CVE Tools
Sign in
month report

November 2024

Data as of Jun 11, 2026, 06:05 UTCSnapshot v1 Sources CVEList V5+NVD+GHSA+CSAF+FSTEC BDU+CISA KEV+EPSS+Nuclei templates Methodology →

November 2024 closed with 4,154 published CVEs — +62.3% YoY . 348 criticals, 22 added to CISA KEV (5 ransomware-linked). сообщество свободного программного обеспечения led volume, mostly via linux. Biggest breakout: irfanview at ×17.4 their 12-month median. Top weakness class — CWE-79 (824 CVE). 10 vendors cracked the top-100 for the first time.

Print view
Total CVEs
4,154
— MoM+62.3% YoY
Severity mix
348 / 1,472
critical / high
KEV added
22
5 ransomware-linked
Nuclei coverage
26.1%
1,083 CVEs with templates

Time to exploit

How fast the community ships detection after a CVE drops.

Days → Nuclei (median)
475.7
n=1,083
Within 7 days
0.0%
Within 30 days
0.0%
Days → KEV (median)
6
n=15
Detection gap

KEV pressure, no Nuclei coverage

November 2024 · vendors with active exploitation listed by CISA but no public detection template.

Weakness × Vendor

What's spreading where in November 2024

Cells shaded by share of vendor's hottest weakness. Click any cell to open the CWE history.

79XSS862Missing Authorization89SQL Injection787Out-of-bounds Write125Out-of-bounds Read78OS Command Injection22Path Traversal120Buffer Overflow74Injection352CSRFсообщество свободного программного обеспечения61113233652linux10183ооо «русбитех-астра»6110172142ооо «ред софт»14347152452ао «нппкт»77162canonical ltd.171624google611372611red hat inc.24132141microsoft corp57cisco21224721cisco systems inc.21224721microsoft27

Most discussed CVEs — November 2024

No CVE mentions in the news this month yet.

Breakout vendors

CVE count ≥3× their own 12-period median.

First time in top-100

Vendors never in top-100 in the prior 24 periods.

Top vendors

Ranked by distinct CVE count this period.

  • 1сообщество свободного программного обеспечения—
    375 CVE12 critCVSS 6.2
    KEV 4Nuclei 3PoC 17
    linux (281) · debian gnu/linux (212) · needrestart (4)
  • 2linux—
    279 CVECVSS 6.0
    KEV 1PoC 1
    linux kernel (279) · linux (274)
  • 3ооо «русбитех-астра»—
    263 CVE12 critCVSS 6.3
    KEV 3Nuclei 1PoC 14
    astra linux special edition (261) · astra linux common edition (51) · astra linux special edition для «эльбрус» (2)
  • 4ооо «ред софт»—
    246 CVE11 critCVSS 6.2
    KEV 1Nuclei 3PoC 17
    ред ос (241) · ред база данных (5)
  • 5ао "нппкт"—
    218 CVE8 critCVSS 6.4
    KEV 3PoC 6
    осон основа оnyx (218)
  • 6canonical—
    165 CVE2 critCVSS 6.2
    KEV 2PoC 5
    ubuntu (164) · ubuntu's pulseaudio (1)
  • 7redhat—
    148 CVE2 critCVSS 6.3
    KEV 3PoC 7
    red hat enterprise linux (114) · red hat enterprise linux 9 (17) · red hat enterprise linux 8 (17)
  • 8google—
    136 CVE5 critCVSS 7.2
    KEV 2PoC 3
    android (118) · chrome (13) · google chrome (13)
  • 9microsoft—
    106 CVE5 critCVSS 7.9
    KEV 3PoC 2
    windows server 2022 (34) · windows server 2022 (server core installation) (34) · windows server 2022 23h2 (32)
  • 10cisco—
    104 CVE3 critCVSS 6.0
    ×5.0Nuclei 2PoC 104
    cisco catalyst sd-wan manager (18) · cisco sd-wan (17) · catalyst sd-wan manager (17)
  • 11irfanview—
    87 CVECVSS 7.8
    NEW×17.4
    irfanview (87) · formats (4)
  • 12packagist—
    74 CVE2 critCVSS 5.7
    Nuclei 4PoC 20
    moodle/moodle (25) · librenms/librenms (13) · symfony/symfony (5)
  • 13intel—
    59 CVECVSS 6.2
    intel arc graphics (4) · video processing library (4) · intel iris xe graphics (4)
  • 14adobe—
    57 CVECVSS 6.8
    substance3d - painter (23) · substance 3d painter (23) · adobe substance 3d painter (22)
  • 15pypi—
    51 CVE5 critCVSS 7.1
    Nuclei 3PoC 8
    calibreweb (3) · transformers (3) · aiohttp (2)
  • 16fedora project—
    50 CVECVSS 5.5
    fedora (50)
  • 17ivanti—
    49 CVE8 critCVSS 7.6
    endpoint manager (18) · connect secure (18) · policy secure (15)
  • 18netgear—
    49 CVECVSS 6.2
    ×7.5
    r7000p (27) · r7000p firmware (26) · r8500 firmware (25)
  • 19maven—
    48 CVE5 critCVSS 7.3
    PoC 4
    org.keycloak:keycloak-quarkus-server (6) · org.keycloak:keycloak-services (4) · ca.uhn.hapi.fhir:org.hl7.fhir.dstu3 (2)
  • 20ао «ивк»—
    47 CVE7 critCVSS 6.7
    PoC 3
    альт сп 10 (35) · альт 8 сп (18)
  • 21code-projects—
    46 CVECVSS 5.9
    PoC 46
    e-health care system (10) · farmacia (10) · job recruitment (6)
  • 22novell inc.—
    44 CVE1 critCVSS 5.8
    KEV 1PoC 2
    opensuse leap (34) · suse linux enterprise server (33) · suse linux enterprise desktop (32)
  • 23go—
    42 CVE5 critCVSS 7.1
    Nuclei 1PoC 5
    github.com/goharbor/harbor (6) · github.com/moby/moby (3) · github.com/drakkan/sftpgo/v2 (2)
  • 24pdf-xchange—
    39 CVECVSS 6.6
    pdf-xchange editor (39) · pdf-tools (38)
  • 25unknown—
    39 CVE2 critCVSS 5.4
    Nuclei 39PoC 38
    logo slider (2) · rss feed widget (2) · appointment booking calendar — simply schedule appointments booking plugin (2)
  • 26tracker software products ltd.—
    38 CVECVSS 6.7
    pdf-xchange editor (38) · pdf-xchange pro (11) · pdf-tools (11)
  • 27qualcomm—
    36 CVE3 critCVSS 7.8
    wsa8830 firmware (21) · wsa8835 firmware (21) · wcd9380 firmware (20)
  • 28qualcomm, inc.—
    36 CVE3 critCVSS 7.8
    snapdragon (36)
  • 29tungstenautomation—
    36 CVECVSS 6.4
    power pdf (36)
  • 30phpgurukul—
    34 CVE2 critCVSS 5.0
    PoC 33
    online shopping portal (11) · user registration \& login and user management system (4) · complaint management system (4)
  • 31siemens—
    34 CVE3 critCVSS 5.9
    KEV 1
    teamcenter visualization v14.2 (10) · teamcenter visualization v14.3 (10) · tecnomatix plant simulation v2404 (10)
  • 32anisha—
    32 CVECVSS 6.0
    NEW×5.3PoC 32
    e-health care system (10) · farmacia (8) · job recruitment (6)
  • 33ibm—
    32 CVE4 critCVSS 6.3
    concert (5) · concert software (5) · security verify access (4)
  • 34tungsten automation—
    32 CVECVSS 6.3
    NEW
    power pdf (32)
  • 35ао «нтц ит роса»—
    32 CVE1 critCVSS 6.4
    KEV 1PoC 2
    rosa virtualization 3.0 (21) · роса кобальт (12) · роса хром (7)
  • 36dlink—
    29 CVE4 critCVSS 7.4
    Nuclei 3PoC 16
    di-8003 (7) · di-8003 firmware (7) · dsl6740c firmware (7)
  • 37qnap—
    29 CVE3 critCVSS 6.9
    ×3.6
    qts (16) · quts hero (16) · notes station 3 (4)
  • 38apache—
    26 CVE6 critCVSS 7.4
    tomcat (4) · traffic server (4) · nimble (4)
  • 39apache software foundation—
    25 CVE6 critCVSS 7.6
    apache tomcat (4) · apache nimble (4) · tomcat (4)
  • 40moodle—
    25 CVECVSS 5.9
    Nuclei 1PoC 1
    moodle (25)
  • 41mozilla—
    24 CVE4 critCVSS 7.3
    PoC 2
    firefox (20) · thunderbird (17) · firefox esr (10)
  • 42trimble—
    24 CVECVSS 7.7
    NEW
    sketchup viewer (19) · sketchup (8) · sketchup pro (2)
  • 431000 projects—
    23 CVECVSS 7.0
    NEWPoC 23
    beauty parlour management system (11) · bookstore management system (9) · portfolio management system mca (3)
  • 44npm—
    22 CVECVSS 6.8
    PoC 2
    @sveltejs/kit (2) · vue-i18n (2) · petite-vue-i18n (2)
  • 45мартин догиамас—
    22 CVECVSS 6.0
    NEW×4.0Nuclei 1PoC 1
    moodle (22)
  • 46advantech—
    21 CVE6 critCVSS 7.9
    NEW
    eki-6333ac-2g firmware (20) · eki-6333ac-2gd (20) · eki-6333ac-2gd firmware (20)
  • 47crates.io—
    21 CVE1 critCVSS 7.9
    PoC 2
    surrealdb-core (3) · surrealdb (3) · mimalloc (1)
  • 48huawei—
    21 CVECVSS 5.8
    harmonyos (21) · emui (5)
  • 49hpe—
    20 CVE3 critCVSS 7.2
    PoC 2
    hpe athonet core (7) · hpe aruba networking access points, instant aos-8, and aos-10 (6) · insight remote support (5)
  • 50lopalopa—
    20 CVE2 critCVSS 6.8
    PoC 6
    e-learning management system (20)

Top weaknesses

CWE classes by distinct CVE count.

1CWE-79824—
2CWE-862261—
3CWE-89245—
4CWE-787239—
5CWE-125198—
6CWE-78134—
7CWE-22115—
8CWE-120107—
9CWE-74104—
10CWE-35299—
11CWE-41697—
12CWE-9493—
13CWE-43489—
14CWE-2071—
15CWE-47668—
16CWE-12265—
17CWE-27664—
18CWE-7762—
19CWE-28460—
20CWE-20057—

Sectors

Solution categories ranked by distinct CVE count this period.

  • Web & CMS Plugins990 CVE
    116 crit690 vendorsCVSS 7.0
    element pack (6) · jobsearch wp job board (5) · kognetiks chatbot (5)
  • Operating Systems738 CVE
    145 crit154 KEV47 vendorsCVSS 7.9
    linux (555) · linux kernel (279) · astra linux special edition (261)
  • Enterprise Software540 CVE
    75 crit4 KEV129 vendorsCVSS 7.4
    zabbix (28) · glpi (24) · itop (14)
  • OSS Libraries389 CVE
    53 crit88 vendorsCVSS 7.9
    ffmpeg (17) · mongoose (10) · mongoose web server (10)
  • Consumer Software356 CVE
    25 crit45 vendorsCVSS 7.4
    irfanview (87) · power pdf (32) · tsmuxer (7)
  • Networking Infrastructure332 CVE
    39 crit6 KEV58 vendorsCVSS 7.7
    r7000p (27) · r7000p firmware (26) · r8500 (25)
  • Hardware Firmware243 CVE
    86 crit31 vendorsCVSS 7.8
    amd ryzen™ ai software (4) · bluefield 1 (4) · bluefield ga (4)
  • Mobile Apps190 CVE
    8 crit17 KEV12 vendorsCVSS 9.0
    android (132) · harmonyos (21) · chrome (13)
  • Security Products184 CVE
    28 crit10 KEV67 vendorsCVSS 7.6
    connect secure (18) · endpoint manager (18) · policy secure (15)
  • ICS / OT / IoT181 CVE
    131 crit11 KEV49 vendorsCVSS 9.8
    monitouch v-sft (24) · eki-6333ac-1gpo (20) · eki-6333ac-1gpo firmware (20)
  • Cloud & SaaS146 CVE
    25 crit5 KEV70 vendorsCVSS 8.2
    nextcloud server (21) · security-advisories (17) · nextcloud enterprise server (10)
  • DevTools & CI58 CVE
    9 crit32 vendorsCVSS 7.7
    gitlab (24) · enterprise server (3) · helix core (3)
  • Communications47 CVE
    4 crit2 KEV26 vendorsCVSS 6.6
    mattermost (4) · mattermost server (4) · chatwoot (3)
  • AI / ML44 CVE
    6 crit27 vendorsCVSS 10.0
    harbor (6) · transformers (6) · yocto (2)
  • Databases25 CVE
    3 crit3 KEV16 vendorsCVSS 7.4
    postgresql (8) · oracle exadata (4) · postgres pro certified (4)
  • Unclassified349 CVE
    56 crit1 KEV228 vendorsCVSS 6.9
    allegra (18) · bitcoin core (11) · wave 2.0 (11)
Weakness × Sector

Which weaknesses hit which solution categories in November 2024

Cells shaded by share of the sector's hottest weakness. Click a row to open the sector history.

79XSS862Missing Authorization89SQL Injection787Out-of-bounds Write125Out-of-bounds Read78OS Command Injection22Path Traversal120Buffer Overflow74Injection352CSRFWeb & CMS Plugins465198951183214461Operating Systems24166626458122Consumer Software31421269531257Enterprise Software114141021221134513OSS Libraries621057118221653Networking Infrastructure2722124641153123Hardware Firmware624192010610ICS / OT / IoT81831827731Security Products1722156161012Cloud & SaaS327316212