CVE Tools
Track your stack

June 2018

1,804 CVEs published. CISA added 0 to KEV.

2018 month by month

2018, month by month. Point at another month to read it.
2018: CVEs published per month
YearJanFebMarAprMayJunJulAugSepOctNovDecYear total
2018January 2018: 1,715 CVEsFebruary 2018: 1,350 CVEsMarch 2018: 2,306 CVEsApril 2018: no snapshotMay 2018: no snapshotJune 2018: 1,804 CVEsJuly 2018: 2,225 CVEsAugust 2018: 1,057 CVEsSeptember 2018: 1,209 CVEsOctober 2018: 1,483 CVEsNovember 2018: no snapshotDecember 2018: 1,212 CVEs14,3619 of 12 months9/12
Critical
29216% of the 1,783 with a CVSS score
Added to CISA KEV
03 of this month's CVEs are in KEV, listed a median 1383 days after publication
Vendors
8572,803 products
Top weakness
Information ExposureCWE-200 · 188 CVEs

Who drove it

Vendors by distinct CVEs this month, with how many of those CVEs are now in CISA KEV and how far each moved in the ranking.

  1. 1npmServe, Sanitize-html, Express-cart35112nonenew
  2. 2HackeroneCoffeescript Node Module, Sanitize-html Node Module, Serve Node Module34011nonenew
  3. 3MozillaFirefox, Firefox Esr, Thunderbird3181101new
  4. 4CanonicalUbuntu, Ubuntu Linux22676nonenew
  5. 5DebianDebian Linux202911new
  6. 6Ооо «русбитех-астра»Astra Linux Special Edition, Astra Linux Common Edition, Astra Linux Special Edition Для «эльбрус»18768nonenew
  7. 7Red HatEnterprise Linux Workstation, Enterprise Linux Server, Enterprise Linux Desktop180881new
  8. 8Novell Inc.Opensuse Leap, Suse Linux Enterprise Server, Suse Linux Enterprise Desktop15461nonenew
  9. 9Сообщество Свободного Программного ОбеспеченияDebian Gnu/linux, Liblouis, Linux141651new
  10. 10Ао «ивк»Альт Линукс Спт, Альт 8 Сп Сервер, Альт 8 Сп Рабочая Станция9749nonenew
  11. 11MavenOrg.bouncycastle:bcprov-jdk14, Org.bouncycastle:bcprov-jdk15, Org.bouncycastle:bcprov-jdk15on717nonenew
  12. 12CiscoNX-OS, Prime Collaboration, Prime Collaboration Provisioning63121new
  13. 13MicrosoftWindows 10, Windows Server 2016, Windows 10 Servers5901new
  14. 14AppleiPhone OS, Mac OS X, watchOS551nonenew
  15. 15QuestDisk Backup521nonenew
  16. 16GoogleAndroid, Boringssl, Chromecast Firmware400nonenew
  17. 17Qualcomm, Inc.Android For Msm, Firefox OS For Msm, Qrd Android320nonenew
  18. 18JenkinsJenkins, GitHub, Black Duck Hub290nonenew
  19. 19IBMWebsphere Mq, Infosphere Information Server, Security Access Manager251nonenew
  20. 20PackagistBaserproject/basercms, Symfony/symfony, Symfony/security223nonenew
  21. 21[unknown]389-ds-base, Python, Ovirt-engine202nonenew
  22. 22Ао «нтц Ит Роса»Роса Кобальт, Rosa Virtualization, Rosa Virtualization 3.0197nonenew
  23. 23OracleRetail Xstore Point of Service, Enterprise Manager Base Platform, Communications Cloud Native Core Automated Test Suite174nonenew
  24. 24LinuxLinux Kernel151nonenew
  25. 25OpensuseOpen Build Service, Leap, Obs-service-set_version140nonenew

Severity

How this month's CVEs score on CVSS; 21 have no score yet. Severity is not exploitation.

  • Critical29216%
  • High92252%
  • Medium55431%
  • Low151%

New in the top 100

Not in the top 100 in any of the 24 months before.

  1. Hackerone340#2
  2. Ао «ивк»97#10
  3. Quest52#15
  4. Qualcomm, Inc.32#17
  5. Jenkins29#18
  6. [unknown]20#21
  7. Bouncycastle11#28
  8. Ca Technologies10#32
  9. Ecos10#34
  10. F5 Networks, Inc.10#36

What kind of weakness

Weakness classes (CWE) by distinct CVEs, with how far each moved in the ranking.

  1. CWE-200Information Exposure188new
  2. CWE-20Improper Input Validation168new
  3. CWE-22Path Traversal161new
  4. CWE-79XSS160new
  5. CWE-119Memory Buffer Bounds125new
  6. CWE-310106new
  7. CWE-311Missing Encryption106new
  8. CWE-416Use After Free77new
  9. CWE-78OS Command Injection72new
  10. CWE-125Out-of-bounds Read60new
  11. CWE-787Out-of-bounds Write55new
  12. CWE-50641new
  13. CWE-352CSRF35new
  14. CWE-732Incorrect Permissions31new
  15. CWE-89SQL Injection31new
  16. CWE-400Resource Consumption29new
  17. CWE-190Integer Overflow27new
  18. CWE-287Improper Authentication26new
  19. CWE-426Untrusted Search Path19new
  20. CWE-269Improper Privilege Mgmt18new

Where it landed

The month's CVEs by the sector of the software they affect. A CVE that touches several sectors counts in each.

Area is CVEs this month. Point at a sector to read it.

Which weakness, where

The top weakness classes against the vendors and the sectors that carried them.

The lighter the cell, the more CVEs. Point at one to read it.

June 2018: weakness classes by vendor and by sector: By vendor
By vendor200Information Exposure20Improper Input Validation22Path Traversal79XSS119Memory Buffer Bounds310311Missing Encryption416Use After Free78OS Command Injection125Out-of-bounds Read
npm4491291710110431
Hackerone428128159910421
Mozilla3854113542619
Debian14215233224711
Canonical Ltd.22251102924311
Ооо «русбитех-астра»21232727399
Mozilla Corp.212710312458
Red Hat151822322445
Novell Inc.1718824396
Сообщество Свободного Программного Обеспечения711312123729
Canonical151414192207
Red Hat Inc.5112212377

Snapshot v1, computed Jun 11, 2026, 06:05 UTC. MethodologyAll months on record

Nuclei coverage and the detection gap are held back while the template mirror is repaired.

We use analytics cookies to see which pages and articles actually help people. Decline and none of them run — the site works the same. What we store