CVE Tools
Sign in
month report

January 2023

Data as of Jun 11, 2026, 06:05 UTCSnapshot v1 Sources CVEList V5+NVD+GHSA+CSAF+FSTEC BDU+CISA KEV+EPSS+Nuclei templates Methodology →

January 2023 closed with 2,619 published CVEs. 338 criticals, 5 added to CISA KEV (3 ransomware-linked). unknown led volume, mostly via welcart e-commerce. Top weakness class — CWE-79 (268 CVE). 10 vendors cracked the top-100 for the first time.

Print view
Total CVEs
2,619
— MoM— YoY
Severity mix
338 / 799
critical / high
KEV added
5
3 ransomware-linked
Nuclei coverage
12.1%
317 CVEs with templates

Time to exploit

How fast the community ships detection after a CVE drops.

Days → Nuclei (median)
1143.9
n=317
Within 7 days
0.0%
Within 30 days
0.0%
Days → KEV (median)
22
n=7
Detection gap

KEV pressure, no Nuclei coverage

January 2023 · vendors with active exploitation listed by CISA but no public detection template.

Weakness × Vendor

What's spreading where in January 2023

Cells shaded by share of vendor's hottest weakness. Click any cell to open the CWE history.

79XSS89SQL Injection787Out-of-bounds Write120Buffer Overflow121CWE-121125Out-of-bounds Read22Path Traversal78OS Command Injection20Improper Input Validation284CWE-284google1191193microsoft corp111674microsoft16164сообщество свободного программного обеспечения3961511insteon23181oracle corp.114maven3217131ао «нппкт»181412oracle14oracle corporation14ооо «русбитех-астра»192141packagist167221

Most discussed CVEs — January 2023

No CVE mentions in the news this month yet.

First time in top-100

Vendors never in top-100 in the prior 24 periods.

Top vendors

Ranked by distinct CVE count this period.

  • 1unknown—
    186 CVE15 critCVSS 6.2
    NEWNuclei 186PoC 179
    welcart e-commerce (4) · letsrecover (3) · wp rss by publishers (3)
  • 2google—
    112 CVECVSS 6.9
    NEWPoC 3
    android (84) · chrome (28) · google chrome (21)
  • 3microsoft—
    109 CVECVSS 7.5
    NEWKEV 1PoC 5
    windows 11 version 22h2 (64) · windows 11 22h2 (64) · windows 11 version 21h2 (64)
  • 4сообщество свободного программного обеспечения—
    102 CVE10 critCVSS 7.0
    NEWKEV 1Nuclei 5PoC 33
    debian gnu/linux (60) · linux (23) · vim (7)
  • 5insteon—
    82 CVE80 critCVSS 9.9
    NEWPoC 16
    hub (82) · hub firmware (76) · insteon hub firmware (6)
  • 6oracle—
    82 CVE1 critCVSS 5.9
    NEWKEV 2Nuclei 6PoC 2
    mysql server (24) · e-business suite (12) · mysql (10)
  • 7maven—
    78 CVE15 critCVSS 7.3
    NEWNuclei 2PoC 6
    org.jenkins-ci.plugins:jira-steps (4) · io.jenkins.plugins:macstadium-orka (3) · org.jenkins-ci.plugins:testquality-updater (3)
  • 8ао "нппкт"—
    76 CVE6 critCVSS 7.1
    NEWKEV 1Nuclei 1PoC 20
    осон основа оnyx (76)
  • 9ооо «русбитех-астра»—
    66 CVE6 critCVSS 7.4
    NEWKEV 1Nuclei 1PoC 16
    astra linux special edition (58) · astra linux common edition (11) · astra linux special edition для «эльбрус» (9)
  • 10packagist—
    65 CVE6 critCVSS 5.9
    NEWNuclei 6PoC 7
    thorsten/phpmyfaq (9) · cakephp/cakephp (7) · froxlor/froxlor (6)
  • 11pdf-xchange—
    65 CVECVSS 6.8
    NEW
    pdf-xchange editor (65)
  • 12redhat—
    65 CVE8 critCVSS 6.6
    NEWPoC 11
    red hat enterprise linux (47) · red hat software collections (27) · red hat openstack platform (5)
  • 13siretta—
    64 CVE43 critCVSS 9.1
    NEWPoC 21
    quartz-gold (64) · quartz-gold firmware (64)
  • 14ооо «ред софт»—
    58 CVE7 critCVSS 6.8
    NEWKEV 1Nuclei 1PoC 17
    ред ос (58)
  • 15ао «ивк»—
    56 CVE3 critCVSS 5.8
    NEWKEV 1PoC 10
    альт 8 сп (51) · альт сп 10 (31) · альт рабочая станция к (1)
  • 16npm—
    47 CVE2 critCVSS 6.3
    NEWNuclei 2PoC 10
    papaparse (2) · serve-lite (2) · @builder.io/qwik (1)
  • 17unisoc (shanghai) technologies co., ltd.—
    39 CVECVSS 5.7
    NEW
    sc9863a/sc9832e/sc7731e/t610/t310/t606/t760/t610/t618/t606/t612/t616/t760/t770/t820/s8000 (39)
  • 18jenkins—
    38 CVE7 critCVSS 7.3
    NEW
    jenkins jira pipeline steps plugin (4) · jira pipeline steps (4) · jenkins orka by macstadium plugin (3)
  • 19pypi—
    38 CVE3 critCVSS 6.3
    NEWNuclei 9PoC 12
    pyload-ng (8) · apache-superset (7) · modoboa (5)
  • 20go—
    33 CVE2 critCVSS 6.7
    NEWNuclei 3PoC 6
    github.com/usememos/memos (6) · github.com/kubeoperator/kubepi (3) · www.velocidex.com/golang/velociraptor (2)
  • 21adobe—
    31 CVECVSS 7.2
    NEWKEV 1PoC 1
    acrobat reader dc (17) · acrobat (17) · acrobat dc (17)
  • 22lenovo group limited—
    31 CVECVSS 5.8
    NEW
    sr645 (20) · sr665 (20) · sr635 (18)
  • 23qualcomm—
    30 CVE2 critCVSS 7.7
    NEW
    qca6574au firmware (27) · wsa8815 firmware (25) · qca6696 firmware (24)
  • 24qualcomm, inc.—
    30 CVE2 critCVSS 7.5
    NEW
    snapdragon (30)
  • 25amd—
    28 CVECVSS 6.3
    NEW
    3rd gen epyc (24) · epyc 75f3 firmware (16) · epyc 7003 firmware (16)
  • 26schneider electric—
    28 CVE10 critCVSS 8.4
    NEW
    igss data server (igssdataserver.exe) (8) · interactive graphical scada system (8) · data center expert (4)
  • 27schneider-electric—
    28 CVE10 critCVSS 7.9
    NEW
    interactive graphical scada system (8) · data center expert (4) · conext combox firmware (3)
  • 28ао «нтц ит роса»—
    28 CVE6 critCVSS 7.6
    NEWNuclei 1PoC 9
    роса хром (17) · rosa virtualization 3.0 (9) · rosa virtualization (7)
  • 29ibm—
    27 CVECVSS 5.4
    NEW
    sterling b2b integrator (7) · sterling b2b integrator standard edition (6) · robotic process automation for cloud pak (6)
  • 30sourcecodester—
    27 CVECVSS 5.5
    NEWNuclei 1PoC 21
    online tours & travels management system (13) · online food ordering system (7) · online flight booking management system (3)
  • 31hpe—
    26 CVECVSS 7.3
    NEW
    aruba edgeconnect enterprise orchestration software (13) · aruba clearpass policy manager (11) · hpe superdome flex server; hpe superdome flex 280 server (1)
  • 32juniper—
    26 CVECVSS 6.9
    NEWPoC 26
    junos (23) · junos os evolved (8)
  • 33juniper networks—
    26 CVECVSS 6.9
    NEWPoC 26
    junos (23) · junos os (23) · junos os evolved (8)
  • 34advanced micro devices inc.—
    25 CVECVSS 6.2
    NEW
    3rd gen amd epyc (23) · 2nd gen amd epyc (17) · 1st gen amd epyc (4)
  • 35apache—
    25 CVE6 critCVSS 7.4
    NEWNuclei 1PoC 1
    superset (7) · http server (3) · iotdb (2)
  • 36apache software foundation—
    25 CVE5 critCVSS 7.5
    NEWNuclei 1PoC 1
    apache superset (7) · http server (3) · apache http server (3)
  • 37gpac—
    25 CVECVSS 7.3
    NEWPoC 10
    gpac (25) · gpac/gpac (1)
  • 38arubanetworks—
    24 CVECVSS 7.4
    NEW
    aruba edgeconnect enterprise orchestrator (13) · clearpass policy manager (11)
  • 39cisco—
    24 CVE1 critCVSS 6.5
    NEWPoC 22
    cisco identity services engine (4) · identity services engine (4) · cisco small business rv series router firmware (4)
  • 40gitlab—
    24 CVE1 critCVSS 5.5
    NEWNuclei 2PoC 4
    gitlab (23) · gitlab runner (1) · runner (1)
  • 41debian—
    23 CVE2 critCVSS 7.1
    NEWKEV 1PoC 8
    debian linux (23)
  • 42mediatek, inc.—
    23 CVE1 critCVSS 6.7
    NEW
    mt7603, mt7613, mt7615, mt7622, mt7628, mt7629, mt7915, mt7916, mt7981, mt7986 (2) · mt6879, mt6895, mt6983 (2) · mt6580, mt6731, mt6735, mt6737, mt6739, mt6753, mt6757, mt6757c, mt6757cd, mt6757ch, mt6761, mt6762, mt6763, mt6765, mt6768, mt6769, mt6771, mt6779, mt6781, mt6785, mt6789, mt6833, mt6853, mt6853t, mt6855, mt6873, mt6875, mt6877, mt6879, mt6883, mt6885, mt6889, mt6891, mt6893, mt6895, mt6983, mt8167, mt8168, mt8173, mt8185, mt8321, mt8362a, mt8365, mt8385, mt8666, mt8675, mt8765, mt8766, mt8768, mt8781, mt8786, mt8788, mt8789, mt8791, mt8791t, mt8797 (2)
  • 43linux—
    21 CVECVSS 6.7
    NEWKEV 1PoC 6
    linux kernel (21)
  • 44nvidia—
    21 CVECVSS 7.2
    NEW
    nvidia dgx servers (20) · dgx a100 firmware (9) · bmc (8)
  • 45fedoraproject—
    19 CVECVSS 6.3
    NEWPoC 6
    fedora (19)
  • 46 amd—
    17 CVECVSS 6.1
    NEW
    2nd gen epyc (14) · ryzen 5000 series (2) · ryzen 3000 series (1)
  • 47dell—
    17 CVECVSS 6.9
    NEW
    policy manager for secure connect gateway (4) · inspiron 3785 firmware (3) · bios (3)
  • 48lenovo—
    17 CVECVSS 5.3
    NEW
    bios (9) · thinkcentre m6600t firmware (4) · thinkcentre m6600s firmware (4)
  • 49novell inc.—
    17 CVE3 critCVSS 6.8
    NEWPoC 5
    suse linux enterprise server (10) · suse linux enterprise server for sap applications (10) · opensuse tumbleweed (8)
  • 50discourse—
    16 CVECVSS 5.8
    NEW
    discourse (15) · discourse-mermaid-theme-component (1) · mermaid (1)

Top weaknesses

CWE classes by distinct CVE count.

1CWE-79268—
2CWE-89227—
3CWE-787166—
4CWE-12099—
5CWE-12198—
6CWE-12591—
7CWE-2287—
8CWE-7867—
9CWE-2065—
10CWE-28451—
11CWE-41651—
12CWE-86251—
13CWE-20045—
14CWE-26941—
15CWE-35239—
16CWE-28738—
17CWE-7737—
18CWE-12236—
19CWE-19030—
20CWE-40027—

Sectors

Solution categories ranked by distinct CVE count this period.

  • Web & CMS Plugins450 CVE
    63 crit260 vendorsCVSS 6.7
    online tours & travels management system (13) · thorsten/phpmyfaq (9) · ghost (8)
  • OSS Libraries403 CVE
    46 crit115 vendorsCVSS 8.0
    gpac (25) · qt (4) · axiom axiomjdk (3)
  • Operating Systems357 CVE
    95 crit54 KEV41 vendorsCVSS 8.6
    осон основа оnyx (76) · debian gnu/linux (60) · astra linux special edition (58)
  • Hardware Firmware258 CVE
    480 crit42 vendorsCVSS 9.3
    sc9863a/sc9832e/sc7731e/t610/t310/t606/t760/t610/t618/t606/t612/t616/t760/t770/t820/s8000 (39) · 3rd gen epyc (24) · 3rd gen amd epyc (23)
  • ICS / OT / IoT253 CVE
    336 crit42 vendorsCVSS 9.5
    hub (82) · hub firmware (76) · quartz-gold (64)
  • Enterprise Software249 CVE
    110 crit48 KEV88 vendorsCVSS 9.2
    glpi (10) · ngeniusone (9) · sterling b2b integrator (7)
  • Networking Infrastructure208 CVE
    136 crit3 KEV66 vendorsCVSS 8.0
    junos (46) · junos os evolved (24) · junos os (23)
  • Consumer Software140 CVE
    7 crit5 KEV31 vendorsCVSS 7.1
    pdf-xchange editor (65) · acrobat (17) · acrobat dc (17)
  • Mobile Apps122 CVE
    5 vendorsCVSS 8.3
    android (85) · chrome (28) · google chrome (21)
  • Databases115 CVE
    7 crit4 KEV22 vendorsCVSS 7.3
    mysql server (61) · vm virtualbox (18) · weblogic server (15)
  • DevTools & CI112 CVE
    25 crit37 vendorsCVSS 7.2
    octopus server (6) · jenkins jira pipeline steps plugin (4) · jira pipeline steps (4)
  • Security Products99 CVE
    13 crit2 KEV64 vendorsCVSS 7.9
    daloradius (4) · freeradius (3) · keycloak (3)
  • Cloud & SaaS71 CVE
    16 crit47 vendorsCVSS 7.5
    security-advisories (5) · emias os (4) · deck (3)
  • Communications33 CVE
    9 crit24 vendorsCVSS 8.1
    modoboa (5) · modoboa/modoboa (5) · listserv (2)
  • AI / ML6 CVE
    1 crit2 vendorsCVSS 9.9
    fossology (1) · harbor (1) · onnx (1)
  • Unclassified263 CVE
    30 crit230 vendorsCVSS 6.0
    online tours \& travels management system (13) · ос тд аис фссп россии (10) · ftp server (5)
Weakness × Sector

Which weaknesses hit which solution categories in January 2023

Cells shaded by share of the sector's hottest weakness. Click a row to open the sector history.

79XSS89SQL Injection787Out-of-bounds Write120Buffer Overflow121CWE-121125Out-of-bounds Read22Path Traversal78OS Command Injection20Improper Input Validation284CWE-284Web & CMS Plugins10310510255OSS Libraries61391114133211125Operating Systems82331032253114ICS / OT / IoT664656832151134Enterprise Software6438111102719Consumer Software172841246751Hardware Firmware58351252759214Networking Infrastructure201324105252855Security Products2071128463DevTools & CI1151127222