Month report
September 2019
Rolled up 2026-08-09 20:45 from 370,662 CVE records
1,531 CVEs published, +31% on the same month last year. 16 rated critical, 0 listed by CISA as exploited. microsoft led with 82; the most common weakness class was CWE-20 (12). the eclipse foundation climbed 46 places, the largest move. 11 vendors ranked for the first time.
Published
1,531
-23.5%on the previous month
Critical / high
16 / 48
of the 157 scored
Medium / low
88 / 5
the rest of the scored bands
Added to CISA KEV
0
listed as exploited this month
Public exploit
86
exploit code indexed publicly
Scanner template
0
0% of the month
Publication to KEV
How long before CISA listed them
11 published this month and listed since — not the 0 listed during it.
Median days to listing
790
from publication to CISA's date added
Listed within 7 days
0%
of the 11
Listed within 30 days
0%
of the 11
Weakness × vendor
Where the two overlap
CVEs carrying both. Each row is shaded against its own worst class.
| Vendor | CWE-20 | CWE-79 | CWE-78 | CWE-284 | CWE-121 | CWE-476 | CWE-77 | CWE-119 |
|---|---|---|---|---|---|---|---|---|
| microsoft | 1 | |||||||
| jenkins project | ||||||||
| cisco | 9 | 3 | 2 | 2 | 2 | 3 | ||
| ibm | ||||||||
| mozilla | ||||||||
| dell | 1 | 2 | 1 | |||||
| qualcomm | ||||||||
| schneider electric se | 1 | 1 |
Vendors
Ranked by distinct CVEs this month
Δ is the move against last month's rank.
| # | Vendor | Top products | ||||||
|---|---|---|---|---|---|---|---|---|
| 1 | microsoft | 82 | 5 | 8 | windows (49) · windows server (47) · windows 10 version 1903 for x64 based systems (46) | ↑1 | ||
| 2 | jenkins project | 39 | 1 | jenkins (6) · jenkins script security plugin (4) · jenkins project inheritance plugin (3) | ↑3 | |||
| 3 | cisco | 38 | 1 | cisco ios xe software (5) · cisco ios xe software 3 2 11asg (5) · cisco hyperflex hx series (2) | — | |||
| 4 | ibm | 31 | websphere application server (8) · websphere extreme scale (4) · security key lifecycle manager (3) | — | ||||
| 5 | mozilla | 22 | firefox (20) · firefox esr (16) · thunderbird (8) | · | ||||
| 6 | dell | 20 | 1 | 1 | rsa bsafe mes (5) · rsa bsafe crypto c micro edition (4) · rsa identity governance and lifecycle (4) | ↑19 | ||
| 7 | qualcomm | 19 | snapdragon auto snapdragon compute snapdragon consumer iot snapdragon industrial iot snapdragon iot snapdragon mobile snapdragon voice music snapdragon wearables (3) · snapdragon auto snapdragon compute snapdragon consumer iot snapdragon industrial iot snapdragon mobile snapdragon voice music snapdragon wearables (3) · snapdragon auto snapdragon compute snapdragon connectivity snapdragon consumer iot snapdragon industrial iot snapdragon mobile snapdragon voice music snapdragon wearables (2) | · | ||||
| 8 | schneider electric se | 13 | modicon m580 (4) · modicon m340 (3) · bmxnor0200h ethernet serial rtu module (2) | · | ||||
| 9 | atlassian | 10 | 2 | jira (7) · bitbucket data center (1) · bitbucket server (1) | ↓3 | |||
| 10 | sap se | 9 | sap hana extended application services (2) · sap business one client (1) · sap businessobjects business intelligence platform cmc (1) | ↓3 | ||||
| 11 | apache | 8 | 2 | ofbiz (4) · apache tapestry (2) · solr (1) | ↓2 | |||
| 12 | micro focus | 8 | service manager (8) | ↑9 | ||||
| 13 | adobe | 7 | cold fusion (3) · flash player (3) · application manager (1) | ↓12 | ||||
| 14 | lenovo | 6 | xclarity administrator lxca (4) · system update (1) · thinkagile cp sb (1) | ↑14 | ||||
| 15 | siemens | 6 | sinema remote connect server (4) · ie wsn pa link wirelesshart gateway (1) · simatic tdc cp51m1 (1) | ↓2 | ||||
| 16 | the eclipse foundation | 5 | eclipse mosquitto (2) · eclipse omr (2) · eclipse paho (1) | ↑46 | ||||
| 17 | dahua technology | 4 | ipc hdw1x2x ipc hfw1x2x ipc hdw2x2x ipc hfw2x2x ipc hdw4x2x ipc hfw4x2x ipc hdbw4x2x ipc hdw5x2x ipc hfw5x2x (4) | new | ||||
| 18 | inc | 4 | cybozu garoon (4) | new | ||||
| 19 | linux | 4 | kernel (3) · linux kernel (1) | · | ||||
| 20 | mcafee | 4 | mcafee web gateway mwg (2) · mcafee total protection free antivirus trial (1) · web gateway mwg (1) | ↓3 | ||||
| 21 | vmware | 4 | vcenter server (2) · vmware esxi (1) · vmware fusion (1) | · | ||||
| 22 | artifex software | 3 | 1 | ghostscript (3) | · | |||
| 23 | cloud foundry | 3 | uaa release oss (2) · cf deployment (1) · cf nfs volume release (1) | ↑1 | ||||
| 24 | dell emc | 3 | dell client platforms dell update packages dup framework file (1) · dell emc enterprise copy data management ecdm (1) · dell emc servers all other drivers bios and firmware dell update package dup framework file (1) | ↑20 | ||||
| 25 | delta electronics | 3 | tpeditor (3) | · | ||||
| 26 | document foundation | 3 | libreoffice (3) | — | ||||
| 27 | 3 | hhvm (2) · whatsapp for android (1) · whatsapp for ios (1) | ↑20 | |||||
| 28 | gigastone | 3 | smart battery a4 (2) · smart battery a2 25de (1) | new | ||||
| 29 | openssl | 3 | openssl (3) | · | ||||
| 30 | talos | 3 | 2 | aspose (2) · aspose pdf for c (1) | · | |||
| 31 | bosch | 2 | 1 | access professional edition (2) | ↑11 | |||
| 32 | f5 networks | 2 | big ip asm (1) · big ip enterprise manager (1) | · | ||||
| 33 | hikari denwa router home gateway provided by nippon telegraph and telephone east | 2 | hikari denwa router home gateway (2) | new | ||||
| 34 | hikari denwa router home gateway provided by nippon telegraph and telephone west | 2 | hikari denwa router home gateway (2) | new | ||||
| 35 | netgear | 2 | n300 wnr2000v5 (2) | · | ||||
| 36 | netskope | 2 | netskope client (2) | new | ||||
| 37 | tibco software | 2 | 2 | tibco enterprise runtime for r server edition (2) · tibco spotfire analytics platform for aws marketplace (2) | ↓5 | |||
| 38 | advantech | 1 | webaccess scada (1) | · | ||||
| 39 | apng drawable | 1 | 1 0 0 to 1 6 0 (1) | new | ||||
| 40 | ca technologies | 1 | 1 | client automation (1) · workload automation ae (1) | · | |||
| 41 | category specific rss feed subscription | 1 | version v2 0 and earlier (1) | new | ||||
| 42 | cve 2019 6813 | 1 | bmxnor0200h ethernet serial rtu module (1) · modicon m340 controller (1) | new | ||||
| 43 | cve 2019 6837 | 1 | u motion server (1) | new | ||||
| 44 | cybozu | 1 | cybozu garoon (1) | · | ||||
| 45 | dahua | 1 | ipc hdw1x2x ipc hfw1x2x ipc hdw2x2x ipc hfw2x2x ipc hdw4x2x ipc hfw4x2x ipc hdbw4x2x ipc hdw5x2x ipc hfw5x2x (1) | · | ||||
| 46 | forcepoint | 1 | forcepoint vpn client for windows (1) | ↑2 | ||||
| 47 | fuji xerox co | 1 | apeosware management suite and apeosware management suite 2 (1) | · | ||||
| 48 | gmbh | 1 | 3s smart software solutions gmbh codesys v3 opc ua server (1) | new | ||||
| 49 | honeywell | 1 | performance ip cameras (1) · performance nvrs (1) | · | ||||
| 50 | line | 1 | line android (1) | · |
One CVE is counted once per vendor, product or weakness class it lists, so a ranking column sums to more than the month's total. Only the month's top 100 keys per dimension are stored. The KEV column counts CVEs published in 2019-09 that are on the CISA KEV catalog today. The 0 in the headline is what CISA listed during the month, whenever those CVEs were published. All 50 ranked vendors are listed; a zero count renders as a dot.
Weaknesses
CWE classes by distinct CVEs
- 1CWE-20120 critical—
- 2CWE-79100 critical↑6
- 3CWE-7893 critical↑1
- 4CWE-28472 critical↑3
- 5CWE-12160 critical↑7
- 6CWE-47660 critical↑25
- 7CWE-7760 critical↑63
- 8CWE-11950 critical↓5
- 9CWE-2250 critical↑35
- 10CWE-41652 critical↑7
- 1CWE-75450 critical·
- 2CWE-78751 critical↑6
- 3CWE-12241 critical↑27
- 4CWE-20040 critical↓1
- 5CWE-24840 critical·
- 6CWE-28540 critical↓6
- 7CWE-39940 critical↑12
- 8CWE-12530 critical↓13
- 9CWE-30731 critical↑32
- 10CWE-31030 critical↑32
One CVE is counted once per vendor, product or weakness class it lists, so a ranking column sums to more than the month's total. Only the month's top 100 keys per dimension are stored.