CVE Tools
Track your stack

January 2016

670 CVEs published, +18% on December 2015 and −9% on January 2015. CISA added 0 to KEV.

2016 month by month

2016, month by month. Point at another month to read it.
2016: CVEs published per month
YearJanFebMarAprMayJunJulAugSepOctNovDecYear total
2016January 2016: 670 CVEsFebruary 2016: 394 CVEsMarch 2016: 333 CVEsApril 2016: 661 CVEsMay 2016: 617 CVEsJune 2016: 515 CVEsJuly 2016: 789 CVEsAugust 2016: no snapshotSeptember 2016: 597 CVEsOctober 2016: 697 CVEsNovember 2016: no snapshotDecember 2016: 527 CVEs5,80010 of 12 months10/12
Critical
6410% of the 669 with a CVSS score
Added to CISA KEV
02 of this month's CVEs are in KEV, listed a median 2262 days after publication
Vendors
152686 products
Top weakness
Memory Buffer BoundsCWE-119 · 68 CVEs

Who drove it

Vendors by distinct CVEs this month, with how many of those CVEs are now in CISA KEV and how far each moved in the ranking.

  1. 1OracleSolaris, E-business Suite, MySQL23012nonenew
  2. 2IBMJazz Reporting Service, Maximo For Life Sciences, Maximo For Nuclear Power7621new
  3. 3OpensuseLeap, Opensuse434nonenew
  4. 4CanonicalUbuntu Linux, Ubuntu343nonenew
  5. 5WiresharkWireshark330nonenew
  6. 6GoogleAndroid, Chrome, Google Chrome273nonenew
  7. 7DebianDebian Linux, Fuse251nonenew
  8. 8MicrosoftWindows 7 Service Pack 1, Windows 7, Windows Server 2008 R2 Service Pack 12511new
  9. 9Red HatEnterprise Linux, Enterprise Linux Workstation, Enterprise Linux Desktop244nonenew
  10. 10CiscoFiresight System Software, Identity Services Engine Software, Aironet Access Point Software235nonenew
  11. 11MozillaFirefox, Firefox OS, Bugzilla224nonenew
  12. 12AppleMac OS X, Quicktime, OS X181nonenew
  13. 13AdobeAcrobat Dc, Acrobat Reader, Acrobat Reader Dc176nonenew
  14. 14AdvantechWebaccess, Eki-1321 Series Firmware, Eki-1322 Series Firmware165nonenew
  15. 15FedoraprojectFedora153nonenew
  16. 16HuaweiP8 Firmware, VCN500, Gem-703l Firmware140nonenew
  17. 17MariaDBMariaDB140nonenew
  18. 18HPStoreonce Backup System Software, Storeonce Backup, HPE Systems Insight Manager131nonenew
  19. 19Advantech Co., LtdAdvantech Webaccess, Eki Серии 1321, Eki Серии 1322115nonenew
  20. 20PHPPHP113nonenew
  21. 21PHP GroupPHP102nonenew
  22. 22PackagistTypo3/cms, Dolibarr/dolibarr, Symphonycms/symphony-270nonenew
  23. 23JuniperJunos, Screenos60nonenew
  24. 24KddiHome Spot Cube Firmware60nonenew
  25. 25OpenstackNova, Swift, Orchestration API60nonenew

Severity

How this month's CVEs score on CVSS; 1 have no score yet. Severity is not exploitation.

  • Critical6410%
  • High16324%
  • Medium38457%
  • Low589%

Breakouts

Vendors with at least three times their own 12-month median.

  1. Oracle23017.0×
  2. Advantech1616.0×
  3. Huawei1414.0×
  4. Juniper66.0×
  5. TYPO366.0×
  6. Wireshark335.5×
  7. Packagist74.7×
  8. IBM Corp.44.0×
  9. Openstack63.0×
  10. Roundcube33.0×

New in the top 100

Not in the top 100 in any of the 24 months before.

  1. Advantech Co., Ltd11#19
  2. Kddi6#24
  3. Fedora Project4#32
  4. Lenovo4#34
  5. Matroska4#35
  6. Cgit Project3#38
  7. F5 Networks, Inc.3#39
  8. ISC3#40
  9. OpenBSD Project3#42
  10. Roundcube3#44

What kind of weakness

Weakness classes (CWE) by distinct CVEs, with how far each moved in the ranking.

  1. CWE-119Memory Buffer Bounds68new
  2. CWE-20Improper Input Validation67new
  3. CWE-79XSS61new
  4. CWE-200Information Exposure56new
  5. CWE-26440new
  6. CWE-39916new
  7. CWE-25415new
  8. CWE-22Path Traversal11new
  9. CWE-179new
  10. CWE-352CSRF9new
  11. CWE-2558new
  12. CWE-284Improper Access Control8new
  13. CWE-1897new
  14. CWE-89SQL Injection7new
  15. CWE-3106new
  16. CWE-78OS Command Injection6new
  17. CWE-195new
  18. CWE-287Improper Authentication5new
  19. CWE-426Untrusted Search Path3new
  20. CWE-362Race Condition2new

Where it landed

The month's CVEs by the sector of the software they affect. A CVE that touches several sectors counts in each.

Area is CVEs this month. Point at a sector to read it.

Which weakness, where

The top weakness classes against the vendors and the sectors that carried them.

The lighter the cell, the more CVEs. Point at one to read it.

January 2016: weakness classes by vendor and by sector: By vendor
By vendor119Memory Buffer Bounds20Improper Input Validation79XSS200Information Exposure26439925422Path Traversal17352CSRF
Oracle511
IBM231618922244
Oracle Corp.211
Opensuse621512
Wireshark433
Canonical221
Google2168122
Debian2111
Microsoft616231
Google Inc216812
Microsoft Corp616231
Red Hat111

Snapshot v1, computed Jun 11, 2026, 06:04 UTC. MethodologyAll months on record

Nuclei coverage and the detection gap are held back while the template mirror is repaired.

We use analytics cookies to see which pages and articles actually help people. Decline and none of them run — the site works the same. What we store