July 2019
1,752 CVEs published, −21% on July 2018. CISA added 0 to KEV.
2019 month by month
| Year | Jan | Feb | Mar | Apr | May | Jun | Jul | Aug | Sep | Oct | Nov | Dec | Year total |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 2019 | January 2019: no snapshot | February 2019: 908 CVEs | March 2019: no snapshot | April 2019: no snapshot | May 2019: 1,366 CVEs | June 2019: no snapshot | July 2019: 1,752 CVEs | August 2019: 2,064 CVEs | September 2019: 1,568 CVEs | October 2019: 1,799 CVEs | November 2019: 1,802 CVEs | December 2019: 1,881 CVEs | 13,1408 of 12 months8/12 |
- Critical
- 27616% of the 1,721 with a CVSS score
- Added to CISA KEV
- 013 of this month's CVEs are in KEV, listed a median 983 days after publication
- Vendors
- 7592,258 products
- Top weakness
- XSSCWE-79 · 198 CVEs
Who drove it
Vendors by distinct CVEs this month, with how many of those CVEs are now in CISA KEV and how far each moved in the ranking.
- 1Сообщество Свободного Программного ОбеспеченияDebian Gnu/linux, U-boot, Linux189443new
- 2OracleMySQL Server, MySQL, Vm VirtualBox1779nonenew
- 3Ооо «русбитех-астра»Astra Linux Special Edition, Astra Linux Special Edition Для «эльбрус», Astra Linux Common Edition169352new
- 4Ао «концерн Вниинс»Ос Он «стрелец»103193new
- 5Red HatRed Hat Enterprise Linux, Enterprise Linux, Enterprise Linux Eus99122new
- 6DebianDebian Linux97181new
- 7OpensuseLeap, Backports Sle, Backports947nonenew
- 8CanonicalUbuntu Linux, Ubuntu9272new
- 9MicrosoftWindows Server, Windows, Windows Server 20198134new
- 10FedoraprojectFedora60121new
- 11Novell Inc.Opensuse Leap, Suse Linux Enterprise Server, Suse Linux Enterprise Desktop608nonenew
- 12QualcommSd 670 Firmware, Sd 712 Firmware, Sd 710 Firmware5012nonenew
- 13Qualcomm, Inc.Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer Iot, Snapdragon Industrial Iot, Snapdragon Iot, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables, Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer Iot, Snapdragon Industrial Iot, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wired Infrastructure and Networking, Snapdragon Auto, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer Iot, Snapdragon Industrial Iot, Snapdragon Mobile, Snapdragon Voice & Music5012nonenew
- 14IBMRobotic Process Automation With Automation Anywhere, DB2, Qradar Siem482nonenew
- 15MozillaFirefox, Thunderbird, Firefox Esr48152new
- 16MavenIo.jenkins:configuration-as-code, Com.fasterxml.jackson.core:jackson-databind, Org.jenkins-ci.plugins.m2release:m2release406nonenew
- 17CpanelCpanel381nonenew
- 18Fedora ProjectFedora3571new
- 19F5BIG-IP Application Security Manager, BIG-IP Advanced Firewall Manager, BIG-IP Policy Enforcement Manager301nonenew
- 20PackagistMediawiki/core, Moodle/moodle, Dolibarr/dolibarr303nonenew
- 21CiscoCisco Small Business 200 Series Smart Switches, SF200-24P Firmware, SF200-48 Firmware281nonenew
- 22JenkinsConfiguration As Code, Jenkins Configuration As Code Plugin, Jenkins Docker Plugin280nonenew
- 23DlinkDcs-1130 Firmware, Dcs-1100 Firmware, Central Wifi Manager2610nonenew
- 24Ао "нппкт"Осон Основа Оnyx262nonenew
- 25ImagemagickImagemagick240nonenew
Severity
How this month's CVEs score on CVSS; 31 have no score yet. Severity is not exploitation.
- Critical276
- High670
- Medium726
- Low49
New in the top 100
Not in the top 100 in any of the 24 months before.
What kind of weakness
Weakness classes (CWE) by distinct CVEs, with how far each moved in the ranking.
- CWE-79XSS198
- CWE-787Out-of-bounds Write148
- CWE-125Out-of-bounds Read67
- CWE-20Improper Input Validation65
- CWE-352CSRF59
- CWE-119Memory Buffer Bounds55
- CWE-89SQL Injection50
- CWE-200Information Exposure47
- CWE-78OS Command Injection45
- CWE-22Path Traversal38
- CWE-284Improper Access Control32
- CWE-476NULL Pointer Dereference28
- CWE-416Use After Free26
- CWE-434Unrestricted File Upload26
- CWE-190Integer Overflow25
- CWE-862Missing Authorization24
- CWE-287Improper Authentication20
- CWE-522Insufficiently Protected Credentials18
- CWE-306Missing Auth for Critical Function17
- CWE-94Code Injection17
Where it landed
The month's CVEs by the sector of the software they affect. A CVE that touches several sectors counts in each.
- Operating Systems51722% of sector-tagged CVEs
- OSS Libraries29813% of sector-tagged CVEs
- Enterprise Software25511% of sector-tagged CVEs
- Databases1968% of sector-tagged CVEs
- Security Products1516% of sector-tagged CVEs
- Web & CMS Plugins1436% of sector-tagged CVEs
- Consumer Software1396% of sector-tagged CVEs
- Networking Infrastructure1235% of sector-tagged CVEs
- DevTools & CI1055% of sector-tagged CVEs
- 6 smaller sectors293
- Not yet classified109
Which weakness, where
The top weakness classes against the vendors and the sectors that carried them.
The lighter the cell, the more CVEs. Point at one to read it.
| By vendor | 79XSS | 787Out-of-bounds Write | 125Out-of-bounds Read | 20Improper Input Validation | 352CSRF | 119Memory Buffer Bounds | 89SQL Injection | 200Information Exposure | 78OS Command Injection | 22Path Traversal |
|---|---|---|---|---|---|---|---|---|---|---|
| Сообщество Свободного Программного Обеспечения | 5 | 39 | 16 | 9 | 2 | 4 | 2 | 1 | 3 | 2 |
| Oracle | 5 | |||||||||
| Ооо «русбитех-астра» | 4 | 34 | 17 | 11 | 1 | 3 | 2 | 1 | 1 | |
| Oracle Corporation | 1 | |||||||||
| Ао «концерн Вниинс» | 5 | 17 | 9 | 6 | 2 | 1 | 1 | 2 | 1 | |
| Debian | 2 | 21 | 13 | 1 | 5 | 1 | 1 | 2 | 1 | |
| Opensuse | 1 | 21 | 10 | 1 | 2 | 1 | 2 | |||
| Microsoft Corp | 4 | 12 | 6 | 16 | 1 | |||||
| Microsoft | 4 | 12 | 6 | 16 | 1 | |||||
| Oracle Corp. | 4 | 1 | ||||||||
| Canonical Ltd. | 2 | 12 | 7 | 1 | 1 | 2 | 3 | |||
| Canonical | 17 | 5 | 2 | 3 |