Month report
December 2018
Rolled up 2026-08-09 20:45 from 370,662 CVE records
1,163 CVEs published, +5.2% on the same month last year. 11 rated critical, 0 listed by CISA as exploited. google led with 79; the most common weakness class was CWE-79 (14). freebsd climbed 30 places, the largest move. 13 vendors ranked for the first time.
Published
1,163
+18.3%on the previous month
Critical / high
11 / 65
of the 173 scored
Medium / low
81 / 16
the rest of the scored bands
Added to CISA KEV
0
listed as exploited this month
Public exploit
73
exploit code indexed publicly
Scanner template
0
0% of the month
Publication to KEV
How long before CISA listed them
10 published this month and listed since — not the 0 listed during it.
Median days to listing
1339
from publication to CISA's date added
Listed within 7 days
0%
of the 10
Listed within 30 days
0%
of the 10
Weakness × vendor
Where the two overlap
CVEs carrying both. Each row is shaded against its own worst class.
| Vendor | CWE-79 | CWE-20 | CWE-787 | CWE-400 | CWE-78 | CWE-121 | CWE-125 | CWE-200 |
|---|---|---|---|---|---|---|---|---|
| 1 | ||||||||
| ibm | ||||||||
| microsoft | 1 | 1 | ||||||
| siemens | 1 | 1 | ||||||
| qualcomm | ||||||||
| 2 | 4 | 1 | 1 | |||||
| schneider electric se | ||||||||
| hewlett packard enterprise |
Vendors
Ranked by distinct CVEs this month
Δ is the move against last month's rank.
| # | Vendor | Top products | ||||||
|---|---|---|---|---|---|---|---|---|
| 1 | 79 | 1 | 1 | chrome (47) · android (32) | — | |||
| 2 | ibm | 63 | 1 | security access manager appliance (10) · security guardium (8) · bigfix platform (7) | ↑1 | |||
| 3 | microsoft | 40 | 3 | 7 | windows 10 (14) · windows server 2019 (14) · windows 10 servers (12) | ↓1 | ||
| 4 | siemens | 20 | sinumerik 808d v4 7 sinumerik 808d v4 8 sinumerik 828d v4 7 sinumerik 840d sl v4 7 sinumerik 840d sl v4 8 (7) · simatic hmi comfort panels 4 22 simatic hmi comfort outdoor panels 7 15 simatic hmi ktp mobile panels ktp400f ktp700 ktp700f ktp900 und ktp900f simatic wincc runtime advanced simatic wincc runtime professional simatic wincc tia portal simatic hmi classic devices tp mp op mp mobile panel (3) · sinumerik 828d v4 7 sinumerik 840d sl v4 7 sinumerik 840d sl v4 8 (3) | · | ||||
| 5 | qualcomm | 16 | android for msm firefox os for msm qrd android (15) · snapdragon mobile snapdragon wear (1) | ↑1 | ||||
| 6 | 14 | 4 | 1 | hhvm (5) · proxygen (3) · buck (1) | new | |||
| 7 | schneider electric se | 13 | embedded web servers in all modicon m340 premium quantum plcs and bmxnor0200 (3) · evlink parking v3 2 0 12 v1 and earlier (3) · iiot monitor 3 1 38 (3) | ↑2 | ||||
| 8 | hewlett packard enterprise | 11 | aruba clearpass policy manager (5) · hpe intelligent management center imc (3) · aruba access points (1) | · | ||||
| 9 | kiboko labs https calendarscripts info | 10 | 10 | arigato autoresponder and newsletter (10) | new | |||
| 10 | mcafee | 10 | 1 | 3 | mcafee agent ma for linux (3) · true key (3) · application and change control (2) | · | ||
| 11 | sap | 9 | sap netweaver as java servercore (2) · sap basis abap platform (1) · sap basis as abap of sap netweaver (1) | ↓4 | ||||
| 12 | apache | 8 | 1 | apache nifi (4) · apache netbeans (1) · apache ofbiz (1) | ↓2 | |||
| 13 | f5 networks | 8 | big ip apm (2) · big ip ltm aam afm analytics apm asm dns edge gateway fps gtm link controller pem webaccelerator (2) · big ip aam (1) | · | ||||
| 14 | intel | 7 | intel quickassist technology for linux (2) · intel integrated performance primitives (1) · intel parallel studio (1) | ↑1 | ||||
| 15 | micro focus | 6 | 2 | fortify software security center ssc (2) · netiq edirectory 9 1 sp2 (2) · netiq imanager 3 1 sp2 (1) | ↑18 | |||
| 16 | talos | 6 | atlantis word processor (3) · tp link (3) | · | ||||
| 17 | elastic | 4 | 1 | elasticsearch (2) · kibana (2) | · | |||
| 18 | freebsd | 4 | freebsd (4) | ↑30 | ||||
| 19 | logitech | 4 | logitech harmony hub (4) | new | ||||
| 20 | synology | 4 | diskstation manager dsm (3) · synology router manager srm (1) | · | ||||
| 21 | blackberry | 3 | blackberry uem (3) | · | ||||
| 22 | cloud foundry | 3 | bits service release (1) · nfs volume release (1) · uaa release (1) | ↑8 | ||||
| 23 | kubernetes | 3 | 1 | 1 | kubernetes (2) · minikube (1) | · | ||
| 24 | netgate | 3 | netgate pfsense (3) | new | ||||
| 25 | open dental | 3 | open dental (3) | new | ||||
| 26 | trend micro | 3 | trend micro officescan (2) · trend micro dr safety for android consumer (1) | · | ||||
| 27 | zte | 3 | usmartview (1) · zxin10 european region (1) · zxv10 b860av2 1 chinamobile (1) | ↓14 | ||||
| 28 | brocade communications systems | 2 | brocade fabric os (2) | ↓17 | ||||
| 29 | dell emc | 2 | idrac (2) | ↓15 | ||||
| 30 | huawei technologies co | 2 | huawei p20 (1) · huawei vip app (1) | ↓22 | ||||
| 31 | pivotal | 2 | concourse (1) · rabbitmq for pcf (1) | ↑27 | ||||
| 32 | qnap | 2 | q center virtual appliance (2) | ↓13 | ||||
| 33 | the foreman project | 2 | foreman (1) · katello (1) | · | ||||
| 34 | vmware | 2 | 1 | vmware esxi (1) · vmware esxi vmware workstation and vmware fusion (1) | ↑5 | |||
| 35 | wizvera | 2 | veraport (2) | new | ||||
| 36 | artifex | 1 | ghostscript (1) | · | ||||
| 37 | bigtreecms | 1 | bigtree (1) | · | ||||
| 38 | cisco | 1 | cisco adaptive security appliance asa software (1) | ↓34 | ||||
| 39 | dell | 1 | dell encryption formerly dell data protection encryption (1) | ↓8 | ||||
| 40 | devpia | 1 | dextuploadx5 (1) | new | ||||
| 41 | estsoft | 1 | alzip (1) | new | ||||
| 42 | hancom | 1 | hancom office (1) | · | ||||
| 43 | infraware | 1 | ml report (1) | new | ||||
| 44 | medtronic | 1 | 29901 encore programmer (1) · carelink 2090 programmer (1) · carelink 9790 programmer (1) | · | ||||
| 45 | netapp | 1 | data ontap operating in 7 mode (1) | ↑9 | ||||
| 46 | netatalk | 1 | 1 | 1 | netatalk (1) | new | ||
| 47 | palo alto networks | 1 | palo alto networks expedition (1) | ↑10 | ||||
| 48 | pandora tv | 1 | kmplayer (1) | new | ||||
| 49 | pixar | 1 | tractor (1) | new | ||||
| 50 | signkorea | 1 | skcertservice (1) | new |
One CVE is counted once per vendor, product or weakness class it lists, so a ranking column sums to more than the month's total. Only the month's top 100 keys per dimension are stored. The KEV column counts CVEs published in 2018-12 that are on the CISA KEV catalog today. The 0 in the headline is what CISA listed during the month, whenever those CVEs were published. All 50 ranked vendors are listed; a zero count renders as a dot.
Weaknesses
CWE classes by distinct CVEs
- 1CWE-79141 critical↑1
- 2CWE-2060 critical↑1
- 3CWE-78751 critical↑16
- 4CWE-40040 critical↓3
- 5CWE-7841 critical↑37
- 6CWE-12130 critical↑1
- 7CWE-12530 critical·
- 8CWE-20030 critical↓4
- 9CWE-2230 critical↓1
- 10CWE-24830 critical·
- 1CWE-28730 critical↑15
- 2CWE-37730 critical·
- 3CWE-40430 critical·
- 4CWE-41630 critical↑2
- 5CWE-12220 critical↓2
- 6CWE-20320 critical·
- 7CWE-26420 critical↑7
- 8CWE-28420 critical↓9
- 9CWE-36220 critical·
- 10CWE-50222 critical↑15
One CVE is counted once per vendor, product or weakness class it lists, so a ranking column sums to more than the month's total. Only the month's top 100 keys per dimension are stored.