Month report
December 2017
Rolled up 2026-08-09 20:45 from 370,700 CVE records
1,105 CVEs published, +113.7% on the same month last year. 2 rated critical, 0 listed by CISA as exploited. ibm led with 49; the most common weakness class was CWE-416 (16). synology climbed 41 places, the largest move. 21 vendors ranked for the first time.
Published
1,105
Critical / high
2 / 15
Medium / low
2 / 0
Added to CISA KEV
0
Public exploit
181
Scanner template
0
Publication to KEV
How long before CISA listed them
Median days to listing
1585
Listed within 7 days
0%
Listed within 30 days
0%
Weakness × vendor
Where the two overlap
| Vendor | CWE-416 | CWE-843 | CWE-125 | CWE-79 | CWE-119 | CWE-20 | CWE-200 | CWE-22 |
|---|---|---|---|---|---|---|---|---|
| ibm | ||||||||
| foxit | 16 | 14 | 13 | |||||
| qualcomm | ||||||||
| microsoft | ||||||||
| huawei technologies co | ||||||||
| f5 networks | ||||||||
| sap |
Vendors
Ranked by distinct CVEs this month
| # | Vendor | Top products | ||||||
|---|---|---|---|---|---|---|---|---|
| 1 | ibm | 49 | 1 | security guardium (11) · sterling file gateway (6) · atlas ediscovery process management (4) | ↑4 | |||
| 2 | foxit | 43 | foxit reader (43) | · | ||||
| 3 | qualcomm | 43 | android for msm firefox os for msm qrd android (43) | — | ||||
| 4 | 38 | 1 | android (38) | — | ||||
| 5 | microsoft | 34 | 10 | chakracore microsoft edge (9) · internet explorer (8) · chakracore microsoft edge internet explorer (3) | ↓3 | |||
| 6 | huawei technologies co | 16 | ireader (3) · rp200 (3) · te30 (3) | ↓5 | ||||
| 7 | f5 networks | 14 | big ip ltm aam afm analytics apm asm dns gtm link controller pem websafe (5) · big ip apm (3) · big ip ltm aam afm analytics apm asm dns edge gateway gtm link controller pem webaccelerator websafe (2) | ↑25 | ||||
| 8 | sap | 12 | sap business intelligence promotion management application (2) · sap hana extended application services (2) · sap business objects platform (1) | new | ||||
| 9 | synology | 12 | 1 | photo station (3) · chat (2) · diskstation manager dsm (2) | ↑41 | |||
| 10 | cambium networks | 10 | 6 | cnpilot (5) · epmp (5) | new | |||
| 11 | apache | 8 | 1 | apache qpid broker j (2) · apache drill (1) · apache fineract (1) | ↓4 | |||
| 12 | qnap | 8 | qts login function (2) · qts password function (2) · qsync for windows exe (1) | ↑35 | ||||
| 13 | princeton | 6 | ptw wms1 (4) · a member (1) · a member for mt cloud (1) | new | ||||
| 14 | vmware | 6 | esxi (3) · fusion (2) · workstation (2) | ↓6 | ||||
| 15 | atlassian | 4 | bamboo (2) · auto unapprove plugin for bitbucket server (1) · confluence (1) | ↑2 | ||||
| 16 | kazuho oku | 4 | h2o (4) | · | ||||
| 17 | trend micro | 4 | trend micro scanmail for exchange (3) · trend micro encryption for email (1) | · | ||||
| 18 | acti | 3 | acti d b i and e series cameras (3) | new | ||||
| 19 | bitdefender | 3 | bitdefender internet security (3) | · | ||||
| 20 | d link | 3 | dir 130 (2) · dir 330 (2) · dir 850l and potentially others (1) | new | ||||
| 21 | elastic | 3 | kibana (2) · packetbeat (1) | · | ||||
| 22 | fortinet | 3 | forticlient for mac osx (1) · forticlient for windows (1) · forticlient sslvpn client for linux (1) | ↓6 | ||||
| 23 | micro focus | 3 | project and portfolio management center (2) · operations manager i (1) | ↑3 | ||||
| 24 | nvidia | 3 | android (3) | ↓3 | ||||
| 25 | sony video sound products | 3 | music center for pc (2) · media go (1) | new | ||||
| 26 | symantec | 3 | norton family android app (2) · messaging gateway (1) | ↓14 | ||||
| 27 | buffalo | 2 | bbr 4hg (2) · bbr 4mg (2) | · | ||||
| 28 | debian | 2 | debian linux (1) · nip2 (1) · tin (1) | · | ||||
| 29 | heketi | 2 | heketi (2) | new | ||||
| 30 | openssl software foundation | 2 | openssl (2) | ↑15 | ||||
| 31 | siemens | 2 | development evaluation kits for profinet io dk standard ethernet controller (1) · development evaluation kits for profinet io ek ertec 200 (1) · development evaluation kits for profinet io ek ertec 200p (1) | · | ||||
| 32 | the node js project | 2 | node js (2) | new | ||||
| 33 | the qt | 2 | qt for android (2) | new | ||||
| 34 | tibco software | 2 | tibbr community (2) · tibbr enterprise (2) | ↓7 | ||||
| 35 | tomoki sanaki | 2 | sdnsproxy exe (1) · streamrelay net exe (1) | new | ||||
| 36 | acdsee | 1 | acdsee ultimate (1) | new | ||||
| 37 | cloud native computing foundation cncf | 1 | fluentd (1) | new | ||||
| 38 | commvault | 1 | 1 | service pack 6 (1) | new | |||
| 39 | dozer project | 1 | 1 | dozer (1) | new | |||
| 40 | flash seats | 1 | flash seats mobile app (1) | new | ||||
| 41 | intel | 1 | 1 | intel graphics driver (1) | ↓32 | |||
| 42 | japan agency for local authority information systems | 1 | the public certification service for individuals the jpki user s software (1) | · | ||||
| 43 | kaspersky labs | 1 | kaspersky embedded systems security (1) | new | ||||
| 44 | legion of the bouncy castle | 1 | 1 | bouncycastle tls (1) | new | |||
| 45 | linksys | 1 | 1 | linksys wvbr0 (1) | new | |||
| 46 | mqtt js | 1 | mqtt js (1) | new | ||||
| 47 | netapp | 1 | vasa provider for clustered data ontap (1) | ↓27 | ||||
| 48 | nip2 project | 1 | debian linux (1) · nip2 (1) | new | ||||
| 49 | nippon telegraph and telephone east | 1 | pwr q200 (1) | · | ||||
| 50 | openstack | 1 | openstack tripleo heat templates (1) | new |
One CVE is counted once per vendor, product or weakness class it lists, so a ranking column sums to more than the month's total. Only the month's top 100 keys per dimension are stored. The KEV column counts CVEs published in 2017-12 that are on the CISA KEV catalog today. The 0 in the headline is what CISA listed during the month, whenever those CVEs were published. All 50 ranked vendors are listed; a zero count renders as a dot.
Weaknesses
CWE classes by distinct CVEs
- 1CWE-416160 critical·
- 2CWE-843140 critical·
- 3CWE-125130 critical↑19
- 4CWE-7980 critical↓3
- 5CWE-11931 critical↓1
- 6CWE-2031 critical↓4
- 7CWE-20030 critical↓4
- 8CWE-2230 critical↑2
- 9CWE-28430 critical↑2
- 10CWE-7830 critical↑28
- 1CWE-12120 critical↑4
- 2CWE-19020 critical↑13
- 3CWE-20320 critical·
- 4CWE-29520 critical·
- 5CWE-35220 critical·
- 6CWE-47220 criticalnew
- 7CWE-55220 critical↑18
- 8CWE-7420 critical↑19
- 9CWE-118810 criticalnew
- 10CWE-12210 critical·
One CVE is counted once per vendor, product or weakness class it lists, so a ranking column sums to more than the month's total. Only the month's top 100 keys per dimension are stored.