October 2018
1,483 CVEs published, +23% on September 2018 and +3% on October 2017. CISA added 0 to KEV.
2018 month by month
| Year | Jan | Feb | Mar | Apr | May | Jun | Jul | Aug | Sep | Oct | Nov | Dec | Year total |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 2018 | January 2018: 1,715 CVEs | February 2018: 1,350 CVEs | March 2018: 2,306 CVEs | April 2018: no snapshot | May 2018: no snapshot | June 2018: 1,804 CVEs | July 2018: 2,225 CVEs | August 2018: 1,057 CVEs | September 2018: 1,209 CVEs | October 2018: 1,483 CVEs | November 2018: no snapshot | December 2018: 1,212 CVEs | 14,3619 of 12 months9/12 |
- Critical
- 18413% of the 1,470 with a CVSS score
- Added to CISA KEV
- 02 of this month's CVEs are in KEV, listed a median 1149.5 days after publication
- Vendors
- 4551,981 products
- Top weakness
- XSSCWE-79 · 199 CVEs
Who drove it
Vendors by distinct CVEs this month, with how many of those CVEs are now in CISA KEV and how far each moved in the ranking.
- 1OracleMySQL, MySQL Server, Peoplesoft Enterprise Peopletools19810nonenew
- 2CiscoIOS XE, Webex Meetings Online, Webex Meetings Server1319nonenew
- 3CanonicalUbuntu Linux, Ubuntu, Linux Kernel, As Used In Ubuntu 18.04 Lts and Ubuntu 18.1010415nonenew
- 4AdobeAdobe Acrobat and Reader, Acrobat Dc, Acrobat Reader Dc1024nonenew
- 5DebianDebian Linux, Crossroads10112nonenew
- 6Сообщество Свободного Программного ОбеспеченияDebian Gnu/linux, Linux, Systemd8410nonenew
- 7Red HatEnterprise Linux Server, Enterprise Linux Workstation, Enterprise Linux Desktop7812nonenew
- 8Ооо «русбитех-астра»Astra Linux Special Edition, Astra Linux Special Edition Для «эльбрус», Astra Linux Common Edition7713nonenew
- 9IBMRational Quality Manager, Security Key Lifecycle Manager, Websphere Application Server632nonenew
- 10Qualcomm, Inc.Snapdragon Mobile, Snapdragon Automobile, Snapdragon Mobile, Snapdragon Wear, Snapdragon Mobile, Snapdragon Wear620nonenew
- 11QualcommSd 845 Firmware, Sd 835 Firmware, SDA660 Firmware610nonenew
- 12MicrosoftWindows 10, Windows 10 Servers, Windows Server 20165211new
- 13Novell Inc.Opensuse Leap, Suse Linux Enterprise Software Development Kit, Suse Linux Enterprise Server448nonenew
- 14FoxitsoftwareReader, Phantompdf, Foxit Reader410nonenew
- 15NetappSnapcenter, Oncommand Workflow Automation, Oncommand Insight412nonenew
- 16MozillaFirefox, Firefox Esr, Thunderbird329nonenew
- 17Ао «ивк»Альт Линукс Спт, Альт 8 Сп Рабочая Станция, Альт 8 Сп Сервер285nonenew
- 18GoogleAndroid272nonenew
- 19Google Inc.Android251nonenew
- 20JuniperJunos, Junos Space, Netscreen Screenos211nonenew
- 21Juniper NetworksJunos OS, Junos, Junos Space211nonenew
- 22MavenIo.vertx:vertx-core, Io.spray:spray-json_2.10, Io.spray:spray-json_2.11219nonenew
- 23Ао «нтц Ит Роса»Роса Хром, Роса Кобальт, Rosa Virtualization 3.0201nonenew
- 24F5BIG-IP Access Policy Manager, BIG-IP Advanced Firewall Manager, BIG-IP Policy Enforcement Manager180nonenew
- 25F5 Networks, Inc.BIG-IP (Ltm, Aam, Afm, Analytics, Apm, Asm, Dns, Edge Gateway, Fps, Gtm, Link Controller, Pem, Webaccelerator), BIG-IP (Apm), BIG-IP Afm180nonenew
Severity
How this month's CVEs score on CVSS; 13 have no score yet. Severity is not exploitation.
- Critical184
- High623
- Medium638
- Low25
New in the top 100
Not in the top 100 in any of the 24 months before.
What kind of weakness
Weakness classes (CWE) by distinct CVEs, with how far each moved in the ranking.
- CWE-79XSS199
- CWE-787Out-of-bounds Write92
- CWE-20Improper Input Validation91
- CWE-125Out-of-bounds Read86
- CWE-119Memory Buffer Bounds70
- CWE-416Use After Free61
- CWE-200Information Exposure58
- CWE-89SQL Injection42
- CWE-22Path Traversal40
- CWE-287Improper Authentication38
- CWE-352CSRF37
- CWE-476NULL Pointer Dereference28
- CWE-190Integer Overflow26
- CWE-732Incorrect Permissions25
- CWE-78OS Command Injection24
- CWE-400Resource Consumption22
- CWE-522Insufficiently Protected Credentials20
- CWE-269Improper Privilege Mgmt15
- CWE-26414
- CWE-434Unrestricted File Upload14
Where it landed
The month's CVEs by the sector of the software they affect. A CVE that touches several sectors counts in each.
- Operating Systems32817% of sector-tagged CVEs
- Networking Infrastructure21411% of sector-tagged CVEs
- Consumer Software20811% of sector-tagged CVEs
- Databases20711% of sector-tagged CVEs
- Enterprise Software19910% of sector-tagged CVEs
- OSS Libraries1689% of sector-tagged CVEs
- Web & CMS Plugins1648% of sector-tagged CVEs
- Hardware Firmware1065% of sector-tagged CVEs
- ICS / OT / IoT915% of sector-tagged CVEs
- Not yet classified68
Which weakness, where
The top weakness classes against the vendors and the sectors that carried them.
The lighter the cell, the more CVEs. Point at one to read it.
| By vendor | 79XSS | 787Out-of-bounds Write | 20Improper Input Validation | 125Out-of-bounds Read | 119Memory Buffer Bounds | 416Use After Free | 200Information Exposure | 89SQL Injection | 22Path Traversal | 287Improper Authentication |
|---|---|---|---|---|---|---|---|---|---|---|
| Oracle | 1 | 1 | 1 | 1 | ||||||
| Oracle Corporation | 1 | |||||||||
| Oracle Corp. | 1 | 1 | 1 | |||||||
| Cisco | 12 | 4 | 38 | 1 | 2 | 5 | 1 | 4 | 2 | |
| Adobe | 5 | 32 | 42 | 3 | 8 | |||||
| Debian | 2 | 5 | 8 | 5 | 10 | 4 | 6 | 2 | 3 | |
| Canonical | 1 | 2 | 5 | 5 | 11 | 6 | 8 | 1 | ||
| Сообщество Свободного Программного Обеспечения | 1 | 4 | 7 | 3 | 6 | 5 | 6 | 2 | 2 | |
| Ооо «русбитех-астра» | 1 | 2 | 5 | 4 | 10 | 4 | 7 | 1 | 2 | |
| Cisco Systems Inc. | 4 | 2 | 24 | 2 | 4 | 1 | 4 | |||
| Red Hat | 1 | 3 | 5 | 2 | 7 | 6 | 5 | 2 | 2 | |
| IBM | 30 | 7 | 1 | 3 | 3 |