July 2018
2,225 CVEs published, +23% on June 2018 and +69% on July 2017. CISA added 0 to KEV.
2018 month by month
| Year | Jan | Feb | Mar | Apr | May | Jun | Jul | Aug | Sep | Oct | Nov | Dec | Year total |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 2018 | January 2018: 1,715 CVEs | February 2018: 1,350 CVEs | March 2018: 2,306 CVEs | April 2018: no snapshot | May 2018: no snapshot | June 2018: 1,804 CVEs | July 2018: 2,225 CVEs | August 2018: 1,057 CVEs | September 2018: 1,209 CVEs | October 2018: 1,483 CVEs | November 2018: no snapshot | December 2018: 1,212 CVEs | 14,3619 of 12 months9/12 |
- Critical
- 25812% of the 2,167 with a CVSS score
- Added to CISA KEV
- 05 of this month's CVEs are in KEV, listed a median 1414 days after publication
- Vendors
- 9902,667 products
- Top weakness
- Integer OverflowCWE-190 · 478 CVEs
Who drove it
Vendors by distinct CVEs this month, with how many of those CVEs are now in CISA KEV and how far each moved in the ranking.
- 1OracleMySQL Server, MySQL, Outside In Technology2198nonenew
- 2AdobeAcrobat Dc, Acrobat Reader Dc, Adobe Acrobat 2017168402new
- 3Red HatEnterprise Linux Workstation, Enterprise Linux Desktop, Enterprise Linux Server14071new
- 4DebianDebian Linux, Devscripts127211new
- 5IBMRational Quality Manager, Rational Collaborative Lifecycle Management, Rational Rhapsody Design Manager951nonenew
- 6CanonicalUbuntu Linux, Ubuntu9318nonenew
- 7FoxitsoftwareFoxit Reader, Phantompdf, Foxit Phantompdf841nonenew
- 8Сообщество Свободного Программного ОбеспеченияDebian Gnu/linux, Linux, Libgit282181new
- 9Ооо «русбитех-астра»Astra Linux Special Edition, Astra Linux Common Edition, Astra Linux Special Edition Для «эльбрус»6521nonenew
- 10Qualcomm, Inc.Android For Msm, Firefox OS For Msm, Qrd Android, Snapdragon Automobile, Snapdragon Mobile, Snapdragon Wear, Snapdragon Mobile, Snapdragon Wear596nonenew
- 11MicrosoftEdge, Microsoft Edge, Chakracore5631new
- 12MavenOrg.jenkins-ci.main:jenkins-core, Io.undertow:undertow-core, Org.keycloak:keycloak-core554nonenew
- 13[unknown]Kernel, Ansible, Kernel:542nonenew
- 14GoogleAndroid, Android Studio464nonenew
- 15LinuxLinux Kernel, Kernel, Kernel:430nonenew
- 16CiscoVedge-100 Firmware, Vbond Orchestrator, Vedge-1000 Firmware378nonenew
- 17NetappOncommand Insight, Oncommand Workflow Automation, Snapcenter372nonenew
- 18npmBootstrap, Angular-redactor, Bootstrap-sass3110nonenew
- 19Schneider-electricU.motion Builder, IBP519-1ER Firmware, IBPS110-1ER Firmware254nonenew
- 20Schneider Electric SeU.motion, U.motion Builder, Pelco Sarix Professional V1244nonenew
- 21ApacheHTTP Server, Kafka, Spark215nonenew
- 22Apache Software FoundationApache Kafka, Apache Tomcat Native, HTTP Server215nonenew
- 23NugetMicrosoft.chakracore, Bootstrap.sass, Bootstrap2101new
- 24PyPIAnsible, Mercurial, Aubio203nonenew
- 25PackagistDolibarr/dolibarr, Twbs/bootstrap, Moodle/moodle1971new
Severity
How this month's CVEs score on CVSS; 58 have no score yet. Severity is not exploitation.
- Critical258
- High1,207
- Medium664
- Low38
New in the top 100
Not in the top 100 in any of the 24 months before.
What kind of weakness
Weakness classes (CWE) by distinct CVEs, with how far each moved in the ranking.
- CWE-190Integer Overflow478
- CWE-79XSS173
- CWE-125Out-of-bounds Read163
- CWE-787Out-of-bounds Write117
- CWE-20Improper Input Validation112
- CWE-200Information Exposure84
- CWE-119Memory Buffer Bounds76
- CWE-416Use After Free76
- CWE-70455
- CWE-843Type Confusion48
- CWE-22Path Traversal44
- CWE-89SQL Injection37
- CWE-352CSRF34
- CWE-476NULL Pointer Dereference34
- CWE-287Improper Authentication29
- CWE-732Incorrect Permissions22
- CWE-295Improper Certificate Validation19
- CWE-78OS Command Injection19
- CWE-306Missing Auth for Critical Function18
- CWE-400Resource Consumption16
Where it landed
The month's CVEs by the sector of the software they affect. A CVE that touches several sectors counts in each.
- Operating Systems41116% of sector-tagged CVEs
- OSS Libraries34513% of sector-tagged CVEs
- Consumer Software30412% of sector-tagged CVEs
- Databases2469% of sector-tagged CVEs
- Enterprise Software2459% of sector-tagged CVEs
- Web & CMS Plugins1225% of sector-tagged CVEs
- Networking Infrastructure1134% of sector-tagged CVEs
- 8 smaller sectors490
- Not yet classified337
Which weakness, where
The top weakness classes against the vendors and the sectors that carried them.
The lighter the cell, the more CVEs. Point at one to read it.
| By vendor | 190Integer Overflow | 79XSS | 125Out-of-bounds Read | 787Out-of-bounds Write | 20Improper Input Validation | 200Information Exposure | 119Memory Buffer Bounds | 416Use After Free | 704 | 843Type Confusion |
|---|---|---|---|---|---|---|---|---|---|---|
| Oracle | 1 | 2 | ||||||||
| Oracle Corporation | ||||||||||
| Adobe | 1 | 76 | 38 | 2 | 5 | 27 | 7 | |||
| Red Hat | 3 | 6 | 9 | 13 | 22 | 6 | 7 | 1 | 2 | |
| Debian | 9 | 2 | 15 | 16 | 13 | 7 | 5 | 5 | ||
| IBM | 54 | 1 | 20 | |||||||
| Foxitsoftware | 1 | 4 | 1 | 2 | 3 | 1 | 29 | 46 | 45 | |
| Canonical | 5 | 1 | 7 | 15 | 5 | 2 | 3 | 3 | ||
| Foxit | 1 | 4 | 1 | 2 | 3 | 1 | 27 | 46 | 45 | |
| Сообщество Свободного Программного Обеспечения | 6 | 10 | 14 | 8 | 3 | 7 | ||||
| Oracle Corp. | ||||||||||
| Ооо «русбитех-астра» | 3 | 1 | 8 | 6 | 9 | 3 | 3 | 4 |