Month report
June 2019
Rolled up 2026-08-09 20:45 from 370,662 CVE records
1,244 CVEs published, -30.2% on the same month last year. 21 rated critical, 0 listed by CISA as exploited. microsoft led with 88; the most common weakness class was CWE-416 (16). synology climbed 47 places, the largest move. 8 vendors ranked for the first time.
Published
1,244
-5.5%on the previous month
Critical / high
21 / 114
of the 315 scored
Medium / low
162 / 18
the rest of the scored bands
Added to CISA KEV
0
listed as exploited this month
Public exploit
100
exploit code indexed publicly
Scanner template
0
0% of the month
Publication to KEV
How long before CISA listed them
8 published this month and listed since — not the 0 listed during it.
Median days to listing
979
from publication to CISA's date added
Listed within 7 days
0%
of the 8
Listed within 30 days
0%
of the 8
Vendors
Ranked by distinct CVEs this month
Δ is the move against last month's rank.
| # | Vendor | Top products | ||||||
|---|---|---|---|---|---|---|---|---|
| 1 | microsoft | 88 | 2 | 10 | windows 10 version 1809 (47) · windows server 2019 (47) · windows server 2019 server core installation (47) | ↑2 | ||
| 2 | 74 | 1 | 5 | chrome (74) | ↑5 | |||
| 3 | ibm | 66 | rational collaborative lifecycle management (13) · security access manager (9) · cognos controller (5) | ↑2 | ||||
| 4 | cisco | 38 | 3 | 5 | cisco unified computing system management software (7) · cisco data center network manager (4) · cisco rv130w wireless n multifunction vpn router firmware (4) | ↓2 | ||
| 5 | foxit | 28 | reader (18) · studio photo (6) · phantompdf (4) | · | ||||
| 6 | qualcomm | 27 | snapdragon auto snapdragon compute snapdragon connectivity snapdragon consumer electronics connectivity snapdragon consumer iot snapdragon industrial iot snapdragon iot snapdragon mobile snapdragon voice music snapdragon wearables snapdragon wired infrastructure and networking (4) · snapdragon auto snapdragon compute snapdragon connectivity snapdragon consumer iot snapdragon industrial iot snapdragon mobile snapdragon voice music snapdragon wearables (3) · snapdragon auto snapdragon consumer iot snapdragon industrial iot snapdragon mobile (3) | ↓2 | ||||
| 7 | huawei | 20 | mate 9 pro (2) · p20 (2) · p30 p30 pro (2) | new | ||||
| 8 | android | 12 | android (12) | · | ||||
| 9 | sap se | 11 | 1 | sap netweaver process integration sap xiesr (3) · sap netweaver process integration sap xitool (3) · sap businessobjects business intelligence platform administration console (1) | ↑7 | |||
| 10 | redhat | 10 | cloudforms (2) · keycloak (2) · picketlink (2) | ↑12 | ||||
| 11 | jenkins project | 9 | jenkins electricflow plugin (6) · jenkins jx resources plugin (2) · jenkins token macro plugin (1) | ↓2 | ||||
| 12 | fortinet | 8 | 2 | 2 | 2 | fortinet fortios (4) · fortinet fortios and fortiproxy (2) · fortinet fortios fortiproxy (2) | ↑3 | |
| 13 | siemens | 8 | siveillance vms 2017 r2 (3) · siveillance vms 2018 r1 (3) · siveillance vms 2018 r2 (3) | ↓5 | ||||
| 14 | synology | 7 | calendar (2) · photo station (2) · note station (1) | ↑47 | ||||
| 15 | 6 | whatsapp business for android (3) · whatsapp for android (3) · whatsapp business for ios (2) | ↓1 | |||||
| 16 | webaccess | 6 | webaccess scada (6) | new | ||||
| 17 | apache | 5 | apache http server (3) · apache fineract (2) | ↓7 | ||||
| 18 | lenovo | 5 | service bridge (4) · system update (1) | ↑27 | ||||
| 19 | mcafee | 5 | mcafee enterprise security manager esm (5) | ↑10 | ||||
| 20 | zte | 5 | 2 | zte mf920 (2) · zte wf820 lte outdoor cpe (2) · netnumen dap (1) | · | |||
| 21 | adobe | 4 | 1 | coldfusion (3) · adobe flash player (1) | ↓20 | |||
| 22 | atlassian | 4 | 1 | 1 | 1 | bitbucket data center (1) · crowd (1) · jira (1) | ↓9 | |
| 23 | linux | 4 | 1 | linux kernel (3) · kernel (1) | · | |||
| 24 | micro focus | 4 | micro focus netiq self service password reset (2) · micro focus fortify software security center server (1) · solutions business manager (1) | · | ||||
| 25 | bitdefender | 3 | safepay (3) | · | ||||
| 26 | dell emc | 3 | 1 | openmanage server administrator (2) · avamar (1) | ↑12 | |||
| 27 | moodle | 3 | moodle (3) | · | ||||
| 28 | php group | 3 | php (3) | ↑3 | ||||
| 29 | quest kace | 3 | 3 | k1000 appliance (3) | new | |||
| 30 | samsung | 3 | 2 | galaxy s9 (3) | · | |||
| 31 | spring | 3 | 1 | spring data jpa (1) · spring security (1) · spring security oauth (1) | ↑3 | |||
| 32 | check point | 2 | check point endpoint security client for windows anti malware blade (1) · check point endpoint security client for windows vpn blade (1) | · | ||||
| 33 | cloud foundry | 2 | bosh (1) · uaa release oss (1) | · | ||||
| 34 | hp | 2 | 1 | hp support assistant (2) | · | |||
| 35 | oaklouds | 2 | mailsherlock msr35 (2) · mailsherlock msr45 (2) | · | ||||
| 36 | panasonic | 2 | fpwin pro (2) | · | ||||
| 37 | talos | 2 | 1 | kcodes (2) | ↑25 | |||
| 38 | vmware | 2 | vmware tools for windows (1) · vmware workstation (1) | · | ||||
| 39 | dell | 1 | dell supportassist for business pcs (1) · dell supportassist for home pcs (1) | · | ||||
| 40 | exacq technologies | 1 | exacqvision enterprise system manager esm (1) | new | ||||
| 41 | exim | 1 | 1 | 1 | 1 | exim (1) | new | |
| 42 | kubevirt | 1 | containerized data importer (1) | new | ||||
| 43 | malwarebytes | 1 | antimalware (1) | · | ||||
| 44 | medtronic | 1 | minimed 508 pump (1) · minimed paradigm 511 pump (1) · minimed paradigm 512 712 pumps (1) | · | ||||
| 45 | netflix | 1 | dial reference source code repo https github com netflix dial reference (1) | new | ||||
| 46 | nvidia | 1 | nvidia vibrante linux (1) | ↓28 | ||||
| 47 | oracle | 1 | 1 | 1 | weblogic server (1) | ↑6 | ||
| 48 | pivotal | 1 | pivotal ops manager (1) | · | ||||
| 49 | postgresql | 1 | postgresql (1) | · | ||||
| 50 | python | 1 | 1 | python (1) | new |
One CVE is counted once per vendor, product or weakness class it lists, so a ranking column sums to more than the month's total. Only the month's top 100 keys per dimension are stored. The KEV column counts CVEs published in 2019-06 that are on the CISA KEV catalog today. The 0 in the headline is what CISA listed during the month, whenever those CVEs were published. All 50 ranked vendors are listed; a zero count renders as a dot.
Weaknesses
CWE classes by distinct CVEs
- 1CWE-416160 critical↑32
- 2CWE-787111 critical↑35
- 3CWE-79100 critical↑5
- 4CWE-28491 critical↓2
- 5CWE-28580 critical↑26
- 6CWE-12560 critical↑21
- 7CWE-2060 critical↓6
- 8CWE-35260 critical↑4
- 9CWE-7861 critical↓6
- 10CWE-12151 critical↑8
- 1CWE-26451 critical—
- 2CWE-12241 critical↑14
- 3CWE-30640 critical↑9
- 4CWE-20031 critical↓7
- 5CWE-2231 critical↓10
- 6CWE-25030 critical↑27
- 7CWE-34530 critical·
- 8CWE-35630 critical·
- 9CWE-5930 critical·
- 10CWE-60130 critical↑38
One CVE is counted once per vendor, product or weakness class it lists, so a ranking column sums to more than the month's total. Only the month's top 100 keys per dimension are stored.