CVE Tools
Sign in
month report

December 2022

Data as of Jun 11, 2026, 06:05 UTCSnapshot v1 Sources CVEList V5+NVD+GHSA+CSAF+FSTEC BDU+CISA KEV+EPSS+Nuclei templates Methodology →

December 2022 closed with 2,862 published CVEs. 300 criticals, 9 added to CISA KEV (4 ransomware-linked). google led volume, mostly via android. Top weakness class — CWE-79 (342 CVE). 10 vendors cracked the top-100 for the first time.

Print view
Total CVEs
2,862
— MoM— YoY
Severity mix
300 / 794
critical / high
KEV added
9
4 ransomware-linked
Nuclei coverage
7.8%
223 CVEs with templates

Time to exploit

How fast the community ships detection after a CVE drops.

Days → Nuclei (median)
1179.9
n=223
Within 7 days
0.0%
Within 30 days
0.0%
Days → KEV (median)
2
n=4
Detection gap

KEV pressure, no Nuclei coverage

December 2022 · vendors with active exploitation listed by CISA but no public detection template.

Weakness × Vendor

What's spreading where in December 2022

Cells shaded by share of vendor's hottest weakness. Click any cell to open the CWE history.

79XSS787Out-of-bounds Write125Out-of-bounds Read707CWE-70789SQL Injection120Buffer Overflow22Path Traversal416Use After Free78OS Command Injection352CSRFgoogle624932319ао «нппкт»1341181302сообщество свободного программного обеспечения636234211mozilla10295120ооо «русбитех-астра»5321841231mozilla corp.10295120ао «ивк»72312420go171111218ооо «ред софт»71510415tenda463165red hat inc.51361182debian61413432

Most discussed CVEs — December 2022

No CVE mentions in the news this month yet.

First time in top-100

Vendors never in top-100 in the prior 24 periods.

Top vendors

Ranked by distinct CVE count this period.

  • 1google—
    270 CVE3 critCVSS 6.4
    NEWKEV 1PoC 1
    android (257) · google chrome (9) · chrome (6)
  • 2ао "нппкт"—
    243 CVE25 critCVSS 7.4
    NEWKEV 3Nuclei 2PoC 35
    осон основа оnyx (243)
  • 3сообщество свободного программного обеспечения—
    210 CVE26 critCVSS 7.4
    NEWNuclei 2PoC 31
    debian gnu/linux (167) · linux (32) · xrdp (10)
  • 4mozilla—
    175 CVE18 critCVSS 7.5
    NEWKEV 2PoC 17
    firefox (157) · thunderbird (117) · firefox esr (104)
  • 5ооо «русбитех-астра»—
    169 CVE22 critCVSS 7.5
    NEWKEV 2PoC 22
    astra linux special edition (162) · astra linux special edition для «эльбрус» (23) · astra linux common edition (5)
  • 6ао «ивк»—
    144 CVE21 critCVSS 7.7
    NEWKEV 2PoC 14
    альт 8 сп (139) · альт сп 10 (8)
  • 7go—
    126 CVE15 critCVSS 6.6
    NEWNuclei 1PoC 26
    github.com/usememos/memos (48) · helm.sh/helm/v3 (3) · github.com/alist-org/alist/v3 (3)
  • 8ооо «ред софт»—
    122 CVE16 critCVSS 7.5
    NEWKEV 2Nuclei 1PoC 16
    ред ос (122)
  • 9unknown—
    103 CVE10 critCVSS 6.4
    NEWNuclei 103PoC 100
    contest gallery pro (17) · contest gallery (16) · popup manager (2)
  • 10redhat—
    97 CVE7 critCVSS 7.1
    NEWNuclei 3PoC 11
    red hat enterprise linux (85) · red hat satellite (4) · openshift (3)
  • 11tenda—
    91 CVE21 critCVSS 8.0
    NEWPoC 71
    f1203 firmware (22) · w30e firmware (21) · a15 firmware (14)
  • 12debian—
    78 CVE16 critCVSS 7.5
    NEWNuclei 2PoC 20
    debian linux (78)
  • 13фссп россии—
    77 CVE12 critCVSS 7.5
    NEWKEV 2PoC 10
    ос тд аис фссп россии (77)
  • 14ао «концерн вниинс»—
    74 CVE10 critCVSS 7.7
    NEWKEV 2PoC 9
    ос он «стрелец» (74)
  • 15maven—
    56 CVE8 critCVSS 7.1
    NEWNuclei 2PoC 8
    cn.hutool:hutool-json (3) · net.mingsoft:ms-mcms (3) · io.apiman:apiman-manager-api-rest-impl (2)
  • 16microsoft—
    55 CVECVSS 7.5
    NEWKEV 2PoC 1
    windows 10 version 1809 (26) · windows 11 (26) · windows 10 version 22h2 (26)
  • 17canonical—
    54 CVE6 critCVSS 7.5
    NEWPoC 3
    ubuntu (54)
  • 18novell inc.—
    54 CVE6 critCVSS 7.1
    NEWNuclei 1PoC 9
    opensuse leap (46) · suse linux enterprise server (36) · suse linux enterprise server for sap applications (35)
  • 19packagist—
    54 CVE4 critCVSS 6.1
    NEWNuclei 7PoC 21
    feehi/feehicms (8) · typo3/cms (7) · typo3/cms-core (5)
  • 20apple—
    51 CVE3 critCVSS 7.3
    NEWKEV 1PoC 2
    macos (42) · iphone os (42) · ipados (40)
  • 21unisoc (shanghai) technologies co., ltd.—
    49 CVECVSS 6.0
    NEW
    sc9863a/sc9832e/sc7731e/t610/t310/t606/t760/t610/t618/t606/t612/t616/t760/t770/t820/s8000 (26) · sc9863a/sc9832e/sc7731e/t610/t310/t606/t760/t610/t618/t606/t612/t616/t760/t770/t820/s8001 (1) · sc9863a/sc9832e/sc7731e/t610/t310/t606/t760/t610/t618/t606/t612/t616/t760/t770/t820/s8002 (1)
  • 22unspecified—
    49 CVECVSS 4.4
    NEWPoC 6
    movie ticket booking system (5) · house rental system (3) · wp-ban (2)
  • 23npm—
    48 CVE7 critCVSS 6.7
    NEWNuclei 2PoC 9
    jsonwebtoken (4) · nadesiko3 (3) · @cubejs-backend/api-gateway (1)
  • 24usememos—
    47 CVE3 critCVSS 6.5
    NEWPoC 20
    usememos/memos (47) · memos (47)
  • 25siemens—
    44 CVE3 critCVSS 5.5
    NEWNuclei 2PoC 1
    teamcenter visualization v13.3 (12) · teamcenter visualization v13.2 (12) · teamcenter visualization (12)
  • 26pypi—
    42 CVE7 critCVSS 6.3
    NEWNuclei 1PoC 3
    rdiffweb (9) · graphite-web (3) · tensorflow-gpu (2)
  • 27ibm—
    40 CVECVSS 5.8
    NEW
    aix (9) · vios (9) · security verify governance (6)
  • 28adobe—
    39 CVECVSS 5.4
    NEW
    experience manager cloud service (34) · adobe experience manager (34) · experience manager (34)
  • 29nvidia—
    32 CVECVSS 6.6
    NEW
    cloud gaming (26) · virtual gpu (26) · gpu display driver (18)
  • 30huawei—
    29 CVE8 critCVSS 8.0
    NEW
    harmonyos (24) · emui (18) · aslan-al10 firmware (3)
  • 31linux—
    27 CVE1 critCVSS 6.4
    NEWPoC 1
    linux kernel (27) · linux (3)
  • 32openimageio—
    24 CVE6 critCVSS 7.5
    NEWPoC 12
    openimageio (24)
  • 33openimageio project—
    24 CVE6 critCVSS 7.5
    NEWPoC 12
    openimageio (24)
  • 34larry gritz—
    23 CVE5 critCVSS 7.4
    NEWPoC 11
    openimageio (23)
  • 35ао «нтц ит роса»—
    23 CVE10 critCVSS 8.3
    NEWPoC 2
    роса хром (18) · роса кобальт (8) · rosa virtualization (6)
  • 36samsung mobile—
    22 CVECVSS 4.9
    NEW
    samsung mobile devices (18) · samsung pass (2) · samsung calendar (1)
  • 37apache software foundation—
    21 CVE6 critCVSS 7.4
    NEWPoC 2
    apache traffic server (3) · apache cxf (2) · apache zeppelin (2)
  • 38trendnet—
    21 CVE20 critCVSS 9.8
    NEWPoC 9
    tew-755ap firmware (20) · tew-820ap firmware (1)
  • 39fedoraproject—
    20 CVE2 critCVSS 7.6
    NEWNuclei 2PoC 1
    fedora (20) · extra packages for enterprise linux (1)
  • 40qualcomm—
    20 CVECVSS 7.7
    NEW
    wcd9380 firmware (19) · wcn6856 firmware (17) · wsa8835 firmware (17)
  • 41qualcomm, inc.—
    20 CVECVSS 7.6
    NEW
    snapdragon mobile (4) · snapdragon auto, snapdragon compute, snapdragon industrial iot, snapdragon mobile, snapdragon wearables (2) · snapdragon auto, snapdragon compute, snapdragon consumer iot, snapdragon industrial iot, snapdragon mobile, snapdragon wearables (2)
  • 42tendacn—
    19 CVECVSS 7.5
    NEWPoC 19
    ac6 firmware (19)
  • 43apache—
    18 CVE6 critCVSS 7.7
    NEWPoC 1
    traffic server (3) · zeppelin (2) · cxf (2)
  • 44contest-gallery—
    18 CVECVSS 6.3
    NEWNuclei 18PoC 17
    contest gallery (18)
  • 45mediatek, inc.—
    18 CVECVSS 6.7
    NEW
    mt6762, mt6765, mt6768, mt6769, mt6779, mt6781, mt6785, mt6789, mt6833, mt6853, mt6853t, mt6855, mt6873, mt6875, mt6877, mt6879, mt6883, mt6885, mt6889, mt6891, mt6893, mt6895, mt8385, mt8765, mt8766, mt8768, mt8781, mt8786, mt8788, mt8789, mt8791, mt8797 (4) · mt6833, mt6853, mt6855, mt6873, mt6877, mt6893, mt8791 (2) · mt6580, mt6739, mt6761, mt6765, mt6768, mt6771, mt6779, mt6781, mt6785, mt6789, mt6833, mt6853, mt6873, mt6877, mt6879, mt6883, mt6895, mt6983, mt8168, mt8365, mt8385, mt8666, mt8667, mt8675, mt8766, mt8768, mt8781, mt8786, mt8788, mt8789, mt8791, mt8797 (1)
  • 46rubygems—
    17 CVE2 critCVSS 6.6
    NEWPoC 16
    rails-html-sanitizer (4) · loofah (3) · resque-scheduler (2)
  • 47ip-com—
    16 CVE16 critCVSS 9.8
    NEWPoC 1
    m50 firmware (15) · ew9 firmware (1)
  • 48dlink—
    14 CVE4 critCVSS 7.6
    NEWNuclei 1PoC 5
    dir-882 a1 firmware (8) · dir-878 (6) · dir-882 (5)
  • 49hcl software—
    14 CVE6 critCVSS 7.6
    NEW
    notes (3) · domino (3) · hcl digital experience (2)
  • 50kibokolabs—
    13 CVECVSS 5.8
    NEWNuclei 13PoC 3
    chained quiz (13)

Top weaknesses

CWE classes by distinct CVE count.

1CWE-79342—
2CWE-787252—
3CWE-125111—
4CWE-70795—
5CWE-8986—
6CWE-12082—
7CWE-2280—
8CWE-41658—
9CWE-7857—
10CWE-35256—
11CWE-2053—
12CWE-28453—
13CWE-86251—
14CWE-28749—
15CWE-20045—
16CWE-86342—
17CWE-47636—
18CWE-40033—
19CWE-43433—
20CWE-26931—

Sectors

Solution categories ranked by distinct CVE count this period.

  • OSS Libraries510 CVE
    92 crit143 vendorsCVSS 7.2
    github.com/usememos/memos (48) · github.com/alist-org/alist/v3 (3) · helm.sh/helm/v3 (3)
  • Operating Systems452 CVE
    219 crit40 KEV43 vendorsCVSS 7.9
    осон основа оnyx (243) · debian gnu/linux (167) · astra linux special edition (162)
  • Mobile Apps368 CVE
    31 crit12 KEV13 vendorsCVSS 7.8
    android (260) · harmonyos (24) · emui (18)
  • Web & CMS Plugins350 CVE
    53 crit178 vendorsCVSS 6.4
    feehicms (8) · aerocms (7) · flatpress (7)
  • Enterprise Software346 CVE
    74 crit2 KEV90 vendorsCVSS 7.2
    aix (9) · vios (9) · domino (6)
  • Consumer Software304 CVE
    103 crit18 KEV38 vendorsCVSS 8.5
    firefox (304) · thunderbird (216) · firefox esr (198)
  • Networking Infrastructure263 CVE
    93 crit55 vendorsCVSS 8.4
    ac6 firmware (23) · f1203 firmware (22) · w30e firmware (21)
  • Hardware Firmware162 CVE
    168 crit32 vendorsCVSS 7.8
    cloud gaming (26) · sc9863a/sc9832e/sc7731e/t610/t310/t606/t760/t610/t618/t606/t612/t616/t760/t770/t820/s8000 (26) · virtual gpu (26)
  • ICS / OT / IoT101 CVE
    364 crit53 vendorsCVSS 8.6
    iboot-pdu fw (7) · iboot-pdu4-n20 firmware (7) · iboot-pdu4a-n15 firmware (7)
  • Security Products90 CVE
    12 crit50 vendorsCVSS 8.5
    passwordstate (14) · passwordstate browser extension chrome (7) · authentik (3)
  • Cloud & SaaS75 CVE
    20 crit5 KEV38 vendorsCVSS 7.5
    cloud foundation (6) · symantec endpoint protection (4) · vmware cloud foundation (4)
  • DevTools & CI59 CVE
    10 crit27 vendorsCVSS 7.4
    ikus060/rdiffweb (9) · rdiffweb (9) · metersphere (3)
  • Communications51 CVE
    8 crit25 vendorsCVSS 6.9
    planet estream (8) · bigbluebutton (7) · trueconf server (4)
  • Databases28 CVE
    6 crit19 vendorsCVSS 9.1
    solaris (4) · ibm security verify governance (3) · blood bank management system (2)
  • AI / ML9 CVE
    1 crit4 vendorsCVSS 6.8
    paddlepaddle (2) · tensorflow (2) · containerd (1)
  • Unclassified246 CVE
    35 crit2 KEV156 vendorsCVSS 6.4
    ос тд аис фссп россии (77) · lenio (5) · bluetooth core specification (4)
Weakness × Sector

Which weaknesses hit which solution categories in December 2022

Cells shaded by share of the sector's hottest weakness. Click a row to open the sector history.

79XSS787Out-of-bounds Write125Out-of-bounds Read707CWE-70789SQL Injection120Buffer Overflow22Path Traversal416Use After Free78OS Command Injection352CSRFOperating Systems1713279597492OSS Libraries882713301123341216Web & CMS Plugins146563612521Consumer Software603811183122912Enterprise Software11361122616110Networking Infrastructure77671692226Hardware Firmware43324152351Communications221972521811ICS / OT / IoT9108127391Security Products1662331123