Month report
May 2018
Rolled up 2026-08-09 20:45 from 370,778 CVE records
1,162 CVEs published, +15% on the same month last year. 15 rated critical, 0 listed by CISA as exploited. hackerone led with 100; the most common weakness class was CWE-311 (43). pivotal climbed 73 places, the largest move. 10 vendors ranked for the first time.
Published
1,162
-30.3%on the previous month
Critical / high
15 / 36
of the 117 scored
Medium / low
58 / 8
the rest of the scored bands
Added to CISA KEV
0
listed as exploited this month
Public exploit
105
exploit code indexed publicly
Scanner template
0
0% of the month
Publication to KEV
How long before CISA listed them
7 published this month and listed since — not the 0 listed during it.
Median days to listing
1406
from publication to CISA's date added
Listed within 7 days
0%
of the 7
Listed within 30 days
0%
of the 7
Vendors
Ranked by distinct CVEs this month
Δ is the move against last month's rank.
| # | Vendor | Top products | ||||||
|---|---|---|---|---|---|---|---|---|
| 1 | hackerone | 100 | 4 | sequelize node module (4) · hapi node module (3) · ws node module (2) | · | |||
| 2 | foxit | 80 | 4 | foxit reader (80) | · | |||
| 3 | microsoft | 64 | 3 | 11 | windows 10 (19) · microsoft edge (18) · windows 10 servers (18) | ↑1 | ||
| 4 | ibm | 32 | db2 for linux unix and windows (9) · flashsystem v9000 (7) · san volume controller (7) | ↑2 | ||||
| 5 | talos | 26 | 8 | moxa (17) · mysql mmm (8) · open fire user import export plugin (1) | — | |||
| 6 | trend micro | 14 | trend micro email encryption gateway (6) · trend micro maximum security (5) · trend micro smart protection server standalone (2) | · | ||||
| 7 | advantech | 11 | webaccess (11) | · | ||||
| 8 | ics cert | 10 | delta electronics wplsoft (3) · vgo robot (2) · abb srea 01 and srea 50 (1) | ↑7 | ||||
| 9 | apache | 9 | 1 | apache nifi (2) · apache ambari (1) · apache batik (1) | — | |||
| 10 | huawei technologies co | 9 | 1288h v5 2288h v5 (3) · 1288h v5 2288h v5 2488 v5 ch121 v3 ch121l v3 ch121l v5 ch121 v5 ch140 v3 ch140l v3 ch220 v3 ch222 v3 ch242 v3 ch242 v5 rh1288 v3 rh2288 v3 rh2288h v3 xh310 v3 xh321 v3 xh321 v5 xh620 v3 (1) · berlin l21hn prague al00a prague al00b prague al00c prague l31 prague tl00a prague tl10a (1) | ↓2 | ||||
| 11 | pivotal | 9 | 3 | spring framework (2) · spring integration zip (2) · greenplum command center (1) | ↑73 | |||
| 12 | f5 networks | 8 | big ip ltm aam afm analytics apm asm dns edge gateway gtm link controller pem webaccelerator websafe (7) · big ip ltm aam afm apm asm link controller pem webaccelerator websafe (1) · big iq centralized management (1) | ↓1 | ||||
| 13 | sap se | 8 | sap internet graphics server igs (4) · sap enterprise financial services ea finserv (1) · sap enterprise financial services s4core (1) | ↑3 | ||||
| 14 | dell emc | 6 | 2 | dell emc recoverpoint (3) · dell emc recoverpoint virtual machine vm (3) · rsa authentication manager security console (1) | ↑22 | |||
| 15 | intel | 6 | 1 | dual band wireless ac tri band wireless ac and wireless ac family of products (1) · intel graphics driver (1) · online connect access (1) | ↑9 | |||
| 16 | ultimate member | 6 | ultimate member (6) | new | ||||
| 17 | fortinet | 5 | 1 | fortios (2) · fortiwlc (2) · fortiauthenticator (1) | ↑50 | |||
| 18 | micro focus | 5 | network automation (2) · network operations management ultimate (2) · client for open enterprise server (1) | ↑61 | ||||
| 19 | nvidia | 5 | 1 | android (4) · some nvidia tegra mobile processors (1) | ↑1 | |||
| 20 | synology | 5 | note station (2) · calendar (1) · drive (1) | · | ||||
| 21 | qualcomm | 4 | android for msm firefox os for msm qrd android (4) | ↓20 | ||||
| 22 | redhat | 4 | 1 | ansible tower (2) · dhcp (1) · infinispan (1) | ↓8 | |||
| 23 | vmware | 4 | fusion (2) · horizon client for linux (1) · vmware xenon (1) | ↑18 | ||||
| 24 | asus japan | 3 | rt ac1200hp (1) · rt ac68u (1) · rt ac87u (1) | new | ||||
| 25 | atlassian | 3 | jira (2) · application links (1) | ↓8 | ||||
| 26 | cloud foundry | 3 | cloud foundry router (1) · cloudfoundry uaa (1) · windows2012r2 stemcell (1) | ↑20 | ||||
| 27 | kernel | 3 | drivers (1) · kvm (1) · vhost (1) | new | ||||
| 28 | mcafee | 3 | data loss prevention dlp endpoint (1) · network security management nsm (1) · virusscan enterprise vse (1) | ↓16 | ||||
| 29 | medtronic | 3 | 2090 carelink programmer (2) · 29901 encore programmer (2) · 8870 n vision removable application card (1) | new | ||||
| 30 | philips | 3 | brilliance ct scanners (3) | ↑1 | ||||
| 31 | schneider electric se | 3 | ampla mes (2) · clearscada (1) | ↓21 | ||||
| 32 | symantec | 3 | advanced secure gateway asg (1) · intelligencecenter (1) · proxysg (1) | ↓10 | ||||
| 33 | the node js project | 3 | node js (3) | · | ||||
| 34 | acoustic technology inc ati systems | 2 | ati emergency mass notification systems (1) · emergency mass notification systems (1) | new | ||||
| 35 | becton dickinson and | 2 | kiestra and inoqula systems (2) | new | ||||
| 36 | boston scientific | 2 | zoom latitude prm (2) | new | ||||
| 37 | freebsd | 2 | freebsd (2) | ↓8 | ||||
| 38 | lantech | 2 | ids 2102 (2) | new | ||||
| 39 | lenovo group | 2 | lenovo system update (1) · some lenovo flex system and lenovo system x products (1) | ↑12 | ||||
| 40 | netapp | 2 | oncommand unified manager for linux (1) · oncommand unified manager for windows (1) | ↑40 | ||||
| 41 | puppet | 2 | puppet enterprise (2) | · | ||||
| 42 | schneider electric | 2 | triconex tricon (2) | · | ||||
| 43 | siemens | 2 | simatic s7 400 incl f cpu hardware version 4 0 and below simatic s7 400 incl f cpu hardware version 5 0 simatic s7 400h cpu hardware version 4 5 and below (1) · siveillance vms video for android siveillance vms video for ios (1) | ↑12 | ||||
| 44 | tenable | 2 | tenable nessus (2) | · | ||||
| 45 | tibco software | 2 | tibco datasynapse gridserver manager (2) | ↓5 | ||||
| 46 | artifex | 1 | mupdf (1) | new | ||||
| 47 | automationdirect | 1 | sixnet managed industrial switches (1) · stride managed ethernet switch models (1) | · | ||||
| 48 | ca technologies | 1 | ca spectrum (1) | ↓4 | ||||
| 49 | celsys | 1 | clip studio series (1) | new | ||||
| 50 | dahua technologies | 1 | xvr 5x04 xvr 5x08 xvr 5x16 xvr 7x16 ipc hdbw4xxx ipc hdbw5xxx (1) | · |
One CVE is counted once per vendor, product or weakness class it lists, so a ranking column sums to more than the month's total. Only the month's top 100 keys per dimension are stored. The KEV column counts CVEs published in 2018-05 that are on the CISA KEV catalog today. The 0 in the headline is what CISA listed during the month, whenever those CVEs were published. All 50 ranked vendors are listed; a zero count renders as a dot.
Weaknesses
CWE classes by distinct CVEs
- 1CWE-311430 critical↑25
- 2CWE-416290 critical↑29
- 3CWE-125261 critical·
- 4CWE-20200 critical↓3
- 5CWE-400150 critical↑10
- 6CWE-79150 critical↓3
- 7CWE-22120 critical↑5
- 8CWE-122100 critical↓3
- 9CWE-787100 critical↑9
- 10CWE-70480 criticalnew
- 1CWE-8980 critical↑36
- 2CWE-20070 critical↓10
- 3CWE-12150 critical↓9
- 4CWE-28752 critical↓8
- 5CWE-28440 critical↓2
- 6CWE-35840 critical·
- 7CWE-66540 critical↑23
- 8CWE-11930 critical·
- 9CWE-29530 critical↑6
- 10CWE-32530 criticalnew
One CVE is counted once per vendor, product or weakness class it lists, so a ranking column sums to more than the month's total. Only the month's top 100 keys per dimension are stored.