CVE Tools
Sign in
month report

December 2021

Data as of Jun 11, 2026, 06:05 UTCSnapshot v1 Sources CVEList V5+NVD+GHSA+CSAF+FSTEC BDU+CISA KEV+EPSS+Nuclei templates Methodology →

December 2021 closed with 2,520 published CVEs. 358 criticals, 20 added to CISA KEV (3 ransomware-linked). netgear led volume, mostly via rbr850 firmware. Top weakness class — CWE-79 (237 CVE). 10 vendors cracked the top-100 for the first time.

Print view
Total CVEs
2,520
— MoM— YoY
Severity mix
358 / 883
critical / high
KEV added
20
3 ransomware-linked
Nuclei coverage
6.7%
169 CVEs with templates

Time to exploit

How fast the community ships detection after a CVE drops.

Days → Nuclei (median)
1544.4
n=169
Within 7 days
0.0%
Within 30 days
0.0%
Days → KEV (median)
503
n=13
Detection gap

KEV pressure, no Nuclei coverage

December 2021 · vendors with active exploitation listed by CISA but no public detection template.

Weakness × Vendor

What's spreading where in December 2021

Cells shaded by share of vendor's hottest weakness. Click any cell to open the CWE history.

79XSS787Out-of-bounds Write77Command Injection89SQL Injection125Out-of-bounds Read22Path Traversal78OS Command Injection416Use After Free352CSRF20Improper Input Validationnetgear1789712google261712211сообщество свободного программного обеспечения625171185debian621161815microsoft corp6372ао «нппкт»217131155fedoraproject415261154ооо «русбитех-астра»122141152ао «концерн вниинс»2131175huawei57418microsoft23packagist23431132

Most discussed CVEs — December 2021

No CVE mentions in the news this month yet.

First time in top-100

Vendors never in top-100 in the prior 24 periods.

Top vendors

Ranked by distinct CVE count this period.

  • 1netgear—
    201 CVE47 critCVSS 7.7
    NEWNuclei 1PoC 1
    rbr850 firmware (89) · rbk852 firmware (88) · rbs850 firmware (88)
  • 2google—
    197 CVE7 critCVSS 7.0
    NEWKEV 2PoC 3
    android (159) · google chrome (36) · chrome (36)
  • 3сообщество свободного программного обеспечения—
    117 CVE15 critCVSS 7.5
    NEWKEV 4Nuclei 4PoC 23
    debian gnu/linux (95) · linux (9) · vim (8)
  • 4debian—
    108 CVE10 critCVSS 7.5
    NEWKEV 3Nuclei 4PoC 19
    debian linux (108)
  • 5microsoft—
    96 CVE9 critCVSS 7.5
    NEWKEV 3Nuclei 1PoC 6
    windows server 2016 (30) · windows 10 version 2004 (30) · windows 10 2004 (30)
  • 6ао "нппкт"—
    93 CVE7 critCVSS 7.6
    NEWKEV 2Nuclei 4PoC 12
    осон основа оnyx (93)
  • 7fedoraproject—
    90 CVE6 critCVSS 7.6
    NEWKEV 2Nuclei 4PoC 18
    fedora (90) · sssd (1) · extra packages for enterprise linux (1)
  • 8ооо «русбитех-астра»—
    77 CVE10 critCVSS 7.7
    NEWKEV 1Nuclei 2PoC 13
    astra linux special edition (77) · astra linux special edition для «эльбрус» (20) · astra linux common edition (4)
  • 9unknown—
    74 CVE10 critCVSS 6.5
    NEWNuclei 74PoC 41
    user registration, login form, user profile & membership – profilepress (formerly wp user avatar) (2) · get custom field values (2) · clickbank affiliate ads (2)
  • 10ао «концерн вниинс»—
    73 CVE5 critCVSS 7.6
    NEWKEV 1Nuclei 3PoC 7
    ос он «стрелец» (73)
  • 11huawei—
    69 CVE20 critCVSS 7.8
    NEW
    harmonyos (60) · emui (28) · magic ui (27)
  • 12packagist—
    63 CVE10 critCVSS 6.8
    NEWNuclei 5PoC 21
    yetiforce/yetiforce-crm (6) · showdoc/showdoc (6) · snipe/snipe-it (5)
  • 13crates.io—
    55 CVE28 critCVSS 8.7
    NEWPoC 2
    rusqlite (7) · messagepack-rs (4) · ckb (3)
  • 14siemens—
    49 CVE4 critCVSS 7.9
    NEWKEV 2Nuclei 2PoC 3
    jt utilities (23) · jt open toolkit (23) · jttk (21)
  • 15ibm—
    42 CVE4 critCVSS 6.7
    NEW
    cognos analytics (7) · spectrum copy data management (7) · db2 for linux, unix and windows (5)
  • 16ооо «ред софт»—
    41 CVE6 critCVSS 7.0
    NEWKEV 2Nuclei 4PoC 2
    ред ос (41)
  • 17advantech co., ltd—
    39 CVE8 critCVSS 8.2
    NEWPoC 11
    r-seenet (26) · wise-4060 (13) · wise-4010 (13)
  • 18fortinet—
    39 CVECVSS 6.7
    NEW
    fortiweb (17) · fortinet fortiweb (15) · fortios (8)
  • 19redhat—
    37 CVE4 critCVSS 7.5
    NEWKEV 3Nuclei 2PoC 4
    red hat enterprise linux (22) · enterprise linux (9) · openshift application runtimes (6)
  • 20apple—
    31 CVE4 critCVSS 7.5
    NEWKEV 1Nuclei 3PoC 5
    macos (25) · mac os x (24) · ios (8)
  • 21maven—
    31 CVE5 critCVSS 7.8
    NEWKEV 2Nuclei 3PoC 5
    io.atomix:atomix (7) · org.ops4j.pax.logging:pax-logging-log4j2 (5) · org.apache.logging.log4j:log4j-core (4)
  • 22adobe—
    29 CVECVSS 5.9
    NEW
    premiere rush (16) · adobe premiere rush (16) · dimension (6)
  • 23mozilla—
    28 CVE2 critCVSS 6.8
    NEWNuclei 1PoC 1
    firefox (25) · thunderbird (20) · firefox esr (19)
  • 24netapp—
    27 CVE4 critCVSS 7.7
    NEWKEV 1Nuclei 2PoC 5
    oncommand insight (12) · h500e firmware (6) · h500s firmware (6)
  • 25advantech—
    26 CVECVSS 6.7
    NEWPoC 11
    r-seenet (26)
  • 26npm—
    26 CVE5 critCVSS 7.1
    NEWPoC 8
    jsx-slack (2) · @backstage/plugin-scaffolder-backend (1) · comb (1)
  • 27pypi—
    26 CVE2 critCVSS 7.1
    NEWNuclei 1PoC 5
    numpy (4) · pyo (2) · lxml (1)
  • 28lantronix—
    24 CVE16 critCVSS 8.5
    NEWNuclei 1PoC 12
    premierwave 2050 firmware (23) · premierwave 2050 (1)
  • 29gitlab—
    22 CVECVSS 4.4
    NEWKEV 1
    gitlab (22) · gitlab runner (1)
  • 30gpac—
    22 CVECVSS 5.6
    NEWPoC 6
    gpac (22)
  • 31mediatek inc.—
    22 CVECVSS 7.8
    NEW
    mt7613 (20) · mt7613 firmware (20) · mt7615 (20)
  • 32oracle—
    20 CVE2 critCVSS 6.6
    NEWNuclei 2PoC 7
    http server (9) · zfs storage appliance kit (8) · communications cloud native core policy (6)
  • 33fedora project—
    19 CVECVSS 7.6
    NEWPoC 2
    fedora (19)
  • 34huawei technologies co., ltd.—
    19 CVE7 critCVSS 7.7
    NEW
    harmonyos (12) · emui (7) · magic ui (7)
  • 35samsung mobile—
    18 CVECVSS 4.7
    NEW
    samsung mobile devices (10) · samsung internet (2) · samsung pay (2)
  • 36ао «ивк»—
    18 CVE2 critCVSS 7.6
    NEW
    альт 8 сп (15) · альт сп 10 (4)
  • 37apache software foundation—
    17 CVE6 critCVSS 8.1
    NEWKEV 3Nuclei 6PoC 4
    log4j (5) · http server (3) · apache log4j2 (3)
  • 38trendnet—
    17 CVE4 critCVSS 7.5
    NEWNuclei 9PoC 2
    tew-827dru firmware (17)
  • 39novell inc.—
    15 CVE1 critCVSS 6.9
    NEWKEV 3Nuclei 2PoC 2
    opensuse leap (12) · opensuse tumbleweed (7) · suse package hub (4)
  • 40apache—
    14 CVE5 critCVSS 8.0
    NEWKEV 2Nuclei 5PoC 2
    log4j (5) · http server (2) · sling commons messaging mail (1)
  • 41sonicwall—
    14 CVE5 critCVSS 8.4
    NEWKEV 3Nuclei 3PoC 3
    sma 400 firmware (10) · sma 410 firmware (10) · sonicwall sma100 (10)
  • 42elecom—
    13 CVECVSS 7.6
    NEW
    edwrc-2533gst2 firmware (6) · wrc-1167gst2a firmware (6) · wrc-1167gst2 firmware (6)
  • 43elecom co.,ltd.—
    13 CVECVSS 6.8
    NEW
    elecom lan routers (8) · elecom routers (3) · elecom lan router (2)
  • 44fortinet inc.—
    13 CVECVSS 7.6
    NEW
    fortios (6) · fortiweb (3) · fortios-6k7k (3)
  • 45go—
    13 CVECVSS 7.1
    NEWKEV 1Nuclei 1PoC 1
    github.com/grafana/grafana (2) · github.com/opencontainers/runc (2) · github.com/foxcpp/maddy (1)
  • 46ivanti—
    13 CVE4 critCVSS 9.2
    NEWKEV 1Nuclei 1PoC 2
    avalanche (10) · endpoint manager cloud services appliance (1) · ivanti cloud services appliance (1)
  • 47sap—
    13 CVE3 critCVSS 6.8
    NEWNuclei 1PoC 2
    3d visual enterprise viewer (3) · netweaver application server abap (2) · businessobjects business intelligence platform (1)
  • 48kaseya—
    12 CVE5 critCVSS 8.7
    NEWPoC 8
    unitrends backup (12)
  • 49sap se—
    12 CVE2 critCVSS 6.5
    NEWNuclei 1PoC 1
    sap 3d visual enterprise viewer (3) · saf-t framework (1) · kyma (1)
  • 50dlink—
    11 CVE8 critCVSS 9.5
    NEWPoC 9
    dir-809 (8) · dir-809 firmware (8) · dir-2640-us firmware (3)

Top weaknesses

CWE classes by distinct CVE count.

1CWE-79237—
2CWE-787184—
3CWE-77109—
4CWE-89102—
5CWE-12572—
6CWE-2258—
7CWE-7858—
8CWE-41654—
9CWE-35250—
10CWE-2048—
11CWE-12047—
12CWE-86245—
13CWE-28740—
14CWE-20038—
15CWE-47631—
16CWE-19025—
17CWE-50225—
18CWE-11924—
19CWE-20324—
20CWE-26922—

Sectors

Solution categories ranked by distinct CVE count this period.

  • OSS Libraries364 CVE
    80 crit8 KEV95 vendorsCVSS 8.8
    gpac (22) · rusqlite (7) · wolfmqtt (7)
  • Operating Systems361 CVE
    206 crit135 KEV36 vendorsCVSS 7.8
    fedora (109) · debian linux (108) · debian gnu/linux (95)
  • Networking Infrastructure350 CVE
    1,509 crit131 KEV44 vendorsCVSS 9.8
    rbr850 firmware (89) · rbk852 firmware (88) · rbr850 (88)
  • Mobile Apps309 CVE
    53 crit5 KEV9 vendorsCVSS 7.4
    android (167) · harmonyos (60) · chrome (36)
  • Enterprise Software295 CVE
    194 crit131 KEV90 vendorsCVSS 8.2
    oncommand insight (12) · unitrends backup (12) · cognos analytics (7)
  • Web & CMS Plugins226 CVE
    63 crit7 KEV127 vendorsCVSS 7.5
    crafter cms (16) · log4j (10) · ifme (8)
  • ICS / OT / IoT166 CVE
    118 crit50 vendorsCVSS 9.1
    r-seenet (26) · wise-4010 (13) · wise-4050 (13)
  • Security Products120 CVE
    12 crit2 KEV38 vendorsCVSS 8.3
    fortiweb (17) · fortinet fortiweb (15) · avalanche (10)
  • Consumer Software101 CVE
    12 crit27 vendorsCVSS 7.8
    adobe premiere rush (16) · premiere rush (16) · dimension (12)
  • DevTools & CI55 CVE
    6 crit2 KEV20 vendorsCVSS 8.6
    gitlab (23) · tuleap (2) · git-it (1)
  • Communications54 CVE
    15 crit37 vendorsCVSS 7.6
    live helper chat (10) · livehelperchat/livehelperchat (10) · mattermost (3)
  • Cloud & SaaS50 CVE
    13 crit2 KEV30 vendorsCVSS 9.2
    thinfinity virtualui (3) · visa tokenisation service (vts) (3) · elabftw (2)
  • Databases37 CVE
    12 crit12 vendorsCVSS 7.4
    http server (9) · zfs storage appliance kit (8) · communications cloud native core binding support function (6)
  • Hardware Firmware27 CVE
    35 crit25 KEV24 vendorsCVSS 8.8
    surveillance station (3) · cloud manager (2) · nova 360 cabinet firmware (2)
  • AI / ML11 CVE
    3 crit1 KEV7 vendorsCVSS 8.1
    longhorn (2) · tremor-script (2) · besu (1)
  • Unclassified126 CVE
    30 crit2 KEV78 vendorsCVSS 7.6
    atomix (7) · ос тд аис фссп россии (6) · reprise license manager (5)
Weakness × Sector

Which weaknesses hit which solution categories in December 2021

Cells shaded by share of the sector's hottest weakness. Click a row to open the sector history.

79XSS787Out-of-bounds Write77Command Injection89SQL Injection125Out-of-bounds Read22Path Traversal78OS Command Injection416Use After Free352CSRF20Improper Input ValidationOperating Systems14653367233124Networking Infrastructure25329812122833OSS Libraries3848447116231815Web & CMS Plugins10113728293Enterprise Software487221251129ICS / OT / IoT10261261691535Consumer Software93121121816Security Products992722413Communications1741224353Hardware Firmware6151121213