Month report
June 2018
Rolled up 2026-08-09 20:45 from 371,001 CVE records
1,783 CVEs published, +72.6% on the same month last year. 10 rated critical, 0 listed by CISA as exploited. hackerone led with 340; the most common weakness class was CWE-22 (132). ca technologies climbed 41 places, the largest move. 9 vendors ranked for the first time.
Published
1,783
+53.4%on the previous month
Critical / high
10 / 41
of the 117 scored
Medium / low
57 / 9
the rest of the scored bands
Added to CISA KEV
0
listed as exploited this month
Public exploit
124
exploit code indexed publicly
Scanner template
0
0% of the month
Publication to KEV
How long before CISA listed them
3 published this month and listed since — not the 0 listed during it.
Median days to listing
1383
from publication to CISA's date added
Listed within 7 days
0%
of the 3
Listed within 30 days
0%
of the 3
Weakness × vendor
Where the two overlap
CVEs carrying both. Each row is shaded against its own worst class.
| Vendor | CWE-22 | CWE-311 | CWE-506 | CWE-20 | CWE-79 | CWE-400 | CWE-200 | CWE-264 |
|---|---|---|---|---|---|---|---|---|
| hackerone | 127 | 104 | 41 | 2 | 14 | 20 | 2 | |
| mozilla | ||||||||
| microsoft | ||||||||
| qualcomm | ||||||||
| ibm | ||||||||
| siemens | 1 | 2 | ||||||
| ca technologies | ||||||||
| f5 networks |
Vendors
Ranked by distinct CVEs this month
Δ is the move against last month's rank.
| # | Vendor | Top products | ||||||
|---|---|---|---|---|---|---|---|---|
| 1 | hackerone | 340 | 4 | coffeescript node module (3) · html janitor node module (2) · nodemailer js node module (2) | — | |||
| 2 | mozilla | 315 | 1 | 12 | firefox (300) · firefox esr (151) · thunderbird (150) | · | ||
| 3 | microsoft | 57 | 4 | windows 10 (29) · windows 10 servers (27) · windows server 2016 (23) | — | |||
| 4 | qualcomm | 32 | android for msm firefox os for msm qrd android (32) | ↑17 | ||||
| 5 | ibm | 23 | infosphere information server (3) · security access manager (3) · mq (2) | ↓1 | ||||
| 6 | siemens | 11 | scalance m875 (6) · scalance x 200irt switch family incl siplus net variants (3) · scalance x 200rna switch family (3) | ↑37 | ||||
| 7 | ca technologies | 10 | 3 | ca privileged access manager (10) | ↑41 | |||
| 8 | f5 networks | 10 | big ip ltm aam afm analytics apm asm dns edge gateway fps gtm link controller pem webaccelerator (4) · big ip ltm aam afm analytics apm asm dns edge gateway gtm link controller pem webaccelerator websafe (3) · big ip apm (1) | ↑4 | ||||
| 9 | ics cert | 10 | 2 | intellivue patient monitors avalon fetal maternal monitors (3) · abb ip gateway (2) · beckhoff twincat (2) | ↓1 | |||
| 10 | mcafee | 10 | 1 | 1 | epolicy orchestrator epo (3) · network security management nsm (3) · common ui cui (1) | ↑18 | ||
| 11 | synology | 10 | diskstation manager dsm (2) · drive (2) · photo station (2) | ↑9 | ||||
| 12 | talos | 10 | natus (3) · pixar renderman (2) · allen bradley (1) | ↓7 | ||||
| 13 | apache | 9 | 1 | apache storm (2) · apache cassandra (1) · apache geode (1) | ↓4 | |||
| 14 | cybozu | 9 | cybozu office (6) · cybozu mailwise (3) | · | ||||
| 15 | huawei technologies co | 9 | 1288h v5 2288h v5 2488 v5 ch121 v3 ch121l v3 ch121l v5 ch121 v5 ch140 v3 ch140l v3 ch220 v3 ch222 v3 ch242 v3 ch242 v5 rh1288 v3 rh2288 v3 rh2288h v3 xh310 v3 xh321 v3 xh321 v5 xh620 v3 (4) · espace desktop (1) · hg255s 10 (1) | ↓5 | ||||
| 16 | micro focus | 9 | 2 | 2 | solutions business manager 11 4 (5) · secure messaging gateway (2) · cms server (1) | ↑2 | ||
| 17 | basercms users community | 7 | basercms (7) | · | ||||
| 18 | the eclipse foundation | 7 | eclipse jetty (5) · eclipse mosquitto (2) | · | ||||
| 19 | tibco software | 7 | 1 | tibco spotfire analytics platform for aws marketplace (3) · tibco administrator enterprise edition (2) · tibco administrator enterprise edition for z linux (2) | ↑26 | |||
| 20 | trend micro | 7 | 1 | trend micro officescan (7) | ↓14 | |||
| 21 | suse | 6 | open build service (2) · crowbar (1) · kdump (1) | · | ||||
| 22 | opensuse | 5 | open build service (4) · obs service set version (1) | · | ||||
| 23 | puppet | 5 | puppet agent (2) · pe client tools (1) · puppet enterprise 2018 1 x prior to 2018 1 1 razor server and pe razor server prior to 1 9 0 0 (1) | ↑18 | ||||
| 24 | cloud foundry | 4 | loggregator (2) · cloud foundry uaa (1) · diego (1) | ↑2 | ||||
| 25 | the node js project | 4 | node js (4) | ↑8 | ||||
| 26 | delta electronics | 3 | delta industrial automation dopsoft (3) | ↑26 | ||||
| 27 | exadel | 3 | flamingo amf serializer (3) | new | ||||
| 28 | fortinet | 3 | fortinet fortimanager fortianalyzer (2) · fortinet fortimanager (1) | ↓11 | ||||
| 29 | ge | 3 | mds pulsenet and mds pulsenet enterprise (3) | · | ||||
| 30 | nvidia | 3 | gpu display driver (3) | ↓11 | ||||
| 31 | pivotal | 3 | spring framework (2) · operations manager (1) | ↓20 | ||||
| 32 | pixelpost org | 3 | pixelpost (3) | new | ||||
| 33 | rsa | 3 | authentication manager (1) · rsa authentication manager (1) · web threat detection (1) | new | ||||
| 34 | sap se | 3 | 1 | sap ui (2) · sap ui for sap netweaver 7 00 (2) · sap business one (1) | ↓21 | |||
| 35 | symantec | 3 | symantec endpoint protection (2) · norton app lock (1) | ↓3 | ||||
| 36 | graniteds | 2 | framework (2) | new | ||||
| 37 | intel | 2 | integrated performance primitives cryptography library (1) · intel core based microprocessors (1) | ↓22 | ||||
| 38 | libfsntfs project | 2 | libfsntfs (2) | new | ||||
| 39 | linux foundation | 2 | linux kernel (2) | new | ||||
| 40 | lutron | 2 | 2 | homeworks qs firmware (1) · radiora 2 firmware (1) · stanza (1) | new | |||
| 41 | manageengine | 2 | 1 | applications manager (2) | new | |||
| 42 | netapp | 2 | oncommand unified manager for 7 mode core package (1) · santricity products (1) | ↓2 | ||||
| 43 | qnap | 2 | app center in qts (1) · ldap server in qts (1) | · | ||||
| 44 | tenable | 2 | burp suite community edition (1) · libjpeg turbo (1) | — | ||||
| 45 | vmware | 2 | 1 | 1 | airwatch agent (1) · nsx sd wan by velocloud (1) | ↓22 | ||
| 46 | all nippon airways co | 1 | ana app for ios (1) | new | ||||
| 47 | apple | 1 | 1 | icloud (1) · iphone os (1) · itunes (1) | · | |||
| 48 | atlassian | 1 | fisheye and crucible (1) | ↓23 | ||||
| 49 | canonical | 1 | 1 | icloud (1) · iphone os (1) · itunes (1) | · | |||
| 50 | dell emc | 1 | idrac service module (1) | ↓36 |
One CVE is counted once per vendor, product or weakness class it lists, so a ranking column sums to more than the month's total. Only the month's top 100 keys per dimension are stored. The KEV column counts CVEs published in 2018-06 that are on the CISA KEV catalog today. The 0 in the headline is what CISA listed during the month, whenever those CVEs were published. All 50 ranked vendors are listed; a zero count renders as a dot.
Weaknesses
CWE classes by distinct CVEs
- 1CWE-221320 critical↑6
- 2CWE-3111040 critical↓1
- 3CWE-506410 critical↑22
- 4CWE-20290 critical—
- 5CWE-79260 critical↑1
- 6CWE-400210 critical↓1
- 7CWE-20090 critical↑5
- 8CWE-26470 critical↑26
- 9CWE-35260 critical↑12
- 10CWE-39960 critical↑12
- 1CWE-28750 critical↑3
- 2CWE-47150 critical·
- 3CWE-7751 critical↑28
- 4CWE-8951 critical↓3
- 5CWE-9450 critical↑13
- 6CWE-11940 critical↑2
- 7CWE-12140 critical↓4
- 8CWE-50240 critical↑6
- 9CWE-7840 critical↑8
- 10CWE-79842 critical↑22
One CVE is counted once per vendor, product or weakness class it lists, so a ranking column sums to more than the month's total. Only the month's top 100 keys per dimension are stored.