Month report
January 2019
Rolled up 2026-08-09 20:45 from 370,700 CVE records
1,212 CVEs published, -4.8% on the same month last year. 8 rated critical, 0 listed by CISA as exploited. oracle led with 155; the most common weakness class was CWE-416 (76). cisco climbed 33 places, the largest move. 14 vendors ranked for the first time.
Published
1,212
+4.2%on the previous month
Critical / high
8 / 64
of the 173 scored
Medium / low
96 / 5
the rest of the scored bands
Added to CISA KEV
0
listed as exploited this month
Public exploit
86
exploit code indexed publicly
Scanner template
0
0% of the month
Publication to KEV
How long before CISA listed them
6 published this month and listed since — not the 0 listed during it.
Median days to listing
1129
from publication to CISA's date added
Listed within 7 days
0%
of the 6
Listed within 30 days
0%
of the 6
Vendors
Ranked by distinct CVEs this month
Δ is the move against last month's rank.
| # | Vendor | Top products | ||||||
|---|---|---|---|---|---|---|---|---|
| 1 | oracle | 155 | 1 | vm virtualbox (27) · mysql server (25) · outside in technology (24) | · | |||
| 2 | 84 | 6 | chrome (84) | ↓1 | ||||
| 3 | foxit | 80 | reader (68) · phantompdf (11) · foxit (1) | · | ||||
| 4 | microsoft | 48 | 1 | 11 | windows 10 (23) · windows 10 servers (23) · windows server 2019 (22) | ↓1 | ||
| 5 | cisco | 45 | 1 | 2 | 3 | cisco identity services engine software (6) · cisco sd wan solution (5) · cisco webex wrf player (5) | ↑33 | |
| 6 | qualcomm | 31 | snapdragon automobile snapdragon mobile snapdragon wear (14) · snapdragon mobile snapdragon wear (13) · snapdragon automobile snapdragon mobile (2) | ↓1 | ||||
| 7 | juniper networks | 26 | 4 | juniper atp (12) · junos os (12) · junos space (2) | · | |||
| 8 | nec | 21 | hc100rc (8) · aterm w300p (5) · aterm wf1200cr and aterm wg1200cr (4) | · | ||||
| 9 | ibm | 18 | 1 | 1 | security identity manager (5) · api connect (3) · rational publishing engine (2) | ↓7 | ||
| 10 | isc | 18 | 3 | bind 9 (15) · isc dhcp (2) · kea dhcp (1) | · | |||
| 11 | apache | 12 | 2 | apache airflow (4) · apache http server (3) · apache thrift (2) | ↑1 | |||
| 12 | sap se | 12 | sap cloud connector (2) · sap crm webclient ui s4fnd (2) · sap crm webclient ui sapscore (2) | · | ||||
| 13 | cybozu | 9 | cybozu remote service (4) · cybozu office (2) · cybozu dezie (1) | · | ||||
| 14 | ics cert | 8 | cx supervisor (5) · dr 195 164 ger infinity delta (3) | · | ||||
| 15 | drupal | 7 | 1 | drupal core (6) · 3rd party module search autocomplete (1) | · | |||
| 16 | intel | 7 | intel r optane tm ssd dc p4800x (2) · intel r nuc (1) · intel r proset wireless wifi software (1) | ↓2 | ||||
| 17 | jenkins project | 5 | 3 | jenkins (2) · pipeline declarative plugin (1) · pipeline groovy plugin (1) | · | |||
| 18 | micronet | 5 | inplc rt (4) · installer of inplc sdk express 3 08 and earlier and installer of inplc sdk pro 3 08 and earlier (1) | new | ||||
| 19 | ricoh company | 5 | ricoh interactive whiteboard (5) | new | ||||
| 20 | the systemd project | 5 | systemd (5) | new | ||||
| 21 | toshiba lighting technology | 5 | toshiba home gateway hem gw16a and toshiba home gateway hem gw26a (5) | · | ||||
| 22 | adobe | 4 | adobe experience manager (2) · adobe acrobat and reader (1) · adobe experience manager forms (1) | · | ||||
| 23 | jpcert coordination center | 4 | 1 | logontracer (4) | new | |||
| 24 | linux | 4 | kernel (4) | · | ||||
| 25 | mcafee | 4 | total protection mtp (2) · mcafee web gateway (1) · mvision endpoint (1) | ↓15 | ||||
| 26 | panasonic | 4 | bn sdwbp3 (3) · some pre installed applications on panasonic pc (1) | new | ||||
| 27 | brocade communications systems | 3 | 1 | brocade network advisor (3) | ↑1 | |||
| 28 | dell | 3 | dell networking os10 (1) · rsa archer (1) · rsa authentication manager (1) | ↑11 | ||||
| 29 | 3 | hhvm (2) · wangle (1) | ↓23 | |||||
| 30 | imperva | 3 | securesphere (3) | new | ||||
| 31 | nippon telegraph and telephone west | 3 | biz box router n58i and n500 (2) · biz box router n58i n500 nvr500 and rtx810 (2) · yamaha broadband voip router nvr500 (2) | · | ||||
| 32 | spring | 3 | spring batch (1) · spring integration (1) · spring web services (1) | new | ||||
| 33 | tenable | 3 | labkey server community edition (3) | · | ||||
| 34 | thimpress | 3 | learnpress (3) | new | ||||
| 35 | tibco software | 3 | tibco spotfire analytics platform for aws marketplace (3) · tibco spotfire server (2) · tibco spotfire server versions (1) | ↑19 | ||||
| 36 | abb | 2 | cms 770 (1) · m2m ethernet (1) | · | ||||
| 37 | ca technologies | 2 | ca service desk manager (2) | · | ||||
| 38 | digital arts | 2 | i filter (2) | · | ||||
| 39 | netapp | 2 | clustered data ontap (1) · oncommand unified manager for 7 mode core package (1) | ↑6 | ||||
| 40 | nippon telegraph and telephone east | 2 | biz box router n58i and n500 (2) · biz box router n58i n500 nvr500 and rtx810 (2) · yamaha broadband voip router nvr500 (2) | · | ||||
| 41 | palo alto networks | 2 | palo alto networks pan os (2) | ↑6 | ||||
| 42 | power dns | 2 | pdns recursor (2) | new | ||||
| 43 | seiko epson | 2 | seiko epson printers and scanners (2) | new | ||||
| 44 | symantec | 2 | norton app lock (1) · symantec reporter (1) | ↑9 | ||||
| 45 | weseek | 2 | growi (2) | · | ||||
| 46 | yamaha | 2 | biz box router n58i and n500 (2) · biz box router n58i n500 nvr500 and rtx810 (2) · yamaha broadband voip router nvr500 (2) | new | ||||
| 47 | yokogawa electric | 2 | multiple yokogawa products that contain vnet ip open communication driver (1) · the license management function of yokogawa products (1) | new | ||||
| 48 | 3s smart | 1 | 3s smart software solutions gmbh codesys control v3 products prior to version 3 5 14 0 (1) | new | ||||
| 49 | apple | 1 | 1 | iphone os (1) · macos (1) | · | |||
| 50 | arne brachhold | 1 | google xml sitemaps (1) | new |
One CVE is counted once per vendor, product or weakness class it lists, so a ranking column sums to more than the month's total. Only the month's top 100 keys per dimension are stored. The KEV column counts CVEs published in 2019-01 that are on the CISA KEV catalog today. The 0 in the headline is what CISA listed during the month, whenever those CVEs were published. All 50 ranked vendors are listed; a zero count renders as a dot.
Weaknesses
CWE classes by distinct CVEs
- 1CWE-416760 critical↑13
- 2CWE-79200 critical↓1
- 3CWE-125110 critical↑4
- 4CWE-200100 critical↑4
- 5CWE-11971 critical↑20
- 6CWE-2070 critical↓4
- 7CWE-28470 critical↑11
- 8CWE-7760 critical·
- 9CWE-79853 critical↑42
- 10CWE-28740 critical↑1
- 1CWE-53240 critical·
- 2CWE-40030 critical↓8
- 3CWE-61130 critical↑33
- 4CWE-77030 critical·
- 5CWE-84330 critical·
- 6CWE-9430 critical·
- 7CWE-12220 critical↓2
- 8CWE-25020 critical·
- 9CWE-26420 critical↓2
- 10CWE-26920 critical·
One CVE is counted once per vendor, product or weakness class it lists, so a ranking column sums to more than the month's total. Only the month's top 100 keys per dimension are stored.