Month report
September 2018
Rolled up 2026-08-09 20:45 from 370,700 CVE records
1,169 CVEs published, -4.8% on the same month last year. 23 rated critical, 0 listed by CISA as exploited. qualcomm led with 65; the most common weakness class was CWE-20 (18). freebsd climbed 52 places, the largest move. 12 vendors ranked for the first time.
Published
1,169
+15.4%on the previous month
Critical / high
23 / 72
of the 175 scored
Medium / low
76 / 4
the rest of the scored bands
Added to CISA KEV
0
listed as exploited this month
Public exploit
87
exploit code indexed publicly
Scanner template
0
0% of the month
Publication to KEV
How long before CISA listed them
3 published this month and listed since — not the 0 listed during it.
Median days to listing
1292
from publication to CISA's date added
Listed within 7 days
0%
of the 3
Listed within 30 days
0%
of the 3
Vendors
Ranked by distinct CVEs this month
Δ is the move against last month's rank.
| # | Vendor | Top products | ||||||
|---|---|---|---|---|---|---|---|---|
| 1 | qualcomm | 65 | android for msm firefox os for msm qrd android (50) · snapdragon automobile snapdragon mobile snapdragon wear (12) · snapdragon automobile snapdragon mobile (1) | · | ||||
| 2 | microsoft | 62 | 1 | 11 | windows 10 (30) · windows 10 servers (29) · windows server 2016 (24) | ↓1 | ||
| 3 | ibm | 38 | 1 | 1 | rational engineering lifecycle manager (5) · websphere application server (4) · websphere portal (4) | — | ||
| 4 | redhat | 28 | glusterfs (12) · cfme (2) · undertow (2) | ↑8 | ||||
| 5 | 24 | chrome (24) | ↑33 | |||||
| 6 | samsung | 22 | 10 | smartthings hub sth eth 250 (13) · samsung galaxy apps (3) · samsung email (2) | ↓1 | |||
| 7 | intel | 20 | intel r active management technology (3) · intel r extreme tuning utility (3) · intel iot developers kit (1) | ↑2 | ||||
| 8 | adobe | 16 | 5 | 1 | 1 | coldfusion (9) · acrobat and reader (6) · flash player (1) | · | |
| 9 | apache | 13 | 3 | apache spamassassin (3) · apache tika (3) · apache karaf (2) | ↓3 | |||
| 10 | foscam | 12 | 2 | foscam c1 indoor hd camera (7) · foscam indoor ip camera c1 series (5) | · | |||
| 11 | huawei technologies co | 12 | 1 | alp l09 (2) · agassi l09 agassi w09 baggio2 u01a bond al00c bond al10b bond tl10b bond tl10c haydn l1jb kobe l09a kobe l09ahn kobe w09c lelandp l22c lelandp l22d rhone al00 selina l02 stanford l09s toronto al00 toronto al00a toronto tl10 (1) · b315s 22 (1) | ↑22 | |||
| 12 | sap | 12 | sap enterprise financial services (2) · gbx01 hr (1) · sap adaptive server enterprise (1) | ↑1 | ||||
| 13 | dell emc | 9 | 1 | dell emc unity (3) · dell emc unityvsa (3) · rsa bsafe ssl j (3) | ↑10 | |||
| 14 | elastic | 9 | elasticsearch (3) · elastic cloud enterprise (2) · elasticsearch x pack machine learning (2) | · | ||||
| 15 | freebsd | 9 | 2 | freebsd (9) | ↑52 | |||
| 16 | lenovo group | 9 | 1 | ez media and backup center (9) · iomega storcenter (9) · lenovoemc (9) | · | |||
| 17 | philips | 9 | e alert unit non medical device (9) | ↑9 | ||||
| 18 | hewlett packard enterprise | 8 | hpe intelligent management center imc wireless services manager software (2) · hpe device entitlement gateway deg (1) · hpe enhanced internet usage manager eium (1) | ↓16 | ||||
| 19 | fuji electric | 7 | v server (6) · v server lite (1) | new | ||||
| 20 | linux | 7 | 1 | 1 | kernel (5) · linux kernel (2) | ↑20 | ||
| 21 | avaya | 5 | orchestration designer (2) · call management system supervisor (1) · communication manager (1) | new | ||||
| 22 | mcafee | 5 | true key tk (2) · endpoint security for linux threat prevention ensltp (1) · mcafee application control and change control macc (1) | · | ||||
| 23 | micro focus | 5 | arcsight management center (5) | ↓3 | ||||
| 24 | open xchange | 5 | pdns (4) · dnsdist (1) | new | ||||
| 25 | pivotal | 5 | application service (2) · cloud cache (1) · pivotal cloud foundry elastic runtime (1) | · | ||||
| 26 | talos | 5 | erpnext (3) · nordvpn (1) · protonvpn (1) | ↓12 | ||||
| 27 | f5 networks | 4 | big ip apm (3) · f5 websafe alert server (1) | ↑10 | ||||
| 28 | hibara software | 4 | attachecase (4) | · | ||||
| 29 | rsa | 4 | authentication manager (3) · bsafe crypto c micro edition (1) · bsafe micro edition suite (1) | ↓2 | ||||
| 30 | weseek | 4 | growi (4) | new | ||||
| 31 | fortinet | 3 | fortios (2) · fortimanager (1) | · | ||||
| 32 | i o data device | 3 | multiple i o data network camera products (3) | · | ||||
| 33 | rockwell automation | 3 | rslinx classic (3) | · | ||||
| 34 | siemens | 3 | scalance x300 scalance x408 scalance x414 (1) · siemens td keypad designer (1) · simatic wincc oa v3 14 and prior (1) | ↓6 | ||||
| 35 | antenna house | 2 | dmc htmlfilter (2) | · | ||||
| 36 | cloud foundry | 2 | container runtime (1) · garden runc (1) | · | ||||
| 37 | foreman | 2 | foreman (2) | · | ||||
| 38 | gmo payment gateway | 2 | ec cube payment module and gmo pg payment module pg multi payment service for ec cube (2) | new | ||||
| 39 | ice qube | 2 | thermal management center (2) | new | ||||
| 40 | nuuo | 2 | nuuo nvrmini2 (2) | new | ||||
| 41 | orca management organization co | 2 | ubuntu14 04 orca online receipt computer advantage 4 8 0 panda client2 1 1 4 9 p41 u4jma1 and earlier ubuntu14 04 orca online receipt computer advantage 5 0 0 panda client2 1 2 0 0 p48 u4jma1 and earlier and ubuntu16 04 orca online receipt computer advantage 5 0 0 panda client2 1 2 0 0 p48 u5jma1 and earlier (1) · ubuntu14 04 orca online receipt computer advantage 4 8 0 panda server 1 1 4 9 p41 u4jma1 and earlier (1) | new | ||||
| 42 | processmaker | 2 | processmaker enterprise (2) | new | ||||
| 43 | symantec | 2 | symantec messaging gateway (2) | ↓14 | ||||
| 44 | the openstack project | 2 | openstack neutron (2) | new | ||||
| 45 | vmware | 2 | airwatch agent for ios prior to 5 8 1 (1) · content locker for ios (1) | ↑6 | ||||
| 46 | wecon technology co | 2 | levistudiou (2) | · | ||||
| 47 | yayoi co | 2 | multiple yayoi 17 series products (2) | new | ||||
| 48 | asus japan | 1 | wl 330nul (1) | · | ||||
| 49 | atlassian | 1 | fisheye and crucible (1) | ↓32 | ||||
| 50 | bit part | 1 | mtappjquery (1) | new |
One CVE is counted once per vendor, product or weakness class it lists, so a ranking column sums to more than the month's total. Only the month's top 100 keys per dimension are stored. The KEV column counts CVEs published in 2018-09 that are on the CISA KEV catalog today. The 0 in the headline is what CISA listed during the month, whenever those CVEs were published. All 50 ranked vendors are listed; a zero count renders as a dot.
Weaknesses
CWE classes by distinct CVEs
- 1CWE-20180 critical—
- 2CWE-200110 critical↑2
- 3CWE-40090 critical↑3
- 4CWE-12170 critical↑19
- 5CWE-7970 critical↓3
- 6CWE-12250 critical↑6
- 7CWE-28550 critical↑1
- 8CWE-50254 critical↑11
- 9CWE-26940 critical↑16
- 10CWE-41640 critical—
- 1CWE-12530 critical↑2
- 2CWE-19030 critical↑12
- 3CWE-28430 critical↓6
- 4CWE-35230 critical↑2
- 5CWE-2220 critical↓10
- 6CWE-26620 critical·
- 7CWE-27420 critical·
- 8CWE-30620 critical·
- 9CWE-31920 critical↑25
- 10CWE-34720 critical·
One CVE is counted once per vendor, product or weakness class it lists, so a ranking column sums to more than the month's total. Only the month's top 100 keys per dimension are stored.