Month report
May 2020
Rolled up 2026-08-09 20:45 from 370,662 CVE records
1,017 CVEs published, -22.7% on the same month last year. 33 rated critical, 0 listed by CISA as exploited. microsoft led with 112; the most common weakness class was CWE-79 (23). simpleledger climbed 61 places, the largest move. 9 vendors ranked for the first time.
Published
1,017
Critical / high
33 / 149
Medium / low
157 / 22
Added to CISA KEV
0
Public exploit
66
Scanner template
0
Publication to KEV
How long before CISA listed them
Median days to listing
616
Listed within 7 days
0%
Listed within 30 days
0%
Vendors
Ranked by distinct CVEs this month
| # | Vendor | Top products | ||||||
|---|---|---|---|---|---|---|---|---|
| 1 | microsoft | 112 | 1 | 4 | windows 10 version 1903 for x64 based systems (78) · windows 10 version 1909 (78) · windows server version 1903 server core installation (78) | ↑1 | ||
| 2 | ibm | 58 | 3 | 3 | 3 | i2 analysts notebook (15) · spectrum scale (9) · security identity governance and intelligence (8) | ↑2 | |
| 3 | cisco | 43 | 2 | 1 | 1 | cisco firepower threat defense software (13) · cisco adaptive security appliance asa software (12) · cisco firepower management center (6) | ↑8 | |
| 4 | 36 | 1 | chrome (35) · google earth pro (1) | ↑4 | ||||
| 5 | palo alto networks | 24 | 1 | pan os (23) · globalprotect app (1) | ↑16 | |||
| 6 | freerdp | 21 | 1 | freerdp (21) | · | |||
| 7 | sap se | 19 | 4 | sap adaptive server enterprise (3) · sap business objects business intelligence platform (2) · sap adaptive server enterprise backup server (1) | — | |||
| 8 | redhat | 16 | keycloak (5) · ansible (3) · kernel (2) | ↑10 | ||||
| 9 | mozilla | 13 | firefox (11) · firefox esr (7) · thunderbird (6) | ↑7 | ||||
| 10 | dell | 11 | rsa archer (7) · isilon onefs (2) · cpg bios (1) | ↑13 | ||||
| 11 | mcafee | 11 | mcafee active response mar for linux (1) · mcafee active response mar for mac (1) · mcafee active response mar for windows (1) | ↑4 | ||||
| 12 | zephyrproject rtos | 11 | 1 | zephyr (11) | new | |||
| 13 | jenkins project | 9 | jenkins amazon ec2 plugin (4) · jenkins credentials binding plugin (2) · jenkins copy artifact plugin (1) | ↑4 | ||||
| 14 | huawei | 8 | e6878 370 (2) · huawei mate 20 (2) · anne al00 (1) | — | ||||
| 15 | glpi project | 7 | 2 | glpi (7) | new | |||
| 16 | typo3 | 6 | typo3 cms (6) | · | ||||
| 17 | raonwiz | 4 | dext ocx activex control in dext5 upload (3) · k upload (1) | new | ||||
| 18 | six apart | 4 | movable type (4) | · | ||||
| 19 | tobesoft | 4 | xplatform (3) · nexacro14 (1) | · | ||||
| 20 | trend micro | 4 | 3 | trend micro interscan web security virtual appliance (4) | · | |||
| 21 | canonical | 3 | 1 | pulseaudio (1) · subiquity (1) · unity8 ubuntu (1) | ↓2 | |||
| 22 | cybozu | 3 | android app kintone mobile for android (1) · android app mailwise for android (1) · cybozu desktop for windows (1) | ↓2 | ||||
| 23 | debian | 3 | netqmail (2) · apt (1) | · | ||||
| 24 | silver peak systems | 3 | 1 unity edgeconnect nx vx 2 unity orchestrator 3 edgeconnect in aws azure gcp (3) | new | ||||
| 25 | vmware | 3 | vmware fusion (3) · vmware esxi (2) · vmware workstation (2) | ↑23 | ||||
| 26 | bluetooth | 2 | 1 | br edr (1) · le (1) | · | |||
| 27 | eaton | 2 | intelligent power manager ipm (2) | · | ||||
| 28 | isc | 2 | 1 | bind9 (2) | · | |||
| 29 | johnson controls | 2 | 1 | american dynamics victor video management system v5 2 (1) · kantech entrapass security management software corporate edition versions 8 22 and prior (1) · kantech entrapass security management software global edition versions 8 22 and prior (1) | · | |||
| 30 | kaoni | 2 | ezhttptrans (2) | new | ||||
| 31 | kata containers | 2 | kata containers (2) | new | ||||
| 32 | lenovo | 2 | printer lj4010dn (2) | ↓8 | ||||
| 33 | linux | 2 | kernel (2) | ↑10 | ||||
| 34 | mongodb | 2 | mongodb ops manager (1) · mongodb server (1) | ↑46 | ||||
| 35 | nvidia | 2 | graphics drivers (2) | · | ||||
| 36 | opensuse | 2 | open build service (2) | ↓5 | ||||
| 37 | puma | 2 | 1 | puma (2) | · | |||
| 38 | simpleledger | 2 | slp validate (1) · slpjs (1) | ↑61 | ||||
| 39 | spring by vmware | 2 | spring security (2) | · | ||||
| 40 | tibco software | 2 | 1 | tibco jasperreports server (2) · tibco jasperreports server for activematrix bpm (2) · tibco jasperreports server for aws marketplace (2) | · | |||
| 41 | abb | 1 | abb device library wizard (1) | ↓35 | ||||
| 42 | alsong | 1 | estsoft (1) | new | ||||
| 43 | anchore | 1 | anchore engine (1) | new | ||||
| 44 | apache | 1 | 1 | 1 | kylin (1) | ↓31 | ||
| 45 | barrelstrength | 1 | sprout forms (1) | new | ||||
| 46 | bitdefender | 1 | 1 | bitdefender engines (1) | ↓9 | |||
| 47 | bookstackapp | 1 | bookstack (1) | · | ||||
| 48 | bosch | 1 | 1 | bosch recording station (1) | · | |||
| 49 | drupal | 1 | drupal core (1) | · | ||||
| 50 | 1 | proxygen (1) | ↓12 |
One CVE is counted once per vendor, product or weakness class it lists, so a ranking column sums to more than the month's total. Only the month's top 100 keys per dimension are stored. The KEV column counts CVEs published in 2020-05 that are on the CISA KEV catalog today. The 0 in the headline is what CISA listed during the month, whenever those CVEs were published. All 50 ranked vendors are listed; a zero count renders as a dot.
Weaknesses
CWE classes by distinct CVEs
- 1CWE-79230 critical—
- 2CWE-20222 critical—
- 3CWE-125180 critical↑2
- 4CWE-284132 critical↑2
- 5CWE-274110 critical·
- 6CWE-78113 critical↑12
- 7CWE-119100 critical↑19
- 8CWE-19091 critical↑52
- 9CWE-40090 critical↑5
- 10CWE-20081 critical↓6
- 1CWE-60170 critical↑23
- 2CWE-2251 critical↑1
- 3CWE-28752 critical↑6
- 4CWE-34750 critical↑67
- 5CWE-49450 critical↑77
- 6CWE-12041 critical·
- 7CWE-28540 critical↑24
- 8CWE-29540 critical↑24
- 9CWE-42740 critical↑70
- 10CWE-69740 critical·
One CVE is counted once per vendor, product or weakness class it lists, so a ranking column sums to more than the month's total. Only the month's top 100 keys per dimension are stored.