October Monthly Vulnerability Insights

Total advisories: 1,217 ↑ (last month: 1,000)

Important conclusions from this month’s report:

• With 1,217 advisories, we continue the trend of high volume, averaging over 1,000 advisories per month this year (last year averaged ~730). This represents a 35.8% YTD increase (last month +38%).
• 18 (last month: 14) advisories do not have a CVE assigned, including 1 rated highly critical (Gentoo).
• Less than half (40.6%) of all vulnerabilities reported this month have a “Remote Attack Vector” (last month: 43%).
• The Secunia Research Team reported 7 extremely critical advisories this month (last month: 0), highlighting Microsoft as a key vendor impacted.
• Threat intelligence continues to show that moderately critical vulnerabilities are often targeted by hackers, with fewer links to recent cyber exploits.
  • 160 advisories (last month: 108) contain at least one vulnerability linked to a recent cyber exploit.
  • 351 advisories (last month: 340) are linked to historical cyber exploits.
• More than half of all advisories are from these usual (Linux) suspect vendors: Linux, Red Hat, SUSE, and Ubuntu.
  • Interestingly, these vendors also have the highest number of rejected advisories, with 160 of 333 rejections coming from Linux, Red Hat, SUSE, and Ubuntu.
  • The trend continues with the Linux Foundation producing a high volume of “vulnerabilities,” many with low threat or risk, yet requiring significant validation effort.
• Cisco accounted for half of all networking-related advisories this month.
• Last month, 54.4% of Secunia Advisories had a threat (exploits, malware, ransomware, etc.) linked to them, and this month the percentage remains steady.

NVD Challenges: The National Vulnerability Database (NVD) continues to experience a substantial backlog, with over 19,000 vulnerabilities still awaiting analysis. These delays impact organizations relying solely on NVD data by creating significant gaps in risk assessment and timely patching. Flexera’s Secunia Research, unaffected by these delays, remains committed to delivering real-time, validated vulnerability intelligence to help our clients stay ahead.