Month report
July 2018
Rolled up 2026-08-09 20:45 from 370,662 CVE records
2,167 CVEs published, +70.9% on the same month last year. 14 rated critical, 0 listed by CISA as exploited. oracle led with 204; the most common weakness class was CWE-843 (46). redhat climbed 58 places, the largest move. 19 vendors ranked for the first time.
Published
2,167
+21.5%on the previous month
Critical / high
14 / 73
of the 287 scored
Medium / low
179 / 21
the rest of the scored bands
Added to CISA KEV
0
listed as exploited this month
Public exploit
93
exploit code indexed publicly
Scanner template
0
0% of the month
Publication to KEV
How long before CISA listed them
5 published this month and listed since — not the 0 listed during it.
Median days to listing
1414
from publication to CISA's date added
Listed within 7 days
0%
of the 5
Listed within 30 days
0%
of the 5
Vendors
Ranked by distinct CVEs this month
Δ is the move against last month's rank.
| # | Vendor | Top products | ||||||
|---|---|---|---|---|---|---|---|---|
| 1 | oracle | 204 | 3 | mysql server (24) · outside in technology (14) · sun zfs storage appliance kit ak software (11) | · | |||
| 2 | foxit | 82 | foxit reader (80) · foxit activex pro sdk (1) · foxit phantompdf (1) | · | ||||
| 3 | ibm | 82 | 3 | rational quality manager (47) · rational collaborative lifecycle management (34) · rational rhapsody design manager (10) | ↑2 | |||
| 4 | qualcomm | 59 | 1 | android for msm firefox os for msm qrd android (43) · snapdragon automobile snapdragon mobile snapdragon wear (9) · snapdragon mobile snapdragon wear (5) | — | |||
| 5 | microsoft | 55 | 1 | 6 | microsoft edge (19) · chakracore (12) · windows 10 (9) | ↓2 | ||
| 6 | redhat | 38 | ceph (4) · ansible (3) · cloudforms (3) | ↑58 | ||||
| 7 | schneider electric se | 24 | 1 | u motion (14) · u motion builder (4) · pelco sarix professional v1 (3) | · | |||
| 8 | apache | 20 | 3 | apache kafka (2) · apache spark (2) · apache tomcat native (2) | ↑5 | |||
| 9 | f5 networks | 16 | big ip ltm aam afm analytics apm asm dns edge gateway fps gtm link controller pem webaccelerator (6) · big ip apm (2) · big ip asm (2) | ↓1 | ||||
| 10 | intel | 16 | 1 | intel active management technology (3) · intel processor diagnostic tool (2) · intel converged security management engine intel csme (1) | ↑27 | |||
| 11 | juniper networks | 14 | 3 | junos os (11) · contrail service orchestration (3) | · | |||
| 12 | huawei technologies co | 11 | emily al00a (2) · dp300 ips module ngfw module rp200 secospace usg6300 secospace usg6500 secospace usg6600 te30 te40 te50 te60 (1) · dp300 rp200 te30 te40 te50 te60 (1) | ↑3 | ||||
| 13 | sap | 11 | sap internet graphics server igs (3) · sap businessobjects business intelligence suite (2) · sap businessobjects business intelligence bi launchpad and central management console (1) | · | ||||
| 14 | siemens | 10 | 1 | siclock tc100 siclock tc400 (6) · firmware variant dnp3 tcp for en100 ethernet module (2) · firmware variant iec104 for en100 ethernet module (2) | ↓8 | |||
| 15 | atlassian | 9 | jira (3) · atlassian http (1) · confluence (1) | ↑33 | ||||
| 16 | qemu | 8 | 1 | qemu (7) · display (1) | · | |||
| 17 | dell emc | 7 | 1 | idrac7 (2) · idrac8 (2) · idrac9 (2) | ↑33 | |||
| 18 | ieee | 7 | standard (7) | new | ||||
| 19 | lenovo group | 7 | lenovo xclarity administrator (3) · lenovo help android application (1) · lenovo smart assistant (1) | · | ||||
| 20 | acd systems | 6 | canvas draw (6) | new | ||||
| 21 | antenna house | 6 | antenna house (6) | · | ||||
| 22 | vmware | 6 | vmware esxi workstation and fusion (3) · esxi (1) · fusion (1) | ↑23 | ||||
| 23 | itrack | 5 | easy (5) | new | ||||
| 24 | linux | 5 | kernel (4) · util linux (1) | · | ||||
| 25 | mcafee | 5 | mcafee web gateway mwg (2) · data loss prevention dlp for windows (1) · drive encryption mde (1) | ↓15 | ||||
| 26 | netpbm | 5 | netpbm (5) | new | ||||
| 27 | php formmail | 5 | generator (5) | new | ||||
| 28 | qnap | 5 | 5 | q center virtual appliance (5) | ↑15 | |||
| 29 | synology | 5 | carddav server (1) · diskstation manager dsm (1) · nas server ds107 (1) | ↓18 | ||||
| 30 | the curl project | 5 | curl (5) | new | ||||
| 31 | echelon | 4 | 4 | i lon 100 (4) · i lon 600 (4) · smartserver 1 (4) | new | |||
| 32 | hughes satellite modem | 4 | dw7000 (4) · hn7000s sm (4) · hn7740s (4) | new | ||||
| 33 | medtronic | 4 | 24950 mycarelink monitor (2) · 24952 mycarelink monitor (2) · 2090 carelink programmer (1) | · | ||||
| 34 | nextcloud | 4 | nextcloud server (2) · nextcloud calendar application (1) · nextcloud contacts application (1) | · | ||||
| 35 | trackr | 4 | bravo mobile application (4) | new | ||||
| 36 | zte | 4 | zxcdn sns (1) · zxiptv epg (1) · zxiptv ucm (1) | · | ||||
| 37 | doccms | 3 | administration panel (3) | new | ||||
| 38 | jenkins project | 3 | active directory jenkins plugin (1) · distfork jenkins plugin (1) · pipeline classpath step jenkins plugin (1) | new | ||||
| 39 | manageengine | 3 | applications manager (3) | ↑2 | ||||
| 40 | martem | 3 | telem gw6 (2) · telem gwm (2) · telem gw6 gwm (1) | new | ||||
| 41 | navarino | 3 | infinity (3) | new | ||||
| 42 | pivotal | 3 | pivotal operations manager (2) · pivotal application service (1) | ↓11 | ||||
| 43 | rsa | 3 | 1 | rsa identity governance and lifecycle (2) · certificate manager path traversal vulnerability (1) | ↓10 | |||
| 44 | samba | 3 | samba (3) | · | ||||
| 45 | schweitzer engineering laboratories | 3 | 1 | acselerator architect (2) · compass (1) | new | |||
| 46 | xorg | 3 | libice (1) · libxdmcp (1) · xorg x11 server (1) | new | ||||
| 47 | zizai technology | 3 | tech nut mobile application (2) · tech nut (1) | new | ||||
| 48 | accellion | 2 | ftp server (2) | new | ||||
| 49 | asus | 2 | rp ac52 access point (2) | new | ||||
| 50 | aveva software | 2 | indusoft web studio (1) · intouch (1) · intouch machine edition (1) | new |
One CVE is counted once per vendor, product or weakness class it lists, so a ranking column sums to more than the month's total. Only the month's top 100 keys per dimension are stored. The KEV column counts CVEs published in 2018-07 that are on the CISA KEV catalog today. The 0 in the headline is what CISA listed during the month, whenever those CVEs were published. All 50 ranked vendors are listed; a zero count renders as a dot.
Weaknesses
CWE classes by distinct CVEs
- 1CWE-843460 critical·
- 2CWE-416300 critical↑55
- 3CWE-20270 critical↑1
- 4CWE-79220 critical↑1
- 5CWE-787170 critical·
- 6CWE-22161 critical↓5
- 7CWE-306151 critical↑41
- 8CWE-200111 critical↓1
- 9CWE-121100 critical↑8
- 10CWE-28490 critical↑14
- 1CWE-29590 critical↑21
- 2CWE-7790 critical↑1
- 3CWE-12280 critical↑9
- 4CWE-12580 critical↑9
- 5CWE-28580 critical↑30
- 6CWE-31070 critical·
- 7CWE-40070 critical↓11
- 8CWE-79871 critical↑2
- 9CWE-35261 critical↓10
- 10CWE-69360 critical↑48
One CVE is counted once per vendor, product or weakness class it lists, so a ranking column sums to more than the month's total. Only the month's top 100 keys per dimension are stored.