Month report
May 2019
Rolled up 2026-08-09 20:45 from 370,662 CVE records
1,316 CVEs published, +13.3% on the same month last year. 21 rated critical, 0 listed by CISA as exploited. adobe led with 207; the most common weakness class was CWE-20 (16). netapp climbed 61 places, the largest move. 13 vendors ranked for the first time.
Published
1,316
-14%on the previous month
Critical / high
21 / 69
of the 214 scored
Medium / low
117 / 7
the rest of the scored bands
Added to CISA KEV
0
listed as exploited this month
Public exploit
111
exploit code indexed publicly
Scanner template
0
0% of the month
Publication to KEV
How long before CISA listed them
14 published this month and listed since — not the 0 listed during it.
Median days to listing
1045
from publication to CISA's date added
Listed within 7 days
0%
of the 14
Listed within 30 days
0%
of the 14
Vendors
Ranked by distinct CVEs this month
Δ is the move against last month's rank.
| # | Vendor | Top products | ||||||
|---|---|---|---|---|---|---|---|---|
| 1 | adobe | 207 | 1 | adobe acrobat and reader (175) · adobe bridge cc (8) · adobe shockwave player (7) | · | |||
| 2 | cisco | 98 | 2 | 1 | cisco nx os software (32) · cisco adaptive security appliance asa software (13) · cisco firepower threat defense ftd software (8) | ↑3 | ||
| 3 | microsoft | 79 | 1 | 3 | 3 | windows server (31) · windows (30) · windows server version 1903 server core installation (29) | ↓1 | |
| 4 | qualcomm | 31 | snapdragon auto snapdragon compute snapdragon consumer iot snapdragon industrial iot snapdragon mobile (5) · snapdragon auto snapdragon compute snapdragon connectivity snapdragon consumer iot snapdragon industrial iot snapdragon iot snapdragon mobile snapdragon wearables (3) · snapdragon auto snapdragon compute snapdragon consumer electronics connectivity snapdragon consumer iot snapdragon industrial iot snapdragon mobile snapdragon voice music snapdragon wearables (3) | ↑16 | ||||
| 5 | ibm | 30 | 1 | 1 | spectrum control standard edition (4) · api connect (3) · bigfix platform (3) | ↓1 | ||
| 6 | cybozu | 20 | cybozu garoon (20) | · | ||||
| 7 | 17 | 3 | chrome (17) | · | ||||
| 8 | siemens | 13 | simatic pcs 7 v8 0 and earlier (4) · simatic wincc v7 2 and earlier (4) · logo 8 bm incl siplus variants (3) | ↑5 | ||||
| 9 | jenkins project | 12 | jenkins artifactory plugin (4) · jenkins warnings ng plugin (2) · jenkins credentials plugin (1) | ↓6 | ||||
| 10 | apache | 10 | 5 | apache jspwiki (3) · apache axis 1 4 (1) · apache camel (1) | ↑2 | |||
| 11 | qualcomm technologies | 10 | snapdragon automobile snapdragon mobile snapdragon wear (6) · snapdragon mobile (2) · small cell soc snapdragon mobile snapdragon wear (1) | new | ||||
| 12 | f5 | 9 | big ip ltm aam afm analytics apm asm dns edge gateway fps gtm link controller pem webaccelerator (6) · big ip ltm aam afm analytics apm asm dns edge gateway gtm link controller pem webaccelerator websafe (1) · big ip ltm aam afm apm asm dns gtm link controller pem (1) | ↑34 | ||||
| 13 | atlassian | 7 | 1 | jira (7) | ↑21 | |||
| 14 | 7 | 1 | 1 | facebook thrift (5) · whatsapp business for android (2) · whatsapp for android (2) | ↑22 | |||
| 15 | fortinet | 7 | 1 | fortinet forticlient for windows (3) · fortianalyzer (1) · forticlientwindows (1) | ↑11 | |||
| 16 | sap se | 7 | sap businessobjects business intelligence platform (1) · sap businessobjects business intelligence platform central management server (1) · sap e commerce sap crmjav sap crmweb sap shrweb sap shrjav sap crmapp sap shrapp (1) | ↑5 | ||||
| 17 | bosch | 6 | smart home controller (6) | new | ||||
| 18 | nvidia | 5 | nvidia gpu display driver (3) · nvidia geforce experience (1) · tegra tlk widevine trust application (1) | ↑13 | ||||
| 19 | intel | 4 | central processing units cpus (3) · central proccve 2018 12126essing units cpus (1) | · | ||||
| 20 | netapp | 3 | oncommand insight (1) · oncommand unified manager 7 mode (1) · oncommand unified manager for vmware vsphere linux and windows 7 2 and above (1) | ↑61 | ||||
| 21 | printerlogic | 3 | management software (3) | new | ||||
| 22 | redhat | 3 | wildfly (2) · enterprise linux (1) · fedora (1) | ↓5 | ||||
| 23 | tibco software | 3 | 1 | tibco spotfire analytics platform for aws marketplace (2) · tibco spotfire server (2) · tibco spotfire statistics services (1) | ↓5 | |||
| 24 | bluecats | 2 | reveal (2) | new | ||||
| 25 | ca technologies a broadcom | 2 | ca risk authentication (2) · ca strong authentication (2) | · | ||||
| 26 | curl | 2 | curl (2) | · | ||||
| 27 | emerson | 2 | emerson ovation ocr400 controller (2) | · | ||||
| 28 | hpe | 2 | hpe virtual connect se 16gb fibre channel module for hpe synergy (1) · nonstop safegaurd and nonstop h series stdsec standard security product (1) | · | ||||
| 29 | mcafee | 2 | mcafee endpoint security ens (1) · mcafee network security manager nsm (1) | ↑49 | ||||
| 30 | ministry of internal affairs and communications | 2 | electronic reception and examination of application for radio licenses offline (1) · installer of electronic reception and examination of application for radio licenses online (1) | new | ||||
| 31 | php group | 2 | php (1) · php imagick extension (1) | ↑23 | ||||
| 32 | rockwell automation | 2 | armor compact guardlogix 5370 controllers (2) · compact guardlogix 5370 controllers (2) · compactlogix 5370 l1 controllers (2) | ↑24 | ||||
| 33 | rsa | 2 | 1 | rsa netwitness platform (2) · rsa security analytics (1) | · | |||
| 34 | spring | 2 | 1 | spring boot (1) · spring cloud config (1) | ↑60 | |||
| 35 | aveva | 1 | aveva vijeo citect and citectscada (1) | ↑27 | ||||
| 36 | axios | 1 | 1 | axios (1) | new | |||
| 37 | create s d co | 1 | create sd official app for android (1) | new | ||||
| 38 | dell emc | 1 | recoverpoint (1) | ↓22 | ||||
| 39 | document foundation | 1 | libreoffice (1) | new | ||||
| 40 | east japan railway | 1 | jr east japan train operation information push notification app for android (1) | new | ||||
| 41 | eaton | 1 | halo home (1) | · | ||||
| 42 | fedoraproject | 1 | enterprise linux (1) · fedora (1) · freeradius (1) | new | ||||
| 43 | freeradius | 1 | enterprise linux (1) · fedora (1) · freeradius (1) | new | ||||
| 44 | kie | 1 | kie server (1) | new | ||||
| 45 | lenovo | 1 | lenovo xclarity administrator (1) | ↓7 | ||||
| 46 | libvirt | 1 | libvirt (1) | · | ||||
| 47 | mitsubishi electric | 1 | melsec q series ethernet module (1) | · | ||||
| 48 | mozilla | 1 | network security services nss (1) | ↓42 | ||||
| 49 | nanosvg library | 1 | nanosvg (1) | new | ||||
| 50 | netiq | 1 | identity manager (1) | · |
One CVE is counted once per vendor, product or weakness class it lists, so a ranking column sums to more than the month's total. Only the month's top 100 keys per dimension are stored. The KEV column counts CVEs published in 2019-05 that are on the CISA KEV catalog today. The 0 in the headline is what CISA listed during the month, whenever those CVEs were published. All 50 ranked vendors are listed; a zero count renders as a dot.
Weaknesses
CWE classes by distinct CVEs
- 1CWE-20160 critical↑1
- 2CWE-284111 critical↓1
- 3CWE-78112 critical↑5
- 4CWE-77100 critical↑17
- 5CWE-2291 critical↑1
- 6CWE-40090 critical↑1
- 7CWE-20080 critical↓3
- 8CWE-7980 critical↓5
- 9CWE-34770 critical·
- 10CWE-11960 critical↑12
- 1CWE-26450 critical·
- 2CWE-35250 critical↑1
- 3CWE-83450 criticalnew
- 4CWE-8951 critical↑24
- 5CWE-39940 critical↓1
- 6CWE-50241 critical·
- 7CWE-92240 critical·
- 8CWE-12130 critical↓9
- 9CWE-26630 critical↑31
- 10CWE-28731 critical↓15
One CVE is counted once per vendor, product or weakness class it lists, so a ranking column sums to more than the month's total. Only the month's top 100 keys per dimension are stored.