October 2016

697 CVEs published, +17% on September 2016 and −6% on October 2015. CISA added 0 to KEV.

2016, month by month. Point at another month to read it.

2016: CVEs published per month
Year	Jan	Feb	Mar	Apr	May	Jun	Jul	Aug	Sep	Oct	Nov	Dec	Year total
2016	January 2016: 670 CVEs	February 2016: 394 CVEs	March 2016: 333 CVEs	April 2016: 661 CVEs	May 2016: 617 CVEs	June 2016: 515 CVEs	July 2016: 789 CVEs	August 2016: no snapshot	September 2016: 597 CVEs	October 2016: 697 CVEs	November 2016: no snapshot	December 2016: 527 CVEs	5,80010 of 12 months10/12

Critical: 14321% of the 687 with a CVSS score
Added to CISA KEV: 03 of this month's CVEs are in KEV, listed a median 2048 days after publication
Vendors: 153453 products
Top weakness: Improper Access ControlCWE-284 · 95 CVEs

Who drove it

Vendors by distinct CVEs this month, with how many of those CVEs are now in CISA KEV and how far each moved in the ranking.

How this month's CVEs score on CVSS; 10 have no score yet. Severity is not exploitation.

Vendors with at least three times their own 12-month median.

Not in the top 100 in any of the 24 months before.

Weakness classes (CWE) by distinct CVEs, with how far each moved in the ranking.

The month's CVEs by the sector of the software they affect. A CVE that touches several sectors counts in each.

Area is CVEs this month. Point at a sector to read it.

The top weakness classes against the vendors and the sectors that carried them.

The lighter the cell, the more CVEs. Point at one to read it.

October 2016: weakness classes by vendor and by sector: By vendor
By vendor	284Improper Access Control	119Memory Buffer Bounds	200Information Exposure	79XSS	264	20Improper Input Validation	416Use After Free	399	89SQL Injection	254
Oracle	69		26	1	4			1		3
Adobe	2	51					23			1
Adobe Systems Inc.	2	48					22			1
Google	4	5	17		25	7		1		1
Cisco		3	4	4	4	15		15	2
Microsoft	2	13	9		9	1
IBM	3		5	7	3				1	1
Microsoft Corp	1	12	2		4
Linux		3	1		2	1	1	2
Red Hat	2		1	2	1	1		1		1
Huge-it				7					11
Libtiff