CVE Tools
Sign in
month report

December 2024

Data as of Jun 11, 2026, 06:05 UTCSnapshot v1 Sources CVEList V5+NVD+GHSA+CSAF+FSTEC BDU+CISA KEV+EPSS+Nuclei templates Methodology →

December 2024 closed with 3,514 published CVEs — +26.9% YoY . 316 criticals, 16 added to CISA KEV (4 ransomware-linked). сообщество свободного программного обеспечения led volume, mostly via linux. Biggest breakout: openrobotics at ×5.3 their 12-month median. Top weakness class — CWE-79 (712 CVE). 10 vendors cracked the top-100 for the first time.

Print view
Total CVEs
3,514
— MoM+26.9% YoY
Severity mix
316 / 1,123
critical / high
KEV added
16
4 ransomware-linked
Nuclei coverage
34.5%
1,211 CVEs with templates

Time to exploit

How fast the community ships detection after a CVE drops.

Days → Nuclei (median)
448.3
n=1,211
Within 7 days
0.0%
Within 30 days
0.0%
Days → KEV (median)
28
n=11
Detection gap

KEV pressure, no Nuclei coverage

December 2024 · vendors with active exploitation listed by CISA but no public detection template.

Weakness × Vendor

What's spreading where in December 2024

Cells shaded by share of vendor's hottest weakness. Click any cell to open the CWE history.

79XSS862Missing Authorization89SQL Injection352CSRF787Out-of-bounds Write476NULL Pointer Dereference94Code Injection125Out-of-bounds Read74Injection416Use After Freeсообщество свободного программного обеспечения91712185226658linux11751156ооо «русбитех-астра»19572344ао «нппкт»116472147ооо «ред софт»10119412032canonical ltd.1643733red hat inc.1112331927adobe100247147adobe systems inc.100246117novell inc.152167microsoft corp211416microsoft131315

Most discussed CVEs — December 2024

No CVE mentions in the news this month yet.

Breakout vendors

CVE count ≥3× their own 12-period median.

First time in top-100

Vendors never in top-100 in the prior 24 periods.

Top vendors

Ranked by distinct CVE count this period.

  • 1сообщество свободного программного обеспечения—
    456 CVE32 critCVSS 6.4
    KEV 3Nuclei 1PoC 17
    linux (354) · debian gnu/linux (270) · drupal (8)
  • 2linux—
    354 CVECVSS 6.1
    KEV 3
    linux (354) · linux kernel (354)
  • 3ооо «русбитех-астра»—
    291 CVE18 critCVSS 6.6
    KEV 3PoC 4
    astra linux special edition (291) · astra linux common edition (30) · astra linux special edition для «эльбрус» (1)
  • 4ао "нппкт"—
    272 CVE17 critCVSS 6.5
    KEV 3PoC 6
    осон основа оnyx (272)
  • 5ооо «ред софт»—
    256 CVE25 critCVSS 6.7
    KEV 3PoC 11
    ред ос (256)
  • 6canonical—
    206 CVE2 critCVSS 6.1
    PoC 2
    ubuntu (204) · lxd (2)
  • 7redhat—
    196 CVE17 critCVSS 6.6
    KEV 2PoC 6
    red hat enterprise linux (181) · red hat build of keycloak (4) · red hat openshift container platform (4)
  • 8adobe—
    177 CVE3 critCVSS 6.2
    ×3.9
    adobe experience manager (92) · experience manager (90) · adobe connect (20)
  • 9novell inc.—
    95 CVE6 critCVSS 6.3
    ×3.4KEV 1PoC 3
    opensuse leap (89) · suse linux enterprise server (85) · suse linux enterprise desktop (84)
  • 10microsoft—
    91 CVE3 critCVSS 7.6
    KEV 1PoC 12
    windows server 2025 (58) · windows server 2025 (server core installation) (58) · windows server 2022, 23h2 edition (server core installation) (57)
  • 11google—
    64 CVE4 critCVSS 7.3
    KEV 1Nuclei 1
    android (54) · chrome (7) · google chrome (7)
  • 12apple—
    62 CVE6 critCVSS 6.5
    macos (59) · ios and ipados (28) · ipados (28)
  • 13code-projects—
    56 CVECVSS 5.7
    ×3.3PoC 35
    job recruitment (10) · simple admin panel (10) · online class and exam scheduling system (7)
  • 14ibm—
    56 CVE1 critCVSS 5.8
    cognos controller (10) · cognos analytics (5) · security guardium key lifecycle manager (5)
  • 15huawei—
    54 CVE1 critCVSS 5.0
    harmonyos (26) · secospace usg6300 firmware (7) · secospace usg6500 (7)
  • 16ооо «открытая мобильная платформа»—
    54 CVE16 critCVSS 8.1
    ×3.9KEV 3PoC 2
    ос аврора (53) · аврора центр (1)
  • 17phpgurukul—
    47 CVE5 critCVSS 5.3
    ×3.6PoC 26
    land record system (12) · maid hiring management system (7) · online nurse hiring system (5)
  • 18packagist—
    42 CVE7 critCVSS 7.7
    KEV 1Nuclei 1PoC 7
    drupal/core (7) · drupal/core-recommended (5) · drupal/drupal (5)
  • 19go—
    39 CVE5 critCVSS 6.8
    PoC 2
    github.com/siyuan-note/siyuan/kernel (4) · github.com/mattermost/mattermost/server/v8 (3) · github.com/cosmwasm/wasmvm (2)
  • 20maven—
    39 CVE10 critCVSS 7.1
    Nuclei 3PoC 6
    org.apache.tomcat:tomcat-catalina (3) · org.keycloak:keycloak-quarkus-server (2) · org.apache.tomcat.embed:tomcat-embed-core (2)
  • 21ооо «нцпр»—
    37 CVE17 critCVSS 8.5
    ×3.4PoC 2
    мсвсфера (37)
  • 22unknown—
    36 CVE1 critCVSS 5.3
    Nuclei 35PoC 36
    wordpress button plugin maxbuttons (2) · paid membership plugin, ecommerce, user registration form, login form, user profile & restrict content (2) · system dashboard (2)
  • 23dell—
    35 CVE1 critCVSS 7.2
    recoverpoint for virtual machines (7) · elastic cloud storage (3) · ecs (3)
  • 24pypi—
    32 CVE5 critCVSS 7.5
    PoC 2
    matrix-synapse (6) · apache-superset (4) · django (2)
  • 25gstreamer—
    29 CVE16 critCVSS 8.6
    NEWPoC 2
    gstreamer (29)
  • 26сообщество gstreamer—
    29 CVE16 critCVSS 8.6
    NEWPoC 2
    gstreamer (29)
  • 271000projects—
    28 CVE1 critCVSS 7.0
    NEWPoC 28
    portfolio management system mca (11) · attendance tracking management system (9) · library management system (2)
  • 281000 projects—
    27 CVECVSS 7.0
    NEWPoC 27
    portfolio management system mca (11) · attendance tracking management system (9) · library management system (2)
  • 29abb—
    24 CVE14 critCVSS 8.9
    NEW×4.0
    nexus series nexus-3-x (24) · matrix series mat-x (24) · nexus series (24)
  • 30crates.io—
    23 CVECVSS 7.5
    PoC 1
    cosmwasm-vm (2) · pgp (2) · age (1)
  • 31npm—
    22 CVE4 critCVSS 7.1
    Nuclei 3PoC 2
    directus (2) · astro (2) · cookie-encrypter (1)
  • 32lopalopa—
    21 CVE9 critCVSS 8.1
    PoC 11
    e-learning management system (21)
  • 33openrobotics—
    21 CVE15 critCVSS 9.2
    NEW×5.3PoC 21
    robot operating system (21)
  • 34qnap—
    19 CVE6 critCVSS 7.8
    PoC 1
    qts (10) · quts hero (10) · qulog center (2)
  • 35autodesk—
    18 CVECVSS 7.6
    navisworks manage (14) · navisworks (14) · navisworks freedom (14)
  • 36qnap systems, inc.—
    18 CVE6 critCVSS 7.7
    PoC 1
    qts (10) · quts hero (10) · qulog center (2)
  • 37vibethemes—
    18 CVE11 critCVSS 9.2
    NEWNuclei 18
    wordpress learning management system (15) · wplms (15) · vibebp (3)
  • 38apache—
    17 CVE7 critCVSS 7.5
    Nuclei 2PoC 2
    superset (4) · tomcat (3) · hive (2)
  • 39apache software foundation—
    17 CVE7 critCVSS 7.4
    Nuclei 2PoC 2
    superset (4) · apache superset (4) · apache tomcat (3)
  • 40ivanti—
    16 CVE5 critCVSS 8.0
    connect secure (5) · cloud services application (3) · cloud services appliance (3)
  • 41dell technologies—
    15 CVE1 critCVSS 7.2
    recoverpoint (6) · powerscale onefs (3) · openmanage server administrator (2)
  • 42jetbrains—
    15 CVECVSS 4.9
    teamcity (9) · youtrack (6)
  • 43mediatek, inc.—
    15 CVECVSS 6.8
    mt6580, mt6739, mt6761, mt6765, mt6768, mt6779, mt6781, mt6785, mt6789, mt6833, mt6835, mt6853, mt6855, mt6873, mt6877, mt6878, mt6879, mt6883, mt6885, mt6886, mt6889, mt6893, mt6895, mt6896, mt6897, mt6983, mt6985, mt6989, mt8321, mt8666, mt8667, mt8673, mt8678, mt8765, mt8766, mt8766r, mt8768, mt8771, mt8781, mt8786, mt8788, mt8788e, mt8791t, mt8797, mt8798, mt8863t (3) · mt2737, mt3605, mt6985, mt6989, mt6990, mt7925, mt7927, mt8518s, mt8532, mt8678 (1) · mt2737, mt6298, mt6879, mt6886, mt6895, mt6895t, mt6896, mt6980, mt6980d, mt6983, mt6985, mt6989, mt6990, mt8673, mt8676, mt8795t, mt8798 (1)
  • 44image access gmbh—
    14 CVECVSS 6.2
    NEWPoC 14
    scan2net (14)
  • 45siemens—
    14 CVE2 critCVSS 7.8
    solid edge se2024 (4) · siemens totally integrated automation portal (tia portal) (3) · comos v10.4.1 (2)
  • 46codezips—
    13 CVECVSS 6.8
    NEWPoC 13
    e-commerce site (4) · technical discussion forum (2) · hospital management system (2)
  • 47fabian—
    13 CVECVSS 5.6
    PoC 11
    online class and exam scheduling system (5) · hospital management system (2) · hostel management system (2)
  • 48qualcomm—
    13 CVECVSS 8.0
    fastconnect 6900 firmware (12) · wsa8835 firmware (12) · wsa8830 firmware (12)
  • 49qualcomm, inc.—
    13 CVECVSS 7.4
    snapdragon (13)
  • 50samsung mobile—
    13 CVECVSS 5.2
    samsung mobile devices (7) · gaminghub (3) · quick share agent (1)

Top weaknesses

CWE classes by distinct CVE count.

1CWE-79712—
2CWE-862423—
3CWE-89243—
4CWE-352174—
5CWE-787146—
6CWE-476123—
7CWE-94117—
8CWE-125111—
9CWE-74105—
10CWE-416102—
11CWE-2265—
12CWE-20052—
13CWE-43447—
14CWE-36245—
15CWE-28444—
16CWE-12042—
17CWE-2041—
18CWE-7840—
19CWE-86336—
20CWE-40135—

Sectors

Solution categories ranked by distinct CVE count this period.

  • Web & CMS Plugins1,062 CVE
    122 crit3 KEV704 vendorsCVSS 6.7
    wordpress learning management system (15) · wplms (15) · wp mailster (12)
  • Operating Systems725 CVE
    258 crit107 KEV38 vendorsCVSS 7.6
    linux (708) · linux kernel (354) · astra linux special edition (291)
  • Enterprise Software431 CVE
    86 crit4 KEV104 vendorsCVSS 7.7
    cognos controller (10) · glpi (10) · whatsup gold (9)
  • OSS Libraries320 CVE
    138 crit1 KEV89 vendorsCVSS 8.3
    gstreamer (87) · tcpdf (13) · ffmpeg (4)
  • Consumer Software233 CVE
    10 crit32 vendorsCVSS 7.5
    adobe experience manager (181) · experience manager (90) · adobe connect (39)
  • Mobile Apps202 CVE
    30 crit1 KEV12 vendorsCVSS 6.6
    android (61) · harmonyos (26) · chrome (7)
  • Hardware Firmware143 CVE
    52 crit26 vendorsCVSS 8.0
    qts (30) · quts hero (30) · synology router manager (srm) (8)
  • Security Products116 CVE
    25 crit15 KEV52 vendorsCVSS 7.7
    connect secure (5) · cloud services appliance (3) · cloud services application (3)
  • Networking Infrastructure107 CVE
    30 crit5 KEV44 vendorsCVSS 8.4
    ruijie reyee os (10) · iap-420 firmware (5) · ac6 firmware (4)
  • ICS / OT / IoT100 CVE
    450 crit36 vendorsCVSS 9.0
    aspect-enterprise (24) · aspect-enterprise asp-ent-x (24) · matrix series (24)
  • Cloud & SaaS89 CVE
    7 crit57 vendorsCVSS 7.5
    frontend admin (3) · docusign (2) · linkace (2)
  • DevTools & CI51 CVE
    3 crit18 vendorsCVSS 8.1
    teamcity (9) · youtrack (6) · labview (3)
  • AI / ML30 CVE
    18 crit10 vendorsCVSS 10.0
    robot operating system (21) · yocto (1)
  • Communications28 CVE
    5 crit2 KEV16 vendorsCVSS 7.4
    misskey (11) · synapse (11) · mattermost (5)
  • Databases22 CVE
    2 crit1 KEV11 vendorsCVSS 7.5
    oracle exadata (4) · cognos analytics (2) · ibm db2 (2)
  • Unclassified290 CVE
    39 crit207 vendorsCVSS 6.8
    мсвсфера (37) · job recruitment (6) · rebuild (4)
Weakness × Sector

Which weaknesses hit which solution categories in December 2024

Cells shaded by share of the sector's hottest weakness. Click a row to open the sector history.

79XSS862Missing Authorization89SQL Injection352CSRF787Out-of-bounds Write476NULL Pointer Dereference94Code Injection125Out-of-bounds Read74Injection416Use After FreeWeb & CMS Plugins47035811011035753Operating Systems181616090168577Enterprise Software162149514222451OSS Libraries479810111315191Consumer Software41451508321313Hardware Firmware1165186155ICS / OT / IoT42331546122Security Products764146521Networking Infrastructure12169528Cloud & SaaS13986111