Month report
May 2017
Rolled up 2026-08-09 20:45 from 370,700 CVE records
1,010 CVEs published, +65% on the same month last year. 6 rated critical, 0 listed by CISA as exploited. google led with 70; the most common weakness class was CWE-200 (9). qualcomm climbed 40 places, the largest move. 29 vendors ranked for the first time.
Published
1,010
-35.6%on the previous month
Critical / high
6 / 22
of the 34 scored
Medium / low
6 / 0
the rest of the scored bands
Added to CISA KEV
0
listed as exploited this month
Public exploit
105
exploit code indexed publicly
Scanner template
0
0% of the month
Publication to KEV
How long before CISA listed them
10 published this month and listed since — not the 0 listed during it.
Median days to listing
1753
from publication to CISA's date added
Listed within 7 days
0%
of the 10
Listed within 30 days
0%
of the 10
Weakness × vendor
Where the two overlap
CVEs carrying both. Each row is shaded against its own worst class.
| Vendor | CWE-200 | CWE-399 | CWE-264 | CWE-22 | CWE-79 | CWE-20 | CWE-285 | CWE-400 |
|---|---|---|---|---|---|---|---|---|
| microsoft | ||||||||
| ibm | ||||||||
| qualcomm | ||||||||
| nvidia | ||||||||
| pivotal | ||||||||
| basercms users community | ||||||||
| juniper networks |
Vendors
Ranked by distinct CVEs this month
Δ is the move against last month's rank.
| # | Vendor | Top products | ||||||
|---|---|---|---|---|---|---|---|---|
| 1 | 70 | 1 | android (70) | ↑1 | ||||
| 2 | microsoft | 69 | 6 | 17 | microsoft edge (12) · microsoft windows (11) · malware protection engine (7) | ↑1 | ||
| 3 | ibm | 26 | 1 | rational collaborative lifecycle management (4) · maximo asset management (3) · interact (2) | ↑1 | |||
| 4 | qualcomm | 23 | all qualcomm products (20) · android for msm firefox os for msm qrd android (3) | ↑40 | ||||
| 5 | nvidia | 15 | gpu display driver (15) | ↑4 | ||||
| 6 | pivotal | 15 | 1 | cloud foundry (10) · spring security (3) · spring framework (2) | new | |||
| 7 | basercms users community | 12 | basercms (4) · basercms plugin blog (3) · basercms plugin mail (3) | new | ||||
| 8 | juniper networks | 12 | junos space (7) · junos os on srx series services gateways chassis cluster (1) · junos os running on qfx3500 qfx3600 qfx5100 qfx5200 ex4300 ex4600 devices (1) | ↓3 | ||||
| 9 | apache | 10 | apache ambari (2) · apache cxf fediz (2) · apache archiva (1) | ↓3 | ||||
| 10 | f5 networks | 10 | big ip (4) · big ip apm (2) · big ip azure cloud instance (1) | ↑4 | ||||
| 11 | fortinet | 9 | fortinet fortiportal (5) · fortinet fortianalyzer fortimanager (1) · fortinet fortios (1) | ↑19 | ||||
| 12 | mcafee | 8 | network data loss prevention ndlp (7) · epolicy orchestrator epo (1) | ↑27 | ||||
| 13 | antenna house | 6 | 1 | dmc htmlfilter (6) | new | |||
| 14 | nextcloud | 6 | nextcloud server (6) | ↓3 | ||||
| 15 | openssl | 6 | 2 | openssl (6) | new | |||
| 16 | siemens | 6 | cadra (3) · development evaluation kits for profinet io dk standard ethernet controller (2) · development evaluation kits for profinet io ek ertec 200 (2) | · | ||||
| 17 | vmware | 5 | 2 | workstation pro player (2) · airwatch agent (1) · airwatch console (1) | new | |||
| 18 | libraw | 4 | libraw (2) · libraw demosaic pack gpl2 (2) | new | ||||
| 19 | redhat | 4 | 1 | cairo (1) · jboss (1) · jboss enterprise application platform (1) | · | |||
| 20 | splunk | 4 | splunk enterprise (4) · splunk light (4) | new | ||||
| 21 | symantec | 4 | asg (2) · proxysg (2) · content analysis ca (1) | ↑3 | ||||
| 22 | videolan | 4 | 1 | vlc (4) | new | |||
| 23 | information technology promotion agency japan ipa | 3 | empirical project monitor extended (3) | ↓11 | ||||
| 24 | olive design | 3 | wp olivecart (3) · wp olivecartpro (3) | ↓9 | ||||
| 25 | synology | 3 | synology photo station (3) | new | ||||
| 26 | the postgresql global development group | 3 | postgresql (3) | new | ||||
| 27 | toshiba | 3 | flashairtm sdhc memory card sd wd wc series w 02 (2) · flashairtm sdhc memory card sd we series w 03 (2) · flashair class 6 model (1) | ↑22 | ||||
| 28 | brocade communications systems | 2 | fibre channel san products running brocade fabric os fos (1) · netiron xmr mlx and brocade ces cer on netiron (1) | new | ||||
| 29 | flexera software | 2 | flexnet manager suite (1) · gnutls libtasn1 (1) | new | ||||
| 30 | intel | 2 | 1 | 1 | 1 | intel active mangement technology intel small business technology intel standard manageability (1) · solid state drive toolbox (1) | ↓17 | |
| 31 | money foward | 2 | money forward (2) · money forward for apppass (2) · money forward for au smartpass (2) | new | ||||
| 32 | nippon institute of agroinformatics | 2 | soy cms (1) · soy cms with installer (1) | new | ||||
| 33 | openvpn technologies | 2 | 1 | openvpn (2) | new | |||
| 34 | power software | 2 | poweriso (2) | new | ||||
| 35 | rapid7 | 2 | appspider pro (2) | · | ||||
| 36 | sourcenext | 2 | money forward (2) · money forward for apppass (2) · money forward for au smartpass (2) | new | ||||
| 37 | adodb | 1 | adodb (1) | new | ||||
| 38 | authconfig | 1 | authconfig (1) | new | ||||
| 39 | bestwebsoft | 1 | captcha (1) · car rental (1) · contact form (1) | new | ||||
| 40 | bitcoin | 1 | bitcoin (1) | new | ||||
| 41 | blackberry | 1 | bes12 (1) · unified endpoint manager (1) | new | ||||
| 42 | brave | 1 | brave (1) | new | ||||
| 43 | cmsmadesimple | 1 | 1 | cms made simple (1) | new | |||
| 44 | evernote | 1 | evernote for windows (1) | new | ||||
| 45 | foreman | 1 | foreman (1) | new | ||||
| 46 | hancom | 1 | hangul word processor in thinkfree office neo trial word (1) | · | ||||
| 47 | igor pavlov | 1 | 7 zip for windows (1) | new | ||||
| 48 | japan agency for local authority information systems | 1 | installer for the public certification service for individuals the jpki user s software (1) · installer for the public certification service for individuals the jpki user s software for windows 7 and later (1) · installer for the public certification service for individuals the jpki user s software for windows vista (1) | new | ||||
| 49 | kazuho oku | 1 | h2o (1) | new | ||||
| 50 | libtiff | 1 | libtiff (1) | · |
One CVE is counted once per vendor, product or weakness class it lists, so a ranking column sums to more than the month's total. Only the month's top 100 keys per dimension are stored. The KEV column counts CVEs published in 2017-05 that are on the CISA KEV catalog today. The 0 in the headline is what CISA listed during the month, whenever those CVEs were published. All 50 ranked vendors are listed; a zero count renders as a dot.
Weaknesses
CWE classes by distinct CVEs
- 1CWE-20090 critical↑3
- 2CWE-39970 critical↓1
- 3CWE-26460 critical↑13
- 4CWE-2250 critical·
- 5CWE-7950 critical↑5
- 6CWE-2040 critical↓3
- 7CWE-28540 critical·
- 8CWE-40040 critical↑11
- 9CWE-11930 critical↓7
- 10CWE-12531 critical↑3
- 1CWE-78730 critical·
- 2CWE-12120 critical↓1
- 3CWE-26020 critical·
- 4CWE-28721 critical↓8
- 5CWE-35220 critical·
- 6CWE-41620 critical·
- 7CWE-42720 critical↑3
- 8CWE-47620 critical·
- 9CWE-61720 criticalnew
- 10CWE-7720 critical↑5
One CVE is counted once per vendor, product or weakness class it lists, so a ranking column sums to more than the month's total. Only the month's top 100 keys per dimension are stored.