May 2019
1,366 CVEs published. CISA added 0 to KEV.
2019 month by month
| Year | Jan | Feb | Mar | Apr | May | Jun | Jul | Aug | Sep | Oct | Nov | Dec | Year total |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 2019 | January 2019: no snapshot | February 2019: 908 CVEs | March 2019: no snapshot | April 2019: no snapshot | May 2019: 1,366 CVEs | June 2019: no snapshot | July 2019: 1,752 CVEs | August 2019: 2,064 CVEs | September 2019: 1,568 CVEs | October 2019: 1,799 CVEs | November 2019: 1,802 CVEs | December 2019: 1,881 CVEs | 13,1408 of 12 months8/12 |
- Critical
- 26019% of the 1,340 with a CVSS score
- Added to CISA KEV
- 014 of this month's CVEs are in KEV, listed a median 1045 days after publication
- Vendors
- 4802,508 products
- Top weakness
- XSSCWE-79 · 181 CVEs
Who drove it
Vendors by distinct CVEs this month, with how many of those CVEs are now in CISA KEV and how far each moved in the ranking.
- 1AdobeAcrobat Dc, Adobe Acrobat and Reader, Acrobat Reader Dc20778nonenew
- 2CiscoNX-OS, Cisco NX-OS Software, Firepower Threat Defense982nonenew
- 3MicrosoftWindows Server, Windows Server 2016, Windows8033new
- 4Сообщество Свободного Программного ОбеспеченияDebian Gnu/linux, Linux, Freeimages6510nonenew
- 5Ооо «русбитех-астра»Astra Linux Special Edition, Astra Linux Special Edition Для «эльбрус», Astra Linux Common Edition487nonenew
- 6Schneider ElectricModicon Quantum, Modicon Quantum Safety Controller, Plc Simulator4281new
- 7Novell Inc.Opensuse Leap, Suse Linux Enterprise Module For Open Buildservice Development Tools, Suse Openstack Cloud414nonenew
- 8QualcommMDM9206 Firmware, MDM9607 Firmware, MDM9650 Firmware4112nonenew
- 9Schneider-electricModicon Quantum Firmware, Modicon Premium Firmware, Modicon M580 Firmware4181new
- 10OpensuseLeap, Backports, Backports Sle384nonenew
- 11IntelIntel Celeron J Series, Intel Celeron N Series, Intel Converged Security and Manageability Engine3531new
- 12MavenOrg.jenkins-ci.plugins:artifactory, Org.apache.jspwiki:jspwiki-main, Org.apache.jspwiki:jspwiki-war342nonenew
- 13Qualcomm, Inc.Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer Iot, Snapdragon Industrial Iot, Snapdragon Mobile, Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Iot, Snapdragon Industrial Iot, Snapdragon Iot, Snapdragon Mobile, Snapdragon Wearables, Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer Iot, Snapdragon Industrial Iot, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables3112nonenew
- 14GoogleChrome, Google Chrome, Android303nonenew
- 15IBMSpectrum Control, Spectrum Control Standard Edition, API Connect301nonenew
- 16CanonicalUbuntu, Ubuntu Linux295nonenew
- 17DebianDebian Linux285nonenew
- 18Red HatRed Hat Enterprise Linux, Enterprise Linux, Red Hat Virtualization275nonenew
- 19Fedora ProjectFedora264nonenew
- 20FedoraprojectFedora264nonenew
- 21GitLabGitLab265nonenew
- 22npmRemarkable, Harp, Webpack-bundle-analyzer260nonenew
- 23SiemensSimatic Wincc \(Tia Portal\), Simatic Wincc Runtime Professional, Simatic Wincc (Tia Portal)2351new
- 24CybozuGaroon201nonenew
- 25Cybozu, Inc.Cybozu Garoon201nonenew
Severity
How this month's CVEs score on CVSS; 26 have no score yet. Severity is not exploitation.
- Critical260
- High560
- Medium511
- Low9
New in the top 100
Not in the top 100 in any of the 24 months before.
What kind of weakness
Weakness classes (CWE) by distinct CVEs, with how far each moved in the ranking.
- CWE-79XSS181
- CWE-125Out-of-bounds Read120
- CWE-787Out-of-bounds Write105
- CWE-416Use After Free81
- CWE-20Improper Input Validation57
- CWE-22Path Traversal50
- CWE-200Information Exposure45
- CWE-89SQL Injection40
- CWE-78OS Command Injection37
- CWE-119Memory Buffer Bounds34
- CWE-352CSRF28
- CWE-476NULL Pointer Dereference24
- CWE-732Incorrect Permissions22
- CWE-190Integer Overflow19
- CWE-284Improper Access Control19
- CWE-400Resource Consumption19
- CWE-502Deserialization18
- CWE-798Hard-coded Credentials18
- CWE-287Improper Authentication16
- CWE-434Unrestricted File Upload16
Where it landed
The month's CVEs by the sector of the software they affect. A CVE that touches several sectors counts in each.
- Consumer Software23614% of sector-tagged CVEs
- Operating Systems22514% of sector-tagged CVEs
- Enterprise Software17811% of sector-tagged CVEs
- OSS Libraries17711% of sector-tagged CVEs
- Networking Infrastructure15710% of sector-tagged CVEs
- Hardware Firmware1318% of sector-tagged CVEs
- ICS / OT / IoT1157% of sector-tagged CVEs
- Web & CMS Plugins936% of sector-tagged CVEs
- Security Products835% of sector-tagged CVEs
- Not yet classified59
Which weakness, where
The top weakness classes against the vendors and the sectors that carried them.
The lighter the cell, the more CVEs. Point at one to read it.
| By vendor | 79XSS | 125Out-of-bounds Read | 787Out-of-bounds Write | 416Use After Free | 20Improper Input Validation | 22Path Traversal | 200Information Exposure | 89SQL Injection | 78OS Command Injection | 119Memory Buffer Bounds |
|---|---|---|---|---|---|---|---|---|---|---|
| Adobe | 2 | 80 | 36 | 61 | 2 | 8 | ||||
| Adobe Systems Inc. | 2 | 48 | 31 | 56 | 2 | 6 | ||||
| Cisco | 5 | 1 | 18 | 6 | 3 | 2 | 13 | 5 | ||
| Cisco Systems Inc. | 5 | 1 | 17 | 6 | 2 | 2 | 11 | 5 | ||
| Microsoft | 7 | 21 | 1 | 3 | 1 | |||||
| Microsoft Corp | 7 | 21 | 3 | |||||||
| Сообщество Свободного Программного Обеспечения | 3 | 7 | 7 | 7 | 6 | 2 | 3 | 3 | ||
| Ооо «русбитех-астра» | 2 | 5 | 5 | 4 | 5 | 3 | 2 | 1 | ||
| Schneider Electric | 2 | 2 | 3 | 1 | 1 | |||||
| Novell Inc. | 5 | 5 | 4 | 3 | 3 | |||||
| Qualcomm | 2 | 6 | 1 | 3 | 6 | |||||
| Schneider-electric | 2 | 2 | 2 | 1 | 1 |