CVE Tools
Sign in
month report

September 2024

Data as of Jun 11, 2026, 06:05 UTCSnapshot v1 Sources CVEList V5+NVD+GHSA+CSAF+FSTEC BDU+CISA KEV+EPSS+Nuclei templates Methodology →

September 2024 closed with 2,594 published CVEs — -9.4% YoY . 241 criticals, 25 added to CISA KEV (3 ransomware-linked). сообщество свободного программного обеспечения led volume, mostly via linux. Biggest breakout: qnap at ×3.3 their 12-month median. Top weakness class — CWE-79 (414 CVE). 10 vendors cracked the top-100 for the first time.

Print view
Total CVEs
2,594
-14.2% MoM-9.4% YoY
Severity mix
241 / 882
critical / high
KEV added
25
3 ransomware-linked
Nuclei coverage
15.2%
395 CVEs with templates

Time to exploit

How fast the community ships detection after a CVE drops.

Days → Nuclei (median)
537.5
n=395
Within 7 days
0.0%
Within 30 days
0.0%
Days → KEV (median)
40
n=13
Detection gap

KEV pressure, no Nuclei coverage

September 2024 · vendors with active exploitation listed by CISA but no public detection template.

Weakness × Vendor

What's spreading where in September 2024

Cells shaded by share of vendor's hottest weakness. Click any cell to open the CWE history.

79XSS89SQL Injection787Out-of-bounds Write476NULL Pointer Dereference125Out-of-bounds Read22Path Traversal120Buffer Overflow200Information Exposure416Use After Free862Missing Authorizationсообщество свободного программного обеспечения1126648122341linux1664830ооо «русбитех-астра»224462226ао «нппкт»118496132ооо «ред софт»11736621241red hat inc.1428421151canonical ltd.1034481microsoft corp352417apple32531151microsoft212411ао «ивк»547213google11751192

Most discussed CVEs — September 2024

No CVE mentions in the news this month yet.

Breakout vendors

CVE count ≥3× their own 12-period median.

First time in top-100

Vendors never in top-100 in the prior 24 periods.

Top vendors

Ranked by distinct CVE count this period.

  • 1сообщество свободного программного обеспечения·
    366 CVE8 critCVSS 6.2
    Nuclei 4PoC 26
    linux (282) · debian gnu/linux (220) · mindsdb (6)
  • 2linux↑1
    277 CVECVSS 6.0
    PoC 2
    linux (277) · linux kernel (277)
  • 3ооо «русбитех-астра»↑1
    243 CVE7 critCVSS 6.4
    Nuclei 1PoC 15
    astra linux special edition (242) · astra linux common edition (23) · astra linux special edition для «эльбрус» (8)
  • 4ао "нппкт"↑1
    240 CVE5 critCVSS 6.3
    Nuclei 1PoC 7
    осон основа оnyx (240)
  • 5ооо «ред софт»↓3
    223 CVE4 critCVSS 6.3
    Nuclei 1PoC 14
    ред ос (216) · ред база данных (7)
  • 6redhat↑2
    170 CVE8 critCVSS 6.2
    Nuclei 2PoC 12
    red hat enterprise linux (149) · red hat enterprise linux 10 (15) · red hat enterprise linux 9 (14)
  • 7canonical↓1
    130 CVECVSS 5.9
    Nuclei 1PoC 4
    ubuntu (129) · anbox cloud (1)
  • 8microsoft↓1
    107 CVE3 critCVSS 7.5
    KEV 4PoC 5
    windows server 2022, 23h2 edition (server core installation) (38) · windows server 2022 (38) · windows server 2022 23h2 (38)
  • 9apple—
    91 CVE2 critCVSS 5.7
    macos (74) · iphone os (35) · ios and ipados (35)
  • 10unknown↑9
    78 CVE3 critCVSS 5.7
    Nuclei 77PoC 76
    wp multitasking (5) · music request manager (3) · starbox (2)
  • 11ао «ивк»↑4
    67 CVE2 critCVSS 6.8
    PoC 9
    альт сп 10 (53) · альт 8 сп (38)
  • 12google·
    60 CVE1 critCVSS 7.1
    PoC 6
    android (28) · chrome (26) · google chrome (25)
  • 13pypi↑9
    53 CVE8 critCVSS 7.2
    Nuclei 4PoC 17
    mindsdb (12) · micropython-copy (3) · micropython-io (3)
  • 14sourcecodester↓5
    50 CVECVSS 5.2
    PoC 42
    food ordering management system (6) · best house rental management system (6) · online railway reservation system (5)
  • 15npm↑13
    47 CVE2 critCVSS 6.3
    PoC 9
    lunary (4) · mattermost-desktop (3) · agnai (3)
  • 16go↓3
    40 CVE6 critCVSS 6.9
    Nuclei 5PoC 5
    github.com/nvidia/nvidia-container-toolkit (4) · github.com/zitadel/zitadel/v2 (3) · github.com/hashicorp/vault (2)
  • 17draytek—
    38 CVECVSS 7.5
    NEW
    vigor3910 firmware (36) · vigor 3910 (5) · vigor 2766 (2)
  • 18maven↑16
    38 CVE4 critCVSS 7.3
    Nuclei 4PoC 6
    org.keycloak:keycloak-services (6) · org.keycloak:keycloak-core (4) · org.xwiki.platform:xwiki-platform-notifications-ui (2)
  • 19opennetworking—
    37 CVECVSS 6.1
    libfluid msg (37)
  • 20open networking foundation (onf)—
    37 CVECVSS 6.1
    NEW
    libfluid (37)
  • 21packagist↓4
    36 CVE1 critCVSS 6.3
    Nuclei 2PoC 3
    mautic/core (14) · mautic/core-lib (5) · concrete5/concrete5 (4)
  • 22samsung↑3
    36 CVECVSS 5.4
    android (19) · exynos 1380 firmware (9) · exynos 850 firmware (9)
  • 23cisco↑16
    32 CVE1 critCVSS 7.2
    KEV 1Nuclei 2PoC 30
    cisco ios xe software (10) · ios xe (10) · cisco ios xr software (9)
  • 24adobe↓14
    29 CVE1 critCVSS 7.0
    illustrator 2023 (5) · illustrator (5) · media encoder (5)
  • 25qnap—
    26 CVECVSS 6.7
    ×3.3Nuclei 1
    quts hero (16) · qts (16) · qutscloud (4)
  • 26code-projects↑23
    25 CVECVSS 6.3
    Nuclei 3PoC 24
    student record system (4) · blood bank system (4) · crud operation system (3)
  • 27oretnom23↓16
    25 CVE1 critCVSS 5.6
    PoC 24
    food ordering management system (6) · railway reservation system (5) · online eyewear shop (4)
  • 28samsung mobile↓1
    25 CVECVSS 5.3
    samsung mobile devices (19) · samsung notes (4) · group sharing (1)
  • 29ivanti↑30
    24 CVE2 critCVSS 7.4
    KEV 2Nuclei 1PoC 1
    endpoint manager (16) · ivanti endpoint manager (16) · epm (11)
  • 30intel↓14
    22 CVECVSS 5.8
    raid web console (9) · intel raid web console (9) · intel xeon processor d family (7)
  • 31siemens↑6
    22 CVE3 critCVSS 5.3
    simatic rf186ci firmware (6) · simatic reader rf685r arib (6) · simatic reader rf685r arib firmware (6)
  • 32gitlab↑22
    21 CVE2 critCVSS 5.8
    Nuclei 1PoC 7
    gitlab (21)
  • 33ibm↓2
    21 CVE1 critCVSS 6.0
    aspera faspex (3) · webmethods integration (3) · mq (2)
  • 34qualcomm↓5
    21 CVECVSS 7.5
    fastconnect 7800 firmware (21) · wsa8835 firmware (21) · wsa8830 firmware (21)
  • 35qualcomm, inc.↓5
    21 CVECVSS 7.7
    snapdragon (21)
  • 36dlink↓10
    20 CVE10 critCVSS 8.8
    Nuclei 1PoC 9
    covr-x1870 (5) · dir-x5460a1 (5) · dir-x4860 firmware (5)
  • 37sap_se↑14
    20 CVECVSS 4.7
    sap netweaver application server for abap and abap platform (8) · sap business warehouse (bex analyzer) (1) · sap for oil & gas (1)
  • 38gotenna—
    19 CVECVSS 5.4
    NEW
    pro (10) · gotenna pro (10) · pro atak plugin (9)
  • 39mayurik↑19
    19 CVE5 critCVSS 6.6
    PoC 17
    best house rental management system (10) · advocate office management system (4) · modern loan management system (2)
  • 40ао «нтц ит роса»↓22
    19 CVE2 critCVSS 6.6
    Nuclei 1PoC 4
    rosa virtualization 3.0 (10) · роса хром (7) · роса кобальт (2)
  • 41huawei↑36
    18 CVECVSS 5.2
    emui (18) · harmonyos (18)
  • 42novell inc.↓9
    18 CVE1 critCVSS 5.6
    PoC 2
    opensuse leap (14) · suse linux enterprise server for sap applications (11) · suse linux enterprise high performance computing (10)
  • 43veeam—
    18 CVE3 critCVSS 8.0
    NEW×3.0KEV 1Nuclei 1PoC 1
    veeam backup \& replication (6) · backup and recovery (6) · one (6)
  • 44veeam software ag—
    17 CVE3 critCVSS 8.1
    NEWKEV 1Nuclei 1PoC 1
    veeam one (6) · veeam backup & replication (6) · veeam service provider console (vspc) (4)
  • 45rubygems↑73
    16 CVE2 critCVSS 7.1
    Nuclei 2PoC 9
    camaleon_cms (7) · decidim (1) · decidim-admin (1)
  • 46zyxel—
    15 CVE2 critCVSS 6.0
    atp series firmware (7) · atp (7) · zld (7)
  • 47apache↓6
    14 CVE2 critCVSS 7.3
    KEV 1Nuclei 2
    ofbiz (2) · airflow (2) · druid (2)
  • 48apache software foundation↓2
    14 CVE2 critCVSS 7.5
    KEV 1Nuclei 2
    apache ofbiz (2) · apache druid (2) · ofbiz (2)
  • 49dell↓7
    14 CVECVSS 6.4
    insightiq (5) · powerscale insightiq (5) · smartfabric os10 (4)
  • 50mozilla↓3
    14 CVE5 critCVSS 8.3
    firefox (12) · thunderbird (9) · firefox esr (9)

Top weaknesses

CWE classes by distinct CVE count.

1CWE-79414·
2CWE-89146·
3CWE-787106·
4CWE-47689↑1
5CWE-12587↑4
6CWE-2280·
7CWE-12070↑10
8CWE-20069↑2
9CWE-41669↓1
10CWE-86265↑3
11CWE-35261↓7
12CWE-9461↑4
13CWE-7858↓2
14CWE-28455↓7
15CWE-2043·
16CWE-7743↑2
17CWE-26938↑3
18CWE-86337↑4
19CWE-12134↓7
20CWE-12233↓1

Sectors

Solution categories ranked by distinct CVE count this period.

  • Operating Systems650 CVE
    79 crit189 KEV36 vendorsCVSS 8.6
    linux (559) · linux kernel (277) · astra linux special edition (242)
  • Web & CMS Plugins539 CVE
    71 crit3 KEV349 vendorsCVSS 7.3
    the ultimate wordpress toolkit – wp extended (7) · wp extended (7) · wp multitasking (6)
  • OSS Libraries361 CVE
    37 crit67 vendorsCVSS 7.3
    libfluid (37) · node (8) · node.js (8)
  • Enterprise Software321 CVE
    76 crit93 vendorsCVSS 9.3
    checkmk (9) · active iq unified manager (5) · insightiq (5)
  • Networking Infrastructure255 CVE
    148 crit3 KEV51 vendorsCVSS 8.1
    vigor3910 firmware (36) · gs-4210-24p2s firmware (12) · gs-4210-24p2s hardware 3.0 (12)
  • Mobile Apps209 CVE
    6 crit10 vendorsCVSS 9.9
    android (47) · chrome (26) · google chrome (25)
  • Hardware Firmware144 CVE
    33 crit38 vendorsCVSS 7.9
    intel raid web console (9) · raid web console (9) · intel xeon processor d family (7)
  • Security Products121 CVE
    25 crit6 KEV64 vendorsCVSS 7.4
    endpoint manager (16) · ivanti endpoint manager (16) · epm (11)
  • Cloud & SaaS112 CVE
    22 crit11 KEV59 vendorsCVSS 8.0
    mautic (26) · easytest online test platform (12) · emias os (5)
  • ICS / OT / IoT104 CVE
    47 crit10 KEV45 vendorsCVSS 9.1
    openplc v3 firmware (5) · openplc_v3 (5) · adam-5630 (4)
  • Consumer Software80 CVE
    33 crit35 vendorsCVSS 8.1
    navisworks (12) · navisworks freedom (6) · navisworks manage (6)
  • DevTools & CI61 CVE
    10 crit24 vendorsCVSS 7.7
    gitlab (31) · backstage (3) · enterprise server (2)
  • Communications54 CVE
    4 crit20 vendorsCVSS 8.7
    gotenna pro (10) · pro (10) · mattermost (9)
  • AI / ML51 CVE
    11 crit30 vendorsCVSS 8.3
    mindsdb (12) · berriai/litellm (1) · litellm (1)
  • Databases19 CVE
    7 crit16 vendorsCVSS 8.0
    oracle exadata (2) · tidb (2) · ibm cloud pak for multicloud management monitoring (1)
  • Unclassified183 CVE
    28 crit137 vendorsCVSS 6.6
    enms (6) · nacpremium (6) · dir-x4860 a1 (5)
Weakness × Sector

Which weaknesses hit which solution categories in September 2024

Cells shaded by share of the sector's hottest weakness. Click a row to open the sector history.

79XSS89SQL Injection787Out-of-bounds Write476NULL Pointer Dereference125Out-of-bounds Read22Path Traversal120Buffer Overflow200Information Exposure416Use After Free862Missing AuthorizationOperating Systems615469307719564Web & CMS Plugins2377822411733OSS Libraries493109281821534Enterprise Software825464117Networking Infrastructure7214123034971Hardware Firmware1321831547161Consumer Software18525210212152ICS / OT / IoT8543412112Security Products812153142Cloud & SaaS1481216616