June 2016
515 CVEs published, −17% on May 2016 and +3% on June 2015. CISA added 0 to KEV.
2016 month by month
| Year | Jan | Feb | Mar | Apr | May | Jun | Jul | Aug | Sep | Oct | Nov | Dec | Year total |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 2016 | January 2016: 670 CVEs | February 2016: 394 CVEs | March 2016: 333 CVEs | April 2016: 661 CVEs | May 2016: 617 CVEs | June 2016: 515 CVEs | July 2016: 789 CVEs | August 2016: no snapshot | September 2016: 597 CVEs | October 2016: 697 CVEs | November 2016: no snapshot | December 2016: 527 CVEs | 5,80010 of 12 months10/12 |
- Critical
- 6012% of the 512 with a CVSS score
- Added to CISA KEV
- 06 of this month's CVEs are in KEV, listed a median 2027.5 days after publication
- Vendors
- 158559 products
- Top weakness
- Memory Buffer BoundsCWE-119 · 80 CVEs
Who drove it
Vendors by distinct CVEs this month, with how many of those CVEs are now in CISA KEV and how far each moved in the ranking.
- 1OpensuseOpensuse, Leap10151new
- 2Red HatEnterprise Linux Server, Enterprise Linux Desktop, Enterprise Linux Workstation9893new
- 3DebianDebian Linux735nonenew
- 4CanonicalUbuntu Linux, Ubuntu, Lxd712nonenew
- 5GoogleAndroid, Chrome, Google Chrome712nonenew
- 6SuseLinux Enterprise Workstation Extension, Linux Enterprise Desktop, Linux Enterprise7041new
- 7AdobeFlash Player, Flash Player Desktop Runtime, Flash Player For Linux49101new
- 8MicrosoftWindows Server 2012, Windows Server 2012 Gold, Windows Server 2012 R24031new
- 9HPSystems Insight Manager, Matrix Operating Environment, Insight Control Server Deployment299nonenew
- 10CiscoCisco IOS, Ip Phone 8800 Series Firmware, Cisco RV215W252nonenew
- 11IBMDomino, Websphere Mq, Java Sdk232nonenew
- 12SymantecEndpoint Protection Manager, Csapi, Data Center Security Server191nonenew
- 13LinuxLinux Kernel, Linux Kernel-rt170nonenew
- 14HuaweiMate 8 Firmware, Honor WS851 Firmware, Hilink App161nonenew
- 15MozillaFirefox, Firefox Esr, Network Security Services140nonenew
- 16MavenOrg.apache.struts:struts2-core, Org.apache.activemq:activemq-client, Org.apache.james:james-server1262new
- 17CybozuGaroon110nonenew
- 18NovellSuse Linux Enterprise Software Development Kit, Suse Linux Enterprise Server, Suse Linux Enterprise Real Time Extension110nonenew
- 19ApacheStruts, Qpid Broker-j, James Server1042new
- 20OracleLinux, Vm Server, Solaris103nonenew
- 21QemuQemu100nonenew
- 22Сообщество Свободного Программного ОбеспеченияDebian Gnu/linux, Libxml2, P7ZIP103nonenew
- 23AppleMac OS X, iPhone OS, watchOS83nonenew
- 24WordPressWordPress80nonenew
- 25Broadcom Inc.Symantec Content Security API (Csapi), Broadcom Symantec Protection For Sharepoint Servers, Broadcom Data Center Security: Server71nonenew
Severity
How this month's CVEs score on CVSS; 3 have no score yet. Severity is not exploitation.
- Critical60
- High293
- Medium147
- Low12
Breakouts
Vendors with at least three times their own 12-month median.
New in the top 100
Not in the top 100 in any of the 24 months before.
What kind of weakness
Weakness classes (CWE) by distinct CVEs, with how far each moved in the ranking.
- CWE-119Memory Buffer Bounds80
- CWE-200Information Exposure55
- CWE-20Improper Input Validation53
- CWE-284Improper Access Control49
- CWE-26445
- CWE-79XSS30
- CWE-25421
- CWE-787Out-of-bounds Write18
- CWE-22Path Traversal11
- CWE-39911
- CWE-3108
- CWE-89SQL Injection7
- CWE-1896
- CWE-287Improper Authentication6
- CWE-352CSRF5
- CWE-194
- CWE-2554
- CWE-190Integer Overflow2
- CWE-269Improper Privilege Mgmt2
- CWE-416Use After Free2
Where it landed
The month's CVEs by the sector of the software they affect. A CVE that touches several sectors counts in each.
- Operating Systems21729% of sector-tagged CVEs
- Mobile Apps9513% of sector-tagged CVEs
- Enterprise Software7610% of sector-tagged CVEs
- Consumer Software689% of sector-tagged CVEs
- OSS Libraries669% of sector-tagged CVEs
- Security Products466% of sector-tagged CVEs
- Cloud & SaaS416% of sector-tagged CVEs
- Networking Infrastructure385% of sector-tagged CVEs
- 7 smaller sectors77
- Not yet classified12
Which weakness, where
The top weakness classes against the vendors and the sectors that carried them.
The lighter the cell, the more CVEs. Point at one to read it.
| By vendor | 119Memory Buffer Bounds | 200Information Exposure | 20Improper Input Validation | 284Improper Access Control | 264 | 79XSS | 254 | 787Out-of-bounds Write | 22Path Traversal | 399 |
|---|---|---|---|---|---|---|---|---|---|---|
| Opensuse | 22 | 6 | 3 | 17 | 2 | 1 | 5 | 15 | ||
| Red Hat | 14 | 9 | 1 | 16 | 2 | 4 | 15 | |||
| Debian | 24 | 3 | 3 | 14 | 1 | 4 | 2 | 3 | ||
| 18 | 6 | 8 | 10 | 7 | 3 | 1 | ||||
| Suse | 10 | 5 | 10 | 3 | 14 | |||||
| Canonical | 23 | 3 | 6 | 12 | 1 | 3 | 3 | 1 | ||
| Google Inc | 18 | 6 | 8 | 10 | 7 | 3 | ||||
| Adobe | 6 | 1 | 2 | 2 | 15 | |||||
| Adobe Systems Inc. | 15 | |||||||||
| Microsoft | 12 | 6 | 8 | 1 | 8 | 1 | 1 | |||
| Microsoft Corp | 8 | 5 | 4 | 1 | 7 | 1 | 1 | 2 | ||
| HP | 2 | 3 | 1 | 1 | 1 |