CVE Tools
Sign in
month report

December 2023

Data as of Jun 11, 2026, 06:05 UTCSnapshot v1 Sources CVEList V5+NVD+GHSA+CSAF+FSTEC BDU+CISA KEV+EPSS+Nuclei templates Methodology →

December 2023 closed with 2,769 published CVEs. 383 criticals, 11 added to CISA KEV (2 ransomware-linked). adobe led volume, mostly via adobe experience manager. Top weakness class — CWE-79 (566 CVE). 10 vendors cracked the top-100 for the first time.

Print view
Total CVEs
2,769
— MoM— YoY
Severity mix
383 / 867
critical / high
KEV added
11
2 ransomware-linked
Nuclei coverage
17.1%
474 CVEs with templates

Time to exploit

How fast the community ships detection after a CVE drops.

Days → Nuclei (median)
808.0
n=474
Within 7 days
0.0%
Within 30 days
0.0%
Days → KEV (median)
9
n=9
Detection gap

KEV pressure, no Nuclei coverage

December 2023 · vendors with active exploitation listed by CISA but no public detection template.

Weakness × Vendor

What's spreading where in December 2023

Cells shaded by share of vendor's hottest weakness. Click any cell to open the CWE history.

79XSS89SQL Injection787Out-of-bounds Write352CSRF862Missing Authorization434Unrestricted File Upload22Path Traversal125Out-of-bounds Read78OS Command Injection20Improper Input Validationadobe1919123adobe systems inc.1909123google3263302maven135327522ооо «ред софт»1182413сообщество свободного программного обеспечения21611242unisoc (shanghai) technologies co., ltd.85811ооо «русбитех-астра»111412ао «нппкт»13131ао «ивк»10412ibm73122112pypi411152

Most discussed CVEs — December 2023

No CVE mentions in the news this month yet.

Top vendors

Ranked by distinct CVE count this period.

  • 1adobe—
    220 CVECVSS 5.5
    NEW
    adobe experience manager (193) · experience manager (193) · experience manager cloud service (113)
  • 2google—
    198 CVE22 critCVSS 7.3
    NEWKEV 1PoC 1
    android (182) · google chrome (13) · chrome (13)
  • 3maven—
    117 CVE18 critCVSS 7.1
    NEWNuclei 8PoC 28
    com.jfinal:jfinal (27) · org.silverpeas.core:silverpeas-core-web (7) · com.cloudtp.jenkins:paaslane-estimate (4)
  • 4ооо «ред софт»—
    106 CVE6 critCVSS 7.0
    NEWKEV 1Nuclei 4PoC 23
    ред ос (106)
  • 5сообщество свободного программного обеспечения—
    103 CVE10 critCVSS 7.2
    NEWKEV 2Nuclei 4PoC 19
    debian gnu/linux (67) · linux (16) · xwiki platform (5)
  • 6unisoc (shanghai) technologies co., ltd.—
    83 CVECVSS 6.0
    NEW
    sc7731e/sc9832e/sc9863a/t310/t606/t612/t616/t610/t618/t760/t770/t820/s8000 (73) · sc9863a/t310/t606/t612/t616/t610/t618/t760/t770/t820/s8000 (6) · t606/t612/t616 (2)
  • 7ооо «русбитех-астра»—
    82 CVE3 critCVSS 7.2
    NEWKEV 1Nuclei 2PoC 12
    astra linux special edition (81) · astra linux common edition (8) · astra linux special edition для «эльбрус» (3)
  • 8ао "нппкт"—
    68 CVE2 critCVSS 7.2
    NEWKEV 1Nuclei 2PoC 9
    осон основа оnyx (68)
  • 9ао «ивк»—
    57 CVE2 critCVSS 6.9
    NEWNuclei 1PoC 8
    альт сп 10 (51) · альт 8 сп (27)
  • 10redhat—
    56 CVECVSS 5.9
    NEWNuclei 1PoC 8
    red hat enterprise linux (31) · red hat enterprise linux 9 (19) · red hat enterprise linux 8 (18)
  • 11ibm—
    54 CVECVSS 6.2
    NEW
    db2 for linux, unix and windows (8) · infosphere information server (8) · db2 (8)
  • 12microsoft—
    54 CVE4 critCVSS 7.6
    NEWKEV 1Nuclei 1PoC 4
    windows server 2022, 23h2 edition (server core installation) (19) · windows server 2022 (18) · windows server 2019 (18)
  • 13pypi—
    52 CVE5 critCVSS 6.9
    NEWNuclei 12PoC 11
    mlflow (11) · apache-airflow (4) · apache-superset (3)
  • 14unknown—
    52 CVE3 critCVSS 6.9
    NEWNuclei 50PoC 49
    wp mail log (5) · wp all export pro (3) · export any wordpress data to xml/csv (3)
  • 15tenda—
    47 CVE47 critCVSS 9.8
    NEWPoC 19
    w30e firmware (11) · i29 firmware (9) · ax9 firmware (8)
  • 16packagist—
    43 CVE1 critCVSS 5.3
    NEWNuclei 5PoC 18
    concrete5/concrete5 (5) · automad/automad (4) · microweber/microweber (4)
  • 17totolink—
    40 CVE37 critCVSS 9.3
    NEWNuclei 1PoC 19
    ex1800t firmware (18) · x6000r firmware (7) · x2000r firmware (3)
  • 18debian—
    39 CVE1 critCVSS 7.3
    NEWKEV 2Nuclei 2PoC 6
    debian linux (39)
  • 19qualcomm—
    38 CVE3 critCVSS 7.8
    NEWKEV 3
    wcd9380 firmware (36) · qca6391 firmware (35) · wsa8835 firmware (34)
  • 20qualcomm, inc.—
    38 CVE3 critCVSS 7.7
    NEWKEV 3
    snapdragon (38)
  • 21npm—
    37 CVE3 critCVSS 6.5
    NEWNuclei 1PoC 12
    @evershop/evershop (7) · uptime-kuma (2) · nuxt-api-party (2)
  • 22apple—
    35 CVECVSS 6.7
    NEWNuclei 1PoC 4
    macos (33) · ipados (12) · iphone os (12)
  • 23dell—
    35 CVECVSS 7.6
    NEW
    powerprotect data domain management center (8) · powerprotect data protection (7) · emc data domain os (7)
  • 24code-projects—
    32 CVECVSS 4.9
    NEWPoC 32
    client details system (7) · e-commerce website (4) · faculty management system (3)
  • 25go—
    32 CVE1 critCVSS 6.4
    NEWNuclei 2PoC 7
    github.com/traefik/traefik/v3 (3) · github.com/mattermost/mattermost/server/v8 (3) · github.com/traefik/traefik/v2 (3)
  • 26ао «нтц ит роса»—
    31 CVE1 critCVSS 6.3
    NEWNuclei 1PoC 7
    роса хром (19) · rosa virtualization 3.0 (15) · роса кобальт (8)
  • 27honor—
    30 CVE1 critCVSS 4.9
    NEW
    magic os (9) · magic ui (7) · magicos (6)
  • 28mediatek, inc.—
    30 CVECVSS 6.7
    NEW
    mt2735, mt2737, mt6297, mt6298, mt6813, mt6815, mt6833, mt6835, mt6853, mt6855, mt6873, mt6875, mt6875t, mt6877, mt6879, mt6880, mt6883, mt6885, mt6886, mt6889, mt6890, mt6891, mt6893, mt6895, mt6895t, mt6896, mt6897, mt6980, mt6980d, mt6983, mt6985, mt6989, mt6990 (6) · mt6761, mt6765, mt6768, mt6779, mt6781, mt6785, mt6789, mt6833, mt6835, mt6853, mt6855, mt6873, mt6877, mt6879, mt6883, mt6885, mt6886, mt6889, mt6893, mt6895, mt6983, mt6985, mt8188, mt8195, mt8673, mt8781 (3) · mt6765, mt6768, mt6833, mt6879, mt6883, mt6885, mt6889, mt6893, mt6983, mt6985, mt8188, mt8195, mt8797, mt8798 (2)
  • 29samsung—
    30 CVECVSS 5.6
    NEW
    android (15) · exynos 2100 firmware (3) · exynos 980 firmware (3)
  • 30apache—
    28 CVE6 critCVSS 7.4
    NEWNuclei 5PoC 4
    airflow (4) · hertzbeat (3) · ofbiz (3)
  • 31fedoraproject—
    27 CVE1 critCVSS 6.6
    NEWKEV 2Nuclei 2PoC 8
    fedora (27) · extra packages for enterprise linux (4)
  • 32jfinalcms project—
    27 CVECVSS 7.9
    NEWPoC 5
    jfinalcms (27)
  • 33shenzhen tenda technology co., ltd.—
    27 CVE27 critCVSS 9.8
    NEWPoC 9
    tenda i29 (8) · tenda w9 (5) · tenda m3 (4)
  • 34samsung mobile—
    26 CVECVSS 6.1
    NEW
    samsung mobile devices (15) · galaxy store (2) · samsung pass (2)
  • 35ivanti—
    25 CVE19 critCVSS 9.2
    NEW
    avalanche (22) · connect secure (3) · wavelink (3)
  • 36apache software foundation—
    24 CVE6 critCVSS 7.6
    NEWNuclei 4PoC 2
    apache airflow (4) · airflow (4) · apache ofbiz (3)
  • 37hihonor—
    24 CVE1 critCVSS 5.1
    NEW
    magic ui (7) · magic os (5) · nth-an00 firmware (4)
  • 38sourcecodester—
    24 CVECVSS 4.8
    NEWPoC 22
    simple student attendance system (8) · user registration and login system (3) · medicine tracking system (2)
  • 39fedora project—
    22 CVE2 critCVSS 7.2
    NEWKEV 1PoC 5
    fedora (21) · fedora epel (1)
  • 40mozilla—
    22 CVECVSS 7.2
    NEW
    firefox (18) · thunderbird (11) · firefox esr (11)
  • 41phpgurukul—
    20 CVE3 critCVSS 5.4
    NEWNuclei 2PoC 18
    online notes sharing system (6) · nipah virus testing management system (4) · student result management system (3)
  • 42fabian—
    18 CVECVSS 5.5
    NEWPoC 18
    client details system (7) · e-commerce website (4) · library management system (3)
  • 43phpjabbers—
    18 CVECVSS 6.8
    NEWNuclei 2PoC 18
    time slots booking calendar (4) · appointment scheduler (4) · availability booking calendar (4)
  • 44projectworlds pvt. limited—
    18 CVE9 critCVSS 9.3
    NEWPoC 4
    online examination system (7) · student result management system (4) · railway reservation system (3)
  • 45siemens—
    18 CVECVSS 7.4
    NEW
    sinec nms (5) · sinumerik integrate runmyhmi \/automotive (5) · sinumerik integrate runmyhmi/automotive (5)
  • 46gitlab—
    17 CVECVSS 4.7
    NEWPoC 9
    gitlab (17)
  • 47huawei—
    17 CVE1 critCVSS 7.3
    NEWPoC 1
    emui (14) · harmonyos (14) · ar6000 (2)
  • 48nagios enterprises llc—
    17 CVE3 critCVSS 5.8
    NEWNuclei 1
    nagios xi (17)
  • 49ibm corp.—
    16 CVECVSS 6.9
    NEW
    ibm db2 (8) · aix (6) · ibm vios (5)
  • 50jenkins—
    16 CVECVSS 6.0
    NEW
    jenkins paaslane estimate plugin (4) · nexus platform (4) · paaslane estimate (4)

Top weaknesses

CWE classes by distinct CVE count.

1CWE-79566—
2CWE-89237—
3CWE-787181—
4CWE-352113—
5CWE-86295—
6CWE-43472—
7CWE-2265—
8CWE-12561—
9CWE-7859—
10CWE-2057—
11CWE-20053—
12CWE-9451—
13CWE-50243—
14CWE-86341—
15CWE-12040—
16CWE-60140—
17CWE-28436—
18CWE-7735—
19CWE-28734—
20CWE-41634—

Sectors

Solution categories ranked by distinct CVE count this period.

  • Web & CMS Plugins740 CVE
    136 crit462 vendorsCVSS 8.0
    wp mail log (6) · system dashboard (5) · backup migration (4)
  • Enterprise Software457 CVE
    63 crit121 vendorsCVSS 7.6
    nagios xi (19) · cacti (12) · pandora fms (10)
  • OSS Libraries438 CVE
    50 crit2 KEV110 vendorsCVSS 7.3
    com.jfinal:jfinal (27) · org.silverpeas.core:silverpeas-core-web (7) · com.cloudtp.jenkins:paaslane-estimate (4)
  • Operating Systems374 CVE
    77 crit14 KEV51 vendorsCVSS 7.8
    ред ос (106) · astra linux special edition (81) · осон основа оnyx (68)
  • Mobile Apps306 CVE
    51 crit2 KEV9 vendorsCVSS 7.0
    android (213) · emui (14) · harmonyos (14)
  • Consumer Software283 CVE
    4 crit33 vendorsCVSS 7.9
    adobe experience manager (385) · experience manager (193) · experience manager cloud service (113)
  • Hardware Firmware219 CVE
    412 crit1,351 KEV41 vendorsCVSS 8.3
    sc7731e/sc9832e/sc9863a/t310/t606/t612/t616/t610/t618/t760/t770/t820/s8000 (73) · mt2735, mt2737, mt6297, mt6298, mt6813, mt6815, mt6833, mt6835, mt6853, mt6855, mt6873, mt6875, mt6875t, mt6877, mt6879, mt6880, mt6883, mt6885, mt6886, mt6889, mt6890, mt6891, mt6893, mt6895, mt6895t, mt6896, mt6897, mt6980, mt6980d, mt6983, mt6985, mt6989, mt6990 (6) · sc9863a/t310/t606/t612/t616/t610/t618/t760/t770/t820/s8000 (6)
  • Networking Infrastructure210 CVE
    164 crit14 KEV67 vendorsCVSS 8.2
    ex1800t firmware (18) · aleos (15) · w30e firmware (11)
  • Security Products121 CVE
    81 crit43 vendorsCVSS 8.2
    avalanche (22) · connect secure (3) · fortios (3)
  • ICS / OT / IoT100 CVE
    96 crit18 KEV47 vendorsCVSS 7.8
    multiprog (6) · pc worx (6) · pc worx express (6)
  • DevTools & CI88 CVE
    10 crit31 vendorsCVSS 7.7
    gitlab (18) · enterprise server (13) · forgejo (3)
  • Cloud & SaaS84 CVE
    17 crit49 vendorsCVSS 7.5
    online examination system (7) · nextcloud server (4) · security-advisories (4)
  • Communications68 CVE
    13 crit44 vendorsCVSS 7.8
    mattermost (13) · mattermost server (11) · line (8)
  • Databases50 CVE
    1 crit20 vendorsCVSS 6.9
    ibm db2 (8) · postgres advanced server (8) · aix (6)
  • AI / ML31 CVE
    6 crit19 vendorsCVSS 8.0
    mlflow (11) · mlflow/mlflow (10) · gradio (3)
  • Unclassified212 CVE
    60 crit5 KEV171 vendorsCVSS 7.0
    masterlab (10) · repox (6) · мсвсфера (6)
Weakness × Sector

Which weaknesses hit which solution categories in December 2023

Cells shaded by share of the sector's hottest weakness. Click a row to open the sector history.

79XSS89SQL Injection787Out-of-bounds Write352CSRF862Missing Authorization434Unrestricted File Upload22Path Traversal125Out-of-bounds Read78OS Command Injection20Improper Input ValidationWeb & CMS Plugins41215418413481643Enterprise Software295763118813139Operating Systems378166541611OSS Libraries5410223656193311Consumer Software119523146125Hardware Firmware81303622322116Networking Infrastructure1264124232234Security Products17422215443ICS / OT / IoT6472237185DevTools & CI4236522