CVE Tools
Track your stack

April 2014

676 CVEs published, +24% on March 2014 and +56% on April 2013. CISA added 0 to KEV.

2014 month by month

2014, month by month. Point at another month to read it.
2014: CVEs published per month
YearJanFebMarAprMayJunJulAugSepOctNovDecYear total
2014January 2014: 579 CVEsFebruary 2014: 445 CVEsMarch 2014: 545 CVEsApril 2014: 676 CVEsMay 2014: 555 CVEsJune 2014: 448 CVEsJuly 2014: 656 CVEsAugust 2014: 407 CVEsSeptember 2014: 1,156 CVEsOctober 2014: 1,418 CVEsNovember 2014: 505 CVEsDecember 2014: 618 CVEs8,008+50%
Critical
6410% of the 666 with a CVSS score
Added to CISA KEV
03 of this month's CVEs are in KEV, listed a median 2912 days after publication
Vendors
263631 products
Top weakness
Improper Input ValidationCWE-20 · 77 CVEs

Who drove it

Vendors by distinct CVEs this month, with how many of those CVEs are now in CISA KEV and how far each moved in the ranking.

  1. 1OracleJre, Jdk, Java Runtime Environment10810nonenew
  2. 2CanonicalUbuntu Linux, Update-manager, Libpam-modules46151new
  3. 3CiscoIOS, Adaptive Security Appliance Software, Asr 1004450nonenew
  4. 4DebianDebian Linux, Dpkg, Ppthtml3881new
  5. 5Red HatEnterprise Linux Server, Enterprise Linux Desktop, Enterprise Linux Workstation3521new
  6. 6AppleSafari, Mac OS X, tvOS272nonenew
  7. 7FedoraprojectFedora2561new
  8. 8IBMForms Viewer, Messagesight, Messagesight Jms Client256nonenew
  9. 9OpensuseOpensuse, Evergreen2471new
  10. 10SapEnterprise Portal, Netweaver Java Application Server, Netweaver Software Lifecycle Manager240nonenew
  11. 11GoogleChrome, Google Chrome, Android220nonenew
  12. 12MicrosoftInternet Explorer, Word, Microsoft Publisher18131new
  13. 13PaperthinCommonspot Content Server165nonenew
  14. 14PyPIRoundup, Django, Pillow162nonenew
  15. 15MozillaFirefox, Seamonkey, Thunderbird156nonenew
  16. 16SuseSuse Linux Enterprise Server, Studio Onsite, Studio Extension For System Z142nonenew
  17. 17JuniperJunos, Junos Space, Screenos134nonenew
  18. 18Gentoo Foundation Inc.Gentoo Linux1221new
  19. 19LinuxLinux Kernel110nonenew
  20. 20MavenOrg.apache.struts:struts2-core, Org.fitnesse:fitnesse, Org.igniterealtime.openfire:parent110nonenew
  21. 21AdvantechWebaccess, Advantech Webaccess100nonenew
  22. 22XenXen100nonenew
  23. 23HPUniversal Configuration Management Database, Array Diagnostics Utility, Database and Middleware Automation92nonenew
  24. 24MariaDBMariaDB90nonenew
  25. 25ApacheStruts, Xalan-java, Archiva80nonenew

Severity

How this month's CVEs score on CVSS; 10 have no score yet. Severity is not exploitation.

  • Critical6410%
  • High14221%
  • Medium40761%
  • Low538%

New in the top 100

Not in the top 100 in any of the 24 months before.

  1. Sap24#10
  2. Paperthin16#13
  3. Juniper13#17
  4. Fortinet5#31
  5. Horde5#32
  6. Zyxel5#34
  7. Cacti4#35
  8. Python4#38
  9. Asus3#43
  10. Clip-bucket3#44

What kind of weakness

Weakness classes (CWE) by distinct CVEs, with how far each moved in the ranking.

  1. CWE-20Improper Input Validation77new
  2. CWE-26470new
  3. CWE-79XSS68new
  4. CWE-119Memory Buffer Bounds59new
  5. CWE-200Information Exposure23new
  6. CWE-22Path Traversal22new
  7. CWE-352CSRF21new
  8. CWE-287Improper Authentication20new
  9. CWE-39920new
  10. CWE-89SQL Injection20new
  11. CWE-18913new
  12. CWE-25513new
  13. CWE-31013new
  14. CWE-94Code Injection12new
  15. CWE-5911new
  16. CWE-78OS Command Injection10new
  17. CWE-1217new
  18. CWE-416Use After Free6new
  19. CWE-362Race Condition4new
  20. CWE-125Out-of-bounds Read3new

Where it landed

The month's CVEs by the sector of the software they affect. A CVE that touches several sectors counts in each.

Area is CVEs this month. Point at a sector to read it.

Which weakness, where

The top weakness classes against the vendors and the sectors that carried them.

The lighter the cell, the more CVEs. Point at one to read it.

April 2014: weakness classes by vendor and by sector: By vendor
By vendor20Improper Input Validation26479XSS119Memory Buffer Bounds200Information Exposure22Path Traversal352CSRF287Improper Authentication39989SQL Injection
Oracle111
Oracle Corp.12
Canonical31111
Cisco1732311234
Debian121111
Red Hat35111
Apple4311421
Fedoraproject3121
IBM4151
Opensuse22211
Sap822111
Google315

Snapshot v1, computed Jun 11, 2026, 06:04 UTC. MethodologyAll months on record

Nuclei coverage and the detection gap are held back while the template mirror is repaired.

We use analytics cookies to see which pages and articles actually help people. Decline and none of them run — the site works the same. What we store