CVE Tools
Sign in
month report

November 2021

Data as of Jun 11, 2026, 06:05 UTCSnapshot v1 Sources CVEList V5+NVD+GHSA+CSAF+FSTEC BDU+CISA KEV+EPSS+Nuclei templates Methodology →

November 2021 closed with 1,694 published CVEs. 199 criticals, 291 added to CISA KEV (73 ransomware-linked). unknown led volume, mostly via simple download monitor. Top weakness class — CWE-79 (227 CVE). 10 vendors cracked the top-100 for the first time.

Print view
Total CVEs
1,694
— MoM— YoY
Severity mix
199 / 635
critical / high
KEV added
291
73 ransomware-linked
Nuclei coverage
12.0%
203 CVEs with templates

Time to exploit

How fast the community ships detection after a CVE drops.

Days → Nuclei (median)
1575.3
n=203
Within 7 days
0.0%
Within 30 days
0.0%
Days → KEV (median)
140
n=9
Detection gap

KEV pressure, no Nuclei coverage

November 2021 · vendors with active exploitation listed by CISA but no public detection template.

Weakness × Vendor

What's spreading where in November 2021

Cells shaded by share of vendor's hottest weakness. Click any cell to open the CWE history.

79XSS787Out-of-bounds Write20Improper Input Validation89SQL Injection352CSRF416Use After Free125Out-of-bounds Read120Buffer Overflow22Path Traversal119Memory Buffer Boundsgoogle112418182debian31582143313сообщество свободного программного обеспечения81265120312microsoft corp2721911fedoraproject510321161313ао «нппкт»21232422microsoft211ооо «русбитех-астра»210312131pypi42111023ао «концерн вниинс»2102211intel312maven4113

Most discussed CVEs — November 2021

No CVE mentions in the news this month yet.

First time in top-100

Vendors never in top-100 in the prior 24 periods.

Top vendors

Ranked by distinct CVE count this period.

  • 1unknown—
    127 CVE4 critCVSS 6.1
    NEWNuclei 127PoC 56
    simple download monitor (4) · accept donations with paypal (3) · qr redirector (2)
  • 2google—
    95 CVE3 critCVSS 7.3
    NEWKEV 2PoC 6
    tensorflow (34) · google chrome (32) · chrome (31)
  • 3debian—
    88 CVE8 critCVSS 7.6
    NEWKEV 3PoC 13
    debian linux (88)
  • 4microsoft—
    87 CVE3 critCVSS 7.1
    NEWKEV 5Nuclei 2PoC 2
    windows server 2016 (29) · windows server 2019 (28) · microsoft edge (28)
  • 5сообщество свободного программного обеспечения—
    87 CVE13 critCVSS 7.3
    NEWKEV 1Nuclei 5PoC 15
    debian gnu/linux (67) · busybox (14) · linux (6)
  • 6fedoraproject—
    79 CVE9 critCVSS 7.5
    NEWKEV 3PoC 21
    fedora (79) · extra packages for enterprise linux (3)
  • 7ао "нппкт"—
    74 CVE6 critCVSS 7.5
    NEWKEV 2PoC 11
    осон основа оnyx (74)
  • 8ооо «русбитех-астра»—
    58 CVE4 critCVSS 7.4
    NEWKEV 1PoC 8
    astra linux special edition (58) · astra linux special edition для «эльбрус» (11)
  • 9pypi—
    56 CVE2 critCVSS 6.5
    NEWPoC 5
    tensorflow-cpu (34) · tensorflow-gpu (34) · tensorflow (34)
  • 10ао «концерн вниинс»—
    52 CVE2 critCVSS 7.8
    NEWKEV 2PoC 4
    ос он «стрелец» (52)
  • 11intel—
    50 CVECVSS 6.6
    NEW
    ac 3165 firmware (12) · ax210 firmware (12) · ax201 firmware (12)
  • 12maven—
    46 CVE18 critCVSS 7.9
    NEWNuclei 3PoC 3
    org.jenkins-ci.main:jenkins-core (13) · org.apache.ozone:ozone-main (7) · software.amazon.awssdk.iotdevicesdk:aws-iot-device-sdk (4)
  • 13packagist—
    46 CVE7 critCVSS 6.7
    NEWNuclei 2PoC 8
    concrete5/core (6) · moodle/moodle (4) · symfony/symfony (3)
  • 14adobe—
    45 CVECVSS 7.2
    NEW
    after effects (11) · adobe after effects (11) · adobe prelude (11)
  • 15npm—
    44 CVE7 critCVSS 7.0
    NEWNuclei 1PoC 11
    aws-iot-device-sdk-v2 (4) · nodebb (3) · apostrophe (2)
  • 16ibm—
    43 CVE1 critCVSS 6.0
    NEW
    security guardium key lifecycle manager (14) · security key lifecycle manager (14) · infosphere information server (7)
  • 17amd—
    40 CVECVSS 6.5
    NEW
    epyc 7443p firmware (21) · epyc 7313 firmware (21) · epyc 75f3 firmware (21)
  • 18novell inc.—
    38 CVE4 critCVSS 7.6
    NEWPoC 3
    opensuse leap (34) · suse linux enterprise server (12) · suse linux enterprise server for sap applications (9)
  • 19ооо «ред софт»—
    36 CVE5 critCVSS 7.2
    NEWPoC 6
    ред ос (36)
  • 20tensorflow—
    34 CVECVSS 6.5
    NEWPoC 4
    tensorflow (34)
  • 21huawei—
    33 CVE2 critCVSS 7.1
    NEW
    harmonyos (20) · magic ui (7) · emui (7)
  • 22dell—
    32 CVE2 critCVSS 7.4
    NEW
    cloudlink (7) · emc cloud link (5) · dell emc streaming data platform (5)
  • 23redhat—
    30 CVE11 critCVSS 7.1
    NEWPoC 5
    red hat enterprise linux (12) · openshift container platform (12) · enterprise linux (4)
  • 24siemens—
    29 CVE3 critCVSS 8.1
    NEWPoC 1
    talon tc compact firmware (13) · talon tc modular firmware (13) · nucleus source code (13)
  • 25apache software foundation—
    25 CVE7 critCVSS 8.1
    NEWNuclei 2PoC 2
    apache ozone (8) · apache traffic server (6) · traffic server (3)
  • 26apache—
    24 CVE7 critCVSS 7.9
    NEWNuclei 2PoC 1
    ozone (8) · traffic server (6) · superset (2)
  • 27jetbrains—
    24 CVE5 critCVSS 6.8
    NEW
    teamcity (10) · youtrack mobile (6) · hub (4)
  • 28cisco—
    21 CVE4 critCVSS 7.4
    NEWPoC 21
    cisco common services platform collector software (4) · common services platform collector (4) · cisco common services platform collector (4)
  • 29go—
    21 CVE2 critCVSS 6.4
    NEWNuclei 1PoC 1
    github.com/cloudflare/cfrpki (6) · github.com/hyperledger/fabric (2) · github.com/stevenweathers/thunderdome-planning-poker (1)
  • 30fortinet—
    20 CVECVSS 5.6
    NEW
    fortinet fortiportal (5) · fortiportal (5) · fortiwlm (2)
  • 31jenkins—
    20 CVE10 critCVSS 8.3
    NEW
    jenkins (13) · jenkins owasp dependency-check plugin (1) · active choices (1)
  • 32fedora project—
    19 CVE3 critCVSS 7.0
    NEWKEV 1PoC 6
    fedora (19)
  • 33qualcomm—
    18 CVE3 critCVSS 7.7
    NEW
    qca6391 firmware (18) · sdx55 firmware (17) · wcd9385 firmware (17)
  • 34qualcomm, inc.—
    18 CVE3 critCVSS 7.7
    NEW
    snapdragon auto, snapdragon compute, snapdragon connectivity, snapdragon consumer iot, snapdragon industrial iot, snapdragon mobile (4) · snapdragon auto, snapdragon compute, snapdragon connectivity, snapdragon consumer iot, snapdragon industrial iot, snapdragon iot, snapdragon mobile, snapdragon voice & music, snapdragon wearables (4) · snapdragon auto, snapdragon compute, snapdragon connectivity, snapdragon industrial iot, snapdragon mobile (1)
  • 35gitlab—
    16 CVECVSS 4.7
    NEWPoC 1
    gitlab (16)
  • 36zohocorp—
    15 CVE10 critCVSS 9.0
    NEWKEV 1Nuclei 2PoC 3
    manageengine supportcenter plus (4) · manageengine network configuration manager (3) · manageengine remote access plus (2)
  • 37busybox—
    14 CVE1 critCVSS 6.9
    NEW
    busybox (14)
  • 38moxa inc.—
    14 CVE10 critCVSS 8.8
    NEW
    iologik e2200 (8) · ioadmin (3) · nport iaw5250a-6i/o (3)
  • 39mozilla—
    14 CVECVSS 8.1
    NEWPoC 1
    firefox (13) · thunderbird (10) · firefox esr (8)
  • 40netapp—
    14 CVE3 critCVSS 6.8
    NEWPoC 3
    h410s firmware (10) · h700s firmware (10) · h500s firmware (10)
  • 41opendesign—
    14 CVE1 critCVSS 7.7
    NEW
    drawings software development kit (6) · oda viewer (2) · drawings sdk (2)
  • 42wildbit-soft—
    14 CVECVSS 5.5
    NEWPoC 5
    wildbit viewer (14)
  • 43hp—
    13 CVE4 critCVSS 8.0
    NEW
    futuresmart 4 (4) · futuresmart 3 (3) · hp scanjet enterprise 8500 fn1 document capture workstation (2)
  • 44open-xchange—
    13 CVECVSS 5.9
    NEWPoC 13
    ox app suite (13)
  • 45ао «ивк»—
    13 CVECVSS 7.4
    NEWPoC 2
    альт 8 сп (13) · альт 8 сп рабочая станция (1)
  • 46cd foundation—
    12 CVE9 critCVSS 9.2
    NEW
    jenkins (12)
  • 47oracle—
    12 CVECVSS 6.9
    NEWPoC 2
    communications cloud native core binding support function (4) · communications cloud native core policy (4) · communications cloud native core network exposure function (3)
  • 48rubygems—
    12 CVE3 critCVSS 7.6
    NEWPoC 9
    spree_auth_devise (4) · publify_core (3) · puppet (2)
  • 49business-dna solutions gmbh—
    11 CVECVSS 6.3
    NEW
    topease (11)
  • 50canonical—
    11 CVECVSS 7.2
    NEWPoC 2
    ubuntu (11) · accountsservice (1) · ubuntu linux (1)

Top weaknesses

CWE classes by distinct CVE count.

1CWE-79227—
2CWE-78791—
3CWE-2089—
4CWE-8969—
5CWE-35265—
6CWE-41650—
7CWE-12543—
8CWE-12041—
9CWE-2241—
10CWE-11935—
11CWE-7832—
12CWE-26930—
13CWE-86327—
14CWE-28425—
15CWE-28724—
16CWE-78824—
17CWE-9423—
18CWE-47621—
19CWE-86221—
20CWE-20020—

Sectors

Solution categories ranked by distinct CVE count this period.

  • OSS Libraries340 CVE
    64 crit81 vendorsCVSS 10.0
    drawings software development kit (6) · ohmyzsh/ohmyzsh (5) · hurd (4)
  • Operating Systems308 CVE
    126 crit179 KEV36 vendorsCVSS 7.4
    fedora (98) · debian linux (88) · осон основа оnyx (74)
  • Enterprise Software260 CVE
    444 crit7 KEV69 vendorsCVSS 8.2
    security guardium key lifecycle manager (14) · security key lifecycle manager (14) · h410s firmware (10)
  • Web & CMS Plugins227 CVE
    47 crit2 KEV146 vendorsCVSS 8.1
    traffic server (9) · apache ozone (8) · moodle (8)
  • Hardware Firmware154 CVE
    564 crit25 vendorsCVSS 8.2
    epyc 72f3 firmware (21) · epyc 7313 firmware (21) · epyc 7313p firmware (21)
  • Mobile Apps146 CVE
    11 crit4 KEV8 vendorsCVSS 7.0
    tensorflow (34) · google chrome (32) · chrome (31)
  • Consumer Software103 CVE
    5 crit23 vendorsCVSS 8.8
    animate (20) · adobe after effects (11) · adobe prelude (11)
  • Security Products96 CVE
    13 crit41 vendorsCVSS 9.8
    octorpki (6) · fortinet fortiportal (5) · fortiportal (5)
  • DevTools & CI93 CVE
    38 crit23 vendorsCVSS 8.5
    teamcity (10) · youtrack mobile (6) · oh my zsh (5)
  • Networking Infrastructure79 CVE
    76 crit36 vendorsCVSS 7.8
    clusterpro x (16) · clusterpro x singleserversafe (8) · cn28 firmware (8)
  • ICS / OT / IoT62 CVE
    29 crit30 vendorsCVSS 8.3
    iologik e2200 (8) · ioadmin (3) · nport iaw5250a-6i/o (3)
  • Cloud & SaaS51 CVE
    8 crit28 vendorsCVSS 8.5
    mendix (3) · booking.com banner creator (1) · booking.com product helper (1)
  • AI / ML45 CVE
    7 vendorsCVSS 6.9
    tensorflow (34) · optical character recognition (3) · fabric (2)
  • Communications41 CVE
    74 crit2 KEV18 vendorsCVSS 9.8
    ox app suite (13) · gnu mailman (2) · smartermail (2)
  • Databases29 CVE
    3 crit13 vendorsCVSS 8.5
    communications cloud native core policy (5) · communications cloud native core binding support function (4) · agile plm (3)
  • Unclassified106 CVE
    13 crit69 vendorsCVSS 7.3
    dialink (10) · barrier (5) · fundraising script (5)
Weakness × Sector

Which weaknesses hit which solution categories in November 2021

Cells shaded by share of the sector's hottest weakness. Click a row to open the sector history.

79XSS787Out-of-bounds Write20Improper Input Validation89SQL Injection352CSRF416Use After Free125Out-of-bounds Read120Buffer Overflow22Path Traversal119Memory Buffer BoundsOSS Libraries5016103232096163Operating Systems133327233215554Web & CMS Plugins89110353626Hardware Firmware21534314643Enterprise Software4312161236Consumer Software637321747226Security Products18463174ICS / OT / IoT12592111652Networking Infrastructure9312131141DevTools & CI103115