEWPoC 7
    gpac (2) · hospital management center (2) · student attendance management system (2)
  • 29apache—
    27 CVE8 critCVSS 7.8
    NEWNuclei 1
    airflow (9) · dolphinscheduler (3) · archiva (2)
  • 30insyde—
    26 CVECVSS 7.2
    NEW
    kernel (25) · insydeh2o (1)
  • 31jenkins—
    24 CVE4 critCVSS 6.6
    NEWPoC 1
    jenkins ns-nd integration performance publisher plugin (3) · ns-nd integration performance publisher (3) · delete log (2)
  • 32moxa inc.—
    24 CVE10 critCVSS 8.3
    NEW
    tap-323 series (8) · moxa tap-213 (8) · moxa awk-1131a (8)
  • 33siemens—
    24 CVE4 critCVSS 7.1
    NEW
    syngo dynamics cardiovascular imaging and information system (7) · syngo dynamics (7) · teamcenter visualization v14.0 (6)
  • 34tensorflow—
    23 CVECVSS 5.2
    NEWPoC 8
    tensorflow (23)
  • 35oracle—
    22 CVECVSS 6.5
    NEWNuclei 2PoC 1
    oracle exadata (19) · oracle vm server for x86 (17) · restaurant menu - food ordering system - table reservation (2)
  • 36ооо "вебсофт девелопмент"—
    22 CVE3 critCVSS 7.5
    NEW
    websoft hcm (22)
  • 37hpe—
    20 CVECVSS 7.5
    NEWNuclei 1
    aruba edgeconnect enterprise software (13) · hf20c firmware (3) · hf20 firmware (3)
  • 38huawei—
    20 CVE5 critCVSS 7.6
    NEW
    emui (20) · harmonyos (20)
  • 39xen—
    20 CVECVSS 6.3
    NEW
    xen (20)
  • 40mediatek, inc.—
    18 CVECVSS 6.7
    NEW
    mt6762, mt6768, mt6769, mt6779, mt6781, mt6785, mt6789, mt6833, mt6853, mt6853t, mt6855, mt6873, mt6875, mt6877, mt6879, mt6883, mt6885, mt6889, mt6891, mt6893, mt6895, mt6983, mt8168, mt8185, mt8365, mt8696, mt8768, mt8786, mt8789, mt8791, mt8797, mt8798 (3) · mt6879, mt6895, mt6983 (2) · mt6983, mt8871, mt8891 (2)
  • 41netapp—
    18 CVECVSS 7.1
    NEWPoC 6
    h410s firmware (12) · h700s firmware (12) · h300s firmware (12)
  • 42the linux foundation—
    18 CVECVSS 6.3
    NEW
    xen (18)
  • 43fortinet—
    17 CVECVSS 5.7
    NEW
    fortios (4) · fortiadc (3) · fortinet fortiadc (3)
  • 44liferay—
    17 CVE2 critCVSS 6.4
    NEWNuclei 2
    liferay portal (17) · digital experience platform (14) · dxp (7)
  • 45linux—
    17 CVECVSS 6.6
    NEWPoC 1
    linux kernel (16) · linux_kernel (1) · layer 2 tunneling protocol (1)
  • 46canteen management system project—
    16 CVE1 critCVSS 6.7
    NEWPoC 4
    canteen management system (16)
  • 47hewlett packard enterprise—
    16 CVE1 critCVSS 6.6
    NEW
    aruba mobility conductor (formerly mobility master); aruba mobility controllers; wlan gateways and sd-wan gateways managed by aruba central (16)
  • 48online diagnostic lab management system project—
    16 CVE2 critCVSS 7.6
    NEWPoC 4
    online diagnostic lab management system (16)
  • 49sanitization management system project—
    16 CVE2 critCVSS 6.8
    NEWPoC 8
    sanitization management system (16)
  • 50struktur—
    16 CVECVSS 6.5
    NEWPoC 5
    libde265 (16)

Top weaknesses

CWE classes by distinct CVE count.

1CWE-79294—
2CWE-787157—
3CWE-89148—
4CWE-35280—
5CWE-2077—
6CWE-2263—
7CWE-20056—
8CWE-41656—
9CWE-70748—
10CWE-43443—
11CWE-12542—
12CWE-28438—
13CWE-7838—
14CWE-28737—
15CWE-9433—
16CWE-36232—
17CWE-11931—
18CWE-12030—
19CWE-86229—
20CWE-40026—

Sectors

Solution categories ranked by distinct CVE count this period.

  • OSS Libraries438 CVE
    69 crit1 KEV95 vendorsCVSS 7.7
    libde265 (32) · bento4 (20) · freerdp (14)
  • Operating Systems394 CVE
    134 crit250 KEV44 vendorsCVSS 7.3
    осон основа оnyx (139) · debian gnu/linux (118) · astra linux special edition (110)
  • Web & CMS Plugins391 CVE
    80 crit207 vendorsCVSS 7.7
    liferay portal (17) · bluespice (15) · digital experience platform (14)
  • Enterprise Software364 CVE
    2,794 crit1 KEV103 vendorsCVSS 9.4
    glpi (20) · h300s firmware (12) · h410s firmware (12)
  • Mobile Apps259 CVE
    27 crit9 KEV8 vendorsCVSS 7.1
    chrome (65) · google chrome (58) · android (47)
  • Networking Infrastructure218 CVE
    118 crit2 KEV46 vendorsCVSS 9.6
    cisco firepower management center (41) · firepower threat defense (25) · secure firewall management center (21)
  • Hardware Firmware190 CVE
    33 crit28 vendorsCVSS 8.2
    geforce r470 (10) · geforce r515 (10) · gpu display driver (10)
  • Cloud & SaaS120 CVE
    34 crit40 vendorsCVSS 7.8
    xen (18) · omnissa workspace one assist (5) · workspace one assist (5)
  • ICS / OT / IoT100 CVE
    649 crit43 vendorsCVSS 9.9
    moxa awk-1131a (8) · moxa awk-1137c (8) · moxa awk-3131a (8)
  • Security Products99 CVE
    7 crit46 vendorsCVSS 7.4
    apex one (8) · trend micro apex one (8) · acronis cyber protect home office (6)
  • DevTools & CI78 CVE
    19 crit23 vendorsCVSS 6.9
    octopus server (4) · jenkins ns-nd integration performance publisher plugin (3) · ns-nd integration performance publisher (3)
  • Consumer Software59 CVE
    6 crit24 vendorsCVSS 8.3
    ffmpeg (2) · gpac (2) · hospital management center (2)
  • Communications42 CVE
    16 crit2 KEV27 vendorsCVSS 8.3
    mattermost (3) · better messages (2) · better messages (wordpress plugin) (2)
  • AI / ML39 CVE
    4 crit8 vendorsCVSS 8.2
    tensorflow (24) · opendaylight (3) · knative func (1)
  • Databases35 CVE
    2 crit11 vendorsCVSS 6.6
    oracle exadata (19) · oracle vm server for x86 (17) · restaurant menu - food ordering system - table reservation (2)
  • Unclassified141 CVE
    24 crit2 KEV84 vendorsCVSS 7.0
    automotive shop management system (12) · ос тд аис фссп россии (9) · candidats (8)
Weakness × Sector

Which weaknesses hit which solution categories in November 2022

Cells shaded by share of the sector's hottest weakness. Click a row to open the sector history.

79XSS787Out-of-bounds Write89SQL Injection352CSRF20Improper Input Validation22Path Traversal200Information Exposure416Use After Free707CWE-707434Unrestricted File UploadOperating Systems10621122101443Web & CMS Plugins1444554311132411OSS Libraries6332209715115151Enterprise Software7518261013141711Networking Infrastructure254661226113Hardware Firmware523165172ICS / OT / IoT1168210101143Consumer Software3161633533Security Products143216341Cloud & SaaS125334511