CVE Tools
Sign in
month report

September 2023

Data as of Jun 11, 2026, 06:05 UTCSnapshot v1 Sources CVEList V5+NVD+GHSA+CSAF+FSTEC BDU+CISA KEV+EPSS+Nuclei templates Methodology →

September 2023 closed with 2,863 published CVEs. 283 criticals, 19 added to CISA KEV (3 ransomware-linked). google led volume, mostly via android. Top weakness class — CWE-79 (375 CVE). 10 vendors cracked the top-100 for the first time.

Print view
Total CVEs
2,863
— MoM— YoY
Severity mix
283 / 777
critical / high
KEV added
19
3 ransomware-linked
Nuclei coverage
9.0%
259 CVEs with templates

Time to exploit

How fast the community ships detection after a CVE drops.

Days → Nuclei (median)
903.8
n=259
Within 7 days
0.0%
Within 30 days
0.0%
Days → KEV (median)
4
n=21
Detection gap

KEV pressure, no Nuclei coverage

September 2023 · vendors with active exploitation listed by CISA but no public detection template.

Weakness × Vendor

What's spreading where in September 2023

Cells shaded by share of vendor's hottest weakness. Click any cell to open the CWE history.

79XSS89SQL Injection787Out-of-bounds Write862Missing Authorization125Out-of-bounds Read416Use After Free22Path Traversal20Improper Input Validation434Unrestricted File Upload120Buffer Overflowgoogle1264222913сообщество свободного программного обеспечения62141823421apple546110ооо «ред софт»62156104221ао «нппкт»11232011ооо «русбитех-астра»115211fedoraproject9551481microsoft32285adobe5116181022go111421microsoft corp31285maven7563213

Most discussed CVEs — September 2023

No CVE mentions in the news this month yet.

First time in top-100

Vendors never in top-100 in the prior 24 periods.

Top vendors

Ranked by distinct CVE count this period.

  • 1google—
    137 CVE1 critCVSS 6.2
    NEWKEV 4PoC 2
    android (118) · chrome (18) · google chrome (18)
  • 2сообщество свободного программного обеспечения—
    125 CVE13 critCVSS 6.9
    NEWKEV 3Nuclei 5PoC 32
    debian gnu/linux (75) · linux (21) · vim (9)
  • 3apple—
    123 CVE5 critCVSS 6.3
    NEWKEV 7
    macos (107) · ipados (64) · iphone os (64)
  • 4ооо «ред софт»—
    100 CVE6 critCVSS 6.6
    NEWKEV 3PoC 12
    ред ос (100)
  • 5ао "нппкт"—
    88 CVE8 critCVSS 6.8
    NEWKEV 3PoC 14
    осон основа оnyx (88)
  • 6redhat—
    84 CVE6 critCVSS 6.7
    NEWKEV 2PoC 7
    red hat enterprise linux (40) · red hat enterprise linux 9 (24) · red hat enterprise linux 8 (23)
  • 7ооо «русбитех-астра»—
    83 CVE7 critCVSS 7.0
    NEWKEV 4PoC 16
    astra linux special edition (81) · astra linux special edition для «эльбрус» (6) · astra linux common edition (5)
  • 8fedoraproject—
    68 CVE2 critCVSS 6.5
    NEWKEV 4Nuclei 3PoC 14
    fedora (68) · extra packages for enterprise linux (1)
  • 9microsoft—
    67 CVE1 critCVSS 7.3
    NEWKEV 5PoC 8
    windows server 2022 (20) · windows server 2022 (server core installation) (19) · windows 11 21h2 (19)
  • 10adobe—
    65 CVE5 critCVSS 6.9
    NEWKEV 2Nuclei 1PoC 1
    acrobat reader dc (12) · acrobat reader (12) · acrobat dc (12)
  • 11go—
    64 CVE6 critCVSS 6.9
    NEWKEV 1PoC 9
    github.com/lf-edge/eve (14) · github.com/schollz/croc/v9 (5) · github.com/mattermost/mattermost/server/v8 (5)
  • 12maven—
    59 CVE6 critCVSS 6.7
    NEWNuclei 3PoC 4
    org.jenkins-ci.main:jenkins-core (5) · org.jenkins-ci.plugins:aws-codecommit-trigger (4) · org.jenkins-ci.plugins:jobconfighistory (4)
  • 13debian—
    54 CVE3 critCVSS 6.8
    NEWKEV 5PoC 16
    debian linux (54)
  • 14dlink—
    53 CVE28 critCVSS 8.2
    NEWNuclei 1PoC 27
    dir-619l firmware (13) · dir-619l (10) · dar-7000 firmware (9)
  • 15packagist—
    51 CVE7 critCVSS 6.9
    NEWNuclei 8PoC 25
    librenms/librenms (7) · gugoan/economizzer (5) · thorsten/phpmyfaq (5)
  • 16pypi—
    47 CVE4 critCVSS 6.3
    NEWKEV 1Nuclei 1PoC 10
    apache-superset (8) · vyper (5) · zope (2)
  • 17ао «ивк»—
    47 CVE4 critCVSS 7.5
    NEWKEV 2PoC 12
    альт сп 10 (47) · альт 8 сп (23)
  • 18mediatek, inc.—
    45 CVECVSS 5.6
    NEW
    mt2713, mt6895, mt6897, mt6983, mt8188, mt8195, mt8395, mt8781 (4) · mt6895, mt6897, mt6983, mt8188, mt8195, mt8395, mt8781 (4) · mt2713, mt6895, mt6897, mt6983, mt8188, mt8195, mt8395, mt8673 (3)
  • 19ао «нтц ит роса»—
    45 CVE4 critCVSS 6.8
    NEWKEV 2PoC 9
    роса хром (36) · rosa virtualization 3.0 (11) · rosa virtualization (6)
  • 20unisoc (shanghai) technologies co., ltd.—
    44 CVECVSS 6.1
    NEW
    sc7731e/sc9832e/sc9863a/t606/t612/t616/t610/t618 (30) · sc7731e/sc9832e/sc9863a/t310/t606/t612/t616/t610/t618/t760/t770/t820/s8000 (5) · sc9832e/sc9863a/t310/t606/t612/t616/t610/t618/t760/t770/t820/s8000 (2)
  • 21unknown—
    40 CVE2 critCVSS 6.0
    NEWNuclei 40PoC 39
    import xml and rss feeds (2) · tagdiv composer (2) · user activity log (2)
  • 22os commerce—
    36 CVECVSS 5.4
    NEWPoC 9
    os commerce (36)
  • 23oscommerce—
    36 CVECVSS 5.4
    NEWPoC 9
    oscommerce (36)
  • 24qualcomm—
    35 CVE2 critCVSS 7.8
    NEW
    wcd9380 firmware (32) · wsa8830 firmware (31) · wsa8835 firmware (31)
  • 25qualcomm, inc.—
    35 CVE2 critCVSS 7.6
    NEW
    snapdragon (35)
  • 26sourcecodester—
    35 CVECVSS 5.5
    NEWPoC 31
    engineers online portal (9) · best courier management system (6) · simple membership system (5)
  • 27linuxfoundation—
    33 CVE2 critCVSS 6.3
    NEW
    yocto (27) · edge virtualization engine (5) · nats-server (1)
  • 28linux—
    32 CVE1 critCVSS 6.8
    NEWPoC 11
    linux kernel (32) · kernel (10) · linux (1)
  • 29samsung—
    32 CVECVSS 4.8
    NEW
    android (16) · exynos 2200 firmware (5) · exynos 2100 firmware (5)
  • 30cisco—
    31 CVE2 critCVSS 6.4
    NEWKEV 2PoC 31
    ios xe (8) · cisco ios xe (8) · cisco ios xe software (8)
  • 31npm—
    29 CVE3 critCVSS 7.1
    NEWKEV 2Nuclei 7PoC 9
    electron (5) · fuxa-server (3) · @frangoteam/fuxa (2)
  • 32canonical—
    28 CVE3 critCVSS 7.5
    NEWKEV 1PoC 5
    ubuntu (24) · ubuntu linux (4) · accountsservice (1)
  • 33jenkins—
    27 CVECVSS 6.3
    NEW
    jenkins (5) · aws codecommit trigger (4) · build failure analyzer (4)
  • 34fedora project—
    26 CVE1 critCVSS 6.3
    NEWKEV 1Nuclei 2PoC 5
    fedora (26)
  • 35gitlab—
    26 CVECVSS 4.9
    NEWPoC 14
    gitlab (26)
  • 36huawei—
    25 CVE5 critCVSS 7.1
    NEW
    harmonyos (25) · emui (23)
  • 37mozilla—
    25 CVE5 critCVSS 7.5
    NEWKEV 2PoC 2
    firefox (24) · firefox esr (19) · thunderbird (19)
  • 38samsung mobile—
    24 CVECVSS 5.2
    NEW
    samsung mobile devices (16) · gallery (2) · packageinstallerchn (1)
  • 39novell inc.—
    23 CVE2 critCVSS 6.9
    NEWNuclei 1PoC 1
    suse linux enterprise server for sap applications (20) · suse linux enterprise server (20) · suse linux enterprise desktop (13)
  • 40siemens—
    22 CVECVSS 7.5
    NEW
    qms automotive (9) · tecnomatix plant simulation v2302 (8) · tecnomatix plant simulation v2201 (8)
  • 41ibm—
    20 CVECVSS 5.8
    NEWNuclei 1
    aspera faspex (8) · sterling secure proxy (2) · sterling external authentication server (2)
  • 42nvidia—
    20 CVECVSS 7.1
    NEW
    dgx h100 bmc (15) · dgx h100 firmware (15) · cumulus linux (2)
  • 43cacti—
    18 CVE1 critCVSS 6.6
    NEWNuclei 3PoC 9
    cacti (18)
  • 44the cacti group inc.—
    18 CVE1 critCVSS 6.6
    NEWNuclei 3PoC 9
    cacti (18)
  • 45apache—
    17 CVE1 critCVSS 5.8
    NEWPoC 2
    superset (8) · airflow (2) · tomcat connectors (1)
  • 46apache software foundation—
    17 CVE1 critCVSS 6.0
    NEWPoC 2
    apache superset (8) · superset (4) · airflow (2)
  • 47crates.io—
    17 CVE2 critCVSS 7.0
    NEWKEV 1PoC 1
    inventory (2) · phonenumber (1) · routinator (1)
  • 48mediatek inc.—
    17 CVECVSS 4.7
    NEW
    iot yocto (16) · mediatek mt2713 (1) · mediatek mt5221 (1)
  • 49tp-link—
    16 CVE1 critCVSS 8.4
    NEWPoC 2
    tl-er5120g firmware (3) · archer a10 firmware (2) · archer c20 (2)
  • 50webmin—
    16 CVECVSS 5.4
    NEWNuclei 1PoC 16
    usermin (10) · webmin (7)

Top weaknesses

CWE classes by distinct CVE count.

1CWE-79375·
2CWE-89179↑1
3CWE-787130↓1
4CWE-86270↑8
5CWE-12565↑2
6CWE-41664↑3
7CWE-2258↓2
8CWE-2048↓4
9CWE-43445↑5
10CWE-12044↓4
11CWE-7841↓3
12CWE-40039↑3
13CWE-20038·
14CWE-9436↑5
15CWE-26934↑3
16CWE-28731·
17CWE-86331·
18CWE-12128—
19CWE-35228↑2
20CWE-28427↓9

Sectors

Solution categories ranked by distinct CVE count this period.

  • Web & CMS Plugins489 CVE
    67 crit306 vendorsCVSS 7.5
    superset (12) · engineers online portal (9) · apache superset (8)
  • Operating Systems442 CVE
    102 crit81 KEV44 vendorsCVSS 7.5
    fedora (104) · ред ос (100) · осон основа оnyx (88)
  • OSS Libraries399 CVE
    59 crit17 KEV96 vendorsCVSS 7.7
    gpac (9) · gpac/gpac (8) · glib (7)
  • Mobile Apps319 CVE
    20 crit61 KEV8 vendorsCVSS 6.4
    android (136) · harmonyos (25) · emui (23)
  • Enterprise Software310 CVE
    91 crit12 KEV116 vendorsCVSS 9.8
    cacti (36) · glpi (18) · aspera faspex (8)
  • Networking Infrastructure201 CVE
    118 crit14 KEV53 vendorsCVSS 7.8
    dir-619l firmware (13) · ac10u firmware (11) · dir-619l (10)
  • Hardware Firmware192 CVE
    97 crit2 KEV32 vendorsCVSS 7.8
    sc7731e/sc9832e/sc9863a/t606/t612/t616/t610/t618 (30) · dgx h100 bmc (15) · dgx h100 firmware (15)
  • Consumer Software159 CVE
    38 crit23 KEV29 vendorsCVSS 8.7
    acrobat dc (12) · acrobat reader (12) · acrobat reader dc (12)
  • Security Products127 CVE
    30 crit9 KEV56 vendorsCVSS 8.3
    acronis cyber protect 15 (13) · cyber protect (13) · atlant (12)
  • DevTools & CI104 CVE
    2 crit1 KEV28 vendorsCVSS 7.8
    usermin (10) · webmin (7) · vyper (5)
  • ICS / OT / IoT102 CVE
    154 crit59 vendorsCVSS 8.6
    ekorccp firmware (10) · ekorrci (10) · ekorrci firmware (10)
  • Cloud & SaaS74 CVE
    9 crit37 vendorsCVSS 7.2
    docker desktop (12) · jumpserver (7) · argo cd (3)
  • AI / ML40 CVE
    8 crit9 vendorsCVSS 8.7
    yocto (27) · edge virtualization engine (5) · langchain (2)
  • Communications34 CVE
    2 KEV28 vendorsCVSS 7.1
    mastodon (8) · mattermost (5) · synapse (4)
  • Databases21 CVE
    3 crit3 KEV15 vendorsCVSS 8.7
    ibm aspera faspex (3) · mariadb (2) · oracle linux (2)
  • Unclassified164 CVE
    36 crit140 vendorsCVSS 6.8
    dar-7000 (9) · dar-8000 (8) · imagegear (8)
Weakness × Sector

Which weaknesses hit which solution categories in September 2023

Cells shaded by share of the sector's hottest weakness. Click a row to open the sector history.

79XSS89SQL Injection787Out-of-bounds Write862Missing Authorization125Out-of-bounds Read416Use After Free22Path Traversal20Improper Input Validation434Unrestricted File Upload120Buffer OverflowOperating Systems229424638451017219Web & CMS Plugins22480515318OSS Libraries5111156109171184Enterprise Software697263317410Consumer Software97332202710532Networking Infrastructure11440325395Hardware Firmware2140402771129Security Products93214222ICS / OT / IoT871034542DevTools & CI18183411