February 2024

February 2024 closed with 2,983 published CVEs. 322 criticals, 9 added to CISA KEV (4 ransomware-linked). сообщество свободного программного обеспечения led volume, mostly via linux. Top weakness class — CWE-79 (438 CVE). 10 vendors cracked the top-100 for the first time.

Time to exploit

How fast the community ships detection after a CVE drops.

Top vendors

Ranked by distinct CVE count this period.

• 1сообщество свободного программного обеспечения—
  405 CVE10 critCVSS 6.4
  NEWPoC 28
  linux (303) · debian gnu/linux (194) · envoy (5)
• 2linux—
  299 CVECVSS 6.1
  NEWPoC 4
  linux kernel (299) · linux (279)
• 3ооо «ред софт»—
  205 CVE4 critCVSS 6.6
  NEWPoC 21
  ред ос (205)
• 4ооо «русбитех-астра»—
  183 CVE3 critCVSS 6.5
  NEWPoC 17
  astra linux special edition (144) · astra linux special edition для «эльбрус» (60) · astra linux common edition (8)
• 5ао "нппкт"—
  96 CVE4 critCVSS 6.7
  NEWPoC 12
  осон основа оnyx (96)
• 6ао «ивк»—
  92 CVECVSS 6.3
  NEWPoC 10
  альт сп 10 (84) · альт 8 сп (56)
• 7microsoft—
  90 CVE9 critCVSS 7.8
  NEWKEV 5Nuclei 1PoC 4
  windows server 2022, 23h2 edition (server core installation) (44) · windows 11 23h2 (43) · windows 11 22h2 (43)
• 8maven—
  89 CVE20 critCVSS 7.2
  NEWNuclei 1PoC 6
  com.liferay.portal:release.portal.bom (33) · com.liferay.portal:release.dxp.bom (32) · org.apache.dolphinscheduler:dolphinscheduler (4)
• 9ibm—
  86 CVE2 critCVSS 6.0
  NEWNuclei 2PoC 1
  powersc (13) · security verify access appliance (12) · security verify access docker (12)
• 10redhat—
  79 CVE3 critCVSS 6.7
  NEWPoC 6
  red hat enterprise linux (59) · red hat enterprise linux 7 (19) · enterprise linux (19)
• 11canonical—
  76 CVECVSS 6.4
  NEWPoC 8
  ubuntu (74) · lxd (2) · ubuntu edk ii (1)
• 12intel—
  76 CVECVSS 5.9
  NEW
  thunderbolt dch driver (21) · intel proset/wireless wifi (10) · intel killer wi-fi (10)
• 13ао «нтц ит роса»—
  71 CVE1 critCVSS 6.5
  NEWPoC 6
  rosa virtualization 3.0 (53) · роса хром (19) · роса кобальт (12)
• 14fedoraproject—
  69 CVE11 critCVSS 7.1
  NEWPoC 16
  fedora (68) · unbound (1)
• 15google—
  69 CVE4 critCVSS 7.3
  NEWPoC 3
  android (51) · google chrome (12) · chrome (12)
• 16pypi—
  66 CVE12 critCVSS 6.9
  NEWNuclei 4PoC 9
  vyper (6) · apache-superset (6) · clearml (3)
• 17packagist—
  64 CVE6 critCVSS 6.2
  NEWNuclei 2PoC 8
  moodle/moodle (7) · getkirby/cms (6) · typo3/cms-core (4)
• 18go—
  52 CVE2 critCVSS 5.5
  NEWPoC 3
  github.com/mattermost/mattermost/server/v8 (11) · github.com/greenpau/caddy-security (10) · github.com/apache/incubator-answer (3)
• 19dell—
  47 CVE5 critCVSS 6.8
  NEW
  unity (16) · unity operating environment (16) · supportassist for home pcs (3)
• 20oracle—
  47 CVECVSS 5.5
  NEWKEV 1Nuclei 1PoC 1
  mysql server (12) · e-business suite (9) · graalvm enterprise edition (5)
• 21apache—
  41 CVE11 critCVSS 7.3
  NEWPoC 4
  superset (6) · dolphinscheduler (5) · solr (4)
• 22apache software foundation—
  38 CVE8 critCVSS 7.3
  NEWPoC 2
  apache superset (6) · apache dolphinscheduler (5) · apache solr (4)
• 23liferay—
  35 CVE13 critCVSS 7.1
  NEWNuclei 1
  digital experience platform (35) · liferay portal (34) · dxp (33)
• 24fedora project—
  34 CVE3 critCVSS 7.5
  NEWPoC 7
  fedora (34)
• 25debian—
  33 CVE2 critCVSS 6.5
  NEWPoC 7
  debian linux (33)
• 26qnap—
  32 CVE1 critCVSS 5.7
  NEWNuclei 1PoC 2
  qutscloud (29) · quts hero (29) · qts (29)
• 27qnap systems, inc.—
  32 CVE1 critCVSS 5.7
  NEWNuclei 1PoC 2
  qts (29) · qutscloud (28) · quts hero (28)
• 28adobe—
  31 CVE3 critCVSS 6.8
  NEW
  acrobat (14) · acrobat dc (14) · acrobat reader (14)
• 29npm—
  29 CVE4 critCVSS 7.0
  NEWNuclei 1PoC 8
  stimulsoft-dashboards-js (3) · undici (2) · ckeditor4 (2)
• 30siemens—
  29 CVE1 critCVSS 7.2
  NEW
  tecnomatix plant simulation (10) · tecnomatix plant simulation v2201 (10) · tecnomatix plant simulation v2302 (10)
• 31code-projects—
  28 CVE6 critCVSS 7.7
  NEWPoC 14
  simple school management system (8) · library system (5) · task manager (5)
• 32apple—
  27 CVECVSS 6.0
  NEW
  macos (23) · iphone os (17) · ios and ipados (16)
• 33huawei—
  26 CVE4 critCVSS 7.2
  NEW
  harmonyos (26) · emui (25)
• 34qualcomm—
  26 CVE1 critCVSS 7.4
  NEW
  fastconnect 7800 firmware (25) · fastconnect 6900 firmware (25) · wcd9380 firmware (25)
• 35qualcomm, inc.—
  26 CVE1 critCVSS 7.5
  NEW
  snapdragon (26)
• 36unknown—
  25 CVE2 critCVSS 6.1
  NEWNuclei 25PoC 24
  chartjs (2) · mappress maps for wordpress (2) · wp jobsearch (2)
• 37netapp—
  24 CVECVSS 6.3
  NEWPoC 6
  active iq unified manager (10) · oncommand insight (5) · storagegrid (3)
• 38sourcecodester—
  22 CVE1 critCVSS 5.5
  NEWPoC 20
  employee management system (5) · online job portal (3) · testimonial page manager (2)
• 39dell technologies—
  21 CVE1 critCVSS 7.3
  NEW
  emc unity operating environment (15) · powerprotect data manager (2) · encryption (1)
• 40f5—
  20 CVECVSS 7.2
  NEW
  big-ip (15) · big-ip application security manager (12) · big-ip advanced firewall manager (9)
• 41autodesk—
  19 CVECVSS 7.8
  NEW
  autocad (19) · autocad architecture (19) · autocad electrical (19)
• 42novell inc.—
  19 CVE1 critCVSS 6.8
  NEWPoC 8
  suse linux enterprise server for sap applications (15) · suse linux enterprise server (15) · opensuse leap (12)
• 43samsung—
  19 CVECVSS 5.9
  NEWPoC 1
  android (11) · galaxy store (4) · gallery (1)
• 44crates.io—
  18 CVECVSS 6.7
  NEW
  ckb (10) · surrealdb (3) · svix (2)
• 45flusity—
  18 CVE1 critCVSS 7.7
  NEWPoC 7
  flusity (18)
• 46mozilla—
  18 CVE1 critCVSS 6.8
  NEWPoC 2
  firefox (16) · thunderbird (8) · firefox esr (8)
• 47samsung mobile—
  18 CVECVSS 5.8
  NEWPoC 1
  samsung mobile devices (11) · galaxy store (4) · samsung internet (1)
• 48codeastro—
  15 CVE1 critCVSS 5.3
  NEWPoC 13
  membership management system (7) · house rental management system (2) · restaurant pos system (2)
• 49hcl software—
  15 CVECVSS 4.4
  NEW
  bigfix platform (6) · hcl sametime (5) · hcl connections (1)
• 50dlink—
  14 CVE4 critCVSS 8.1
  NEWPoC 8
  dir-823g (8) · dir-823g firmware (8) · dir-816 firmware (2)

Top weaknesses

CWE classes by distinct CVE count.

Sectors

Solution categories ranked by distinct CVE count this period.

• Web & CMS Plugins743 CVE
  145 crit476 vendorsCVSS 6.9
  imagerecycle pdf & image compression (10) · imagerecycle pdf \& image compression (10) · wp recipe maker (10)
• Operating Systems703 CVE
  110 crit107 KEV46 vendorsCVSS 7.8
  linux (582) · linux kernel (299) · ред ос (205)
• OSS Libraries494 CVE
  103 crit132 vendorsCVSS 9.8
  libbiosig (18) · node.js (10) · axiom axiomjdk (6)
• Enterprise Software449 CVE
  104 crit6 KEV125 vendorsCVSS 7.2
  unity (16) · unity operating environment (16) · powersc (13)
• Hardware Firmware248 CVE
  577 crit39 vendorsCVSS 9.6
  thunderbolt dch driver (41) · intel killer wi-fi (10) · intel proset/wireless wifi (10)
• Networking Infrastructure153 CVE
  34 crit7 KEV63 vendorsCVSS 7.6
  dir-823g (8) · dir-823g firmware (8) · er7206 firmware (8)
• Mobile Apps141 CVE
  14 crit7 vendorsCVSS 7.1
  android (64) · harmonyos (26) · emui (25)
• Security Products123 CVE
  19 crit6 KEV63 vendorsCVSS 7.8
  big-ip (15) · pan-os (15) · big-ip application security manager (12)
• Consumer Software113 CVE
  18 crit37 vendorsCVSS 7.5
  autocad (28) · autocad architecture (28) · autocad electrical (28)
• ICS / OT / IoT94 CVE
  37 crit45 vendorsCVSS 8.1
  feverwarn (6) · feverwarn firmware (6) · nav2 (4)
• Databases80 CVE
  4 crit3 KEV15 vendorsCVSS 7.5
  mysql server (34) · installed base (11) · weblogic server (11)
• Communications67 CVE
  23 crit36 vendorsCVSS 8.3
  mattermost (16) · mattermost server (13) · mastodon (11)
• DevTools & CI63 CVE
  16 crit30 vendorsCVSS 9.1
  gitlab (24) · enterprise server (11) · github enterprise server (2)
• Cloud & SaaS59 CVE
  9 crit36 vendorsCVSS 7.6
  aria operations for networks (5) · vmware aria operations for networks (5) · qemu (3)
• AI / ML43 CVE
  10 crit22 vendorsCVSS 7.8
  clearml (12) · onnx (4) · robot operating system (4)
• Unclassified189 CVE
  55 crit142 vendorsCVSS 7.1
  novel-plus (12) · caddy-security (5) · views for wpforms (5)