September 2018
1,209 CVEs published, +14% on August 2018 and −2% on September 2017. CISA added 0 to KEV.
2018 month by month
| Year | Jan | Feb | Mar | Apr | May | Jun | Jul | Aug | Sep | Oct | Nov | Dec | Year total |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 2018 | January 2018: 1,715 CVEs | February 2018: 1,350 CVEs | March 2018: 2,306 CVEs | April 2018: no snapshot | May 2018: no snapshot | June 2018: 1,804 CVEs | July 2018: 2,225 CVEs | August 2018: 1,057 CVEs | September 2018: 1,209 CVEs | October 2018: 1,483 CVEs | November 2018: no snapshot | December 2018: 1,212 CVEs | 14,3619 of 12 months9/12 |
- Critical
- 16614% of the 1,172 with a CVSS score
- Added to CISA KEV
- 03 of this month's CVEs are in KEV, listed a median 1292 days after publication
- Vendors
- 5321,509 products
- Top weakness
- XSSCWE-79 · 169 CVEs
Who drove it
Vendors by distinct CVEs this month, with how many of those CVEs are now in CISA KEV and how far each moved in the ranking.
- 1DebianDebian Linux1026nonenew
- 2Red HatEnterprise Linux Server, Enterprise Linux Workstation, Enterprise Linux Desktop9211new
- 3GoogleAndroid, Chrome, Google Chrome840nonenew
- 4CanonicalUbuntu Linux, Ubuntu6661new
- 5MicrosoftWindows 10, Windows Server 2016, Windows 10 Servers6511new
- 6Qualcomm, Inc.Android For Msm, Firefox OS For Msm, Qrd Android, Snapdragon Automobile, Snapdragon Mobile, Snapdragon Wear, Snapdragon Automobile, Snapdragon Mobile652nonenew
- 7Сообщество Свободного Программного ОбеспеченияDebian Gnu/linux, Linux, Open Vswitch656nonenew
- 8Ооо «русбитех-астра»Astra Linux Special Edition, Astra Linux Common Edition, Astra Linux Special Edition Для «эльбрус»525nonenew
- 9IBMRational Engineering Lifecycle Manager, Websphere Portal, Websphere Application Server401nonenew
- 10SamsungSth-eth-250 Firmware, Smartthings Hub Sth-eth-250, Galaxy Apps234nonenew
- 11IntelConverged Security Management Engine Firmware, Intel Converged Security and Manageability Engine, Active Management Technology Firmware212nonenew
- 12MavenOrg.apache.tika:tika-core, Org.elasticsearch:elasticsearch, Org.apache.karaf:apache-karaf211nonenew
- 13Novell Inc.Opensuse Leap, Suse Linux Enterprise Module For Basesystem, Suse Linux Enterprise Server191nonenew
- 14AdobeColdfusion, Acrobat Dc, Acrobat Reader Dc1861new
- 15PackagistElefant/cms, Smarty/smarty, Gleez/cms185nonenew
- 16OpensuseLeap172nonenew
- 17Ао «концерн Вниинс»Ос Он «стрелец»173nonenew
- 18QualcommSD450 Firmware, SD430 Firmware, SD425 Firmware162nonenew
- 19RubygemsActionpack, Rails-html-sanitizer, Smart_proxy_dynflow161nonenew
- 20TP-LinkTl-wr886n Firmware, Eap Controller161nonenew
- 21ApacheTika, Spamassassin, Mesos141nonenew
- 22ArtifexGhostscript, Gpl Ghostscript, Mupdf140nonenew
- 23NugetMicrosoft.chakracore, Microsoft.aspnetcore.all, Microsoft.data.odata141nonenew
- 24Apache Software FoundationApache Tika, Apache Spamassassin, Apache Karaf131nonenew
- 25ImagemagickImagemagick132nonenew
Severity
How this month's CVEs score on CVSS; 37 have no score yet. Severity is not exploitation.
- Critical166
- High493
- Medium504
- Low9
New in the top 100
Not in the top 100 in any of the 24 months before.
What kind of weakness
Weakness classes (CWE) by distinct CVEs, with how far each moved in the ranking.
- CWE-79XSS169
- CWE-20Improper Input Validation84
- CWE-200Information Exposure75
- CWE-119Memory Buffer Bounds71
- CWE-787Out-of-bounds Write64
- CWE-89SQL Injection51
- CWE-125Out-of-bounds Read50
- CWE-352CSRF44
- CWE-22Path Traversal41
- CWE-78OS Command Injection27
- CWE-732Incorrect Permissions25
- CWE-476NULL Pointer Dereference23
- CWE-94Code Injection21
- CWE-190Integer Overflow20
- CWE-287Improper Authentication20
- CWE-416Use After Free20
- CWE-400Resource Consumption18
- CWE-434Unrestricted File Upload16
- CWE-120Buffer Overflow15
- CWE-611XXE13
Where it landed
The month's CVEs by the sector of the software they affect. A CVE that touches several sectors counts in each.
- Operating Systems34522% of sector-tagged CVEs
- OSS Libraries21613% of sector-tagged CVEs
- Web & CMS Plugins17411% of sector-tagged CVEs
- Enterprise Software15610% of sector-tagged CVEs
- Mobile Apps1218% of sector-tagged CVEs
- Hardware Firmware1077% of sector-tagged CVEs
- Networking Infrastructure775% of sector-tagged CVEs
- ICS / OT / IoT714% of sector-tagged CVEs
- Consumer Software654% of sector-tagged CVEs
- 6 smaller sectors186
- Not yet classified84
Which weakness, where
The top weakness classes against the vendors and the sectors that carried them.
The lighter the cell, the more CVEs. Point at one to read it.
| By vendor | 79XSS | 20Improper Input Validation | 200Information Exposure | 119Memory Buffer Bounds | 787Out-of-bounds Write | 89SQL Injection | 125Out-of-bounds Read | 352CSRF | 22Path Traversal | 78OS Command Injection |
|---|---|---|---|---|---|---|---|---|---|---|
| Debian | 2 | 24 | 11 | 4 | 10 | 5 | 3 | 1 | ||
| 1 | 17 | 6 | 17 | 6 | 9 | |||||
| Red Hat | 3 | 23 | 13 | 1 | 5 | 4 | 2 | |||
| Microsoft | 4 | 9 | 15 | 1 | 11 | |||||
| Qualcomm, Inc. | 5 | 1 | 13 | 7 | 8 | |||||
| Сообщество Свободного Программного Обеспечения | 1 | 5 | 1 | 6 | 6 | 10 | 1 | 1 | ||
| Microsoft Corp | 4 | 8 | 15 | 1 | 11 | |||||
| Canonical | 4 | 3 | 5 | 6 | 5 | 1 | ||||
| Ооо «русбитех-астра» | 1 | 3 | 1 | 4 | 4 | 8 | ||||
| IBM | 7 | 2 | 4 | 1 | 2 | |||||
| Canonical Ltd. | 2 | 1 | 3 | 3 | 7 | 2 | ||||
| Red Hat | 1 | 7 | 6 | 2 | 2 |