Month report
July 2020
Rolled up 2026-08-09 20:45 from 370,662 CVE records
1,417 CVEs published, -12.4% on the same month last year. 77 rated critical, 0 listed by CISA as exploited. oracle led with 213; the most common weakness class was CWE-78 (46). huawei climbed 44 places, the largest move. 11 vendors ranked for the first time.
Published
1,417
-21.6%on the previous month
Critical / high
77 / 211
of the 587 scored
Medium / low
270 / 29
the rest of the scored bands
Added to CISA KEV
0
listed as exploited this month
Public exploit
90
exploit code indexed publicly
Scanner template
0
0% of the month
Publication to KEV
How long before CISA listed them
16 published this month and listed since — not the 0 listed during it.
Median days to listing
481
from publication to CISA's date added
Listed within 7 days
0%
of the 16
Listed within 30 days
0%
of the 16
Weakness × vendor
Where the two overlap
CVEs carrying both. Each row is shaded against its own worst class.
| Vendor | CWE-78 | CWE-79 | CWE-20 | CWE-89 | CWE-284 | CWE-22 | CWE-306 | CWE-400 |
|---|---|---|---|---|---|---|---|---|
| oracle | ||||||||
| microsoft | 4 | 2 | ||||||
| ibm | ||||||||
| cisco | 2 | 6 | 7 | 4 | 1 | 2 | 3 | 1 |
| centos web panel | 26 | 12 | ||||||
| adobe | ||||||||
| jenkins project |
Vendors
Ranked by distinct CVEs this month
Δ is the move against last month's rank.
| # | Vendor | Top products | ||||||
|---|---|---|---|---|---|---|---|---|
| 1 | oracle | 213 | 11 | 1 | 4 | mysql server (33) · vm virtualbox (25) · weblogic server (17) | · | |
| 2 | microsoft | 125 | 2 | 3 | 4 | windows server (88) · windows 10 version 1903 for 32 bit systems (87) · windows 10 version 1903 for arm64 based systems (87) | ↓1 | |
| 3 | ibm | 54 | 1 | 2 | verify gateway ivg (8) · db2 for linux unix and windows (6) · mq appliance (5) | ↑2 | ||
| 4 | cisco | 52 | 9 | 1 | 1 | cisco sd wan vmanage (13) · cisco data center network manager (12) · cisco rv130w wireless n multifunction vpn router firmware (4) | ↓1 | |
| 5 | centos web panel | 39 | 27 | centos web panel (39) | new | |||
| 6 | adobe | 34 | magento (6) · adobe acrobat and reader (5) · adobe photoshop (5) | ↓4 | ||||
| 7 | 31 | 4 | chrome (30) · wpantund (1) | ↑1 | ||||
| 8 | jenkins project | 28 | jenkins (4) · jenkins fortify on demand plugin (3) · jenkins matrix project plugin (2) | ↑5 | ||||
| 9 | mozilla | 26 | firefox (23) · thunderbird (11) · firefox esr (10) | · | ||||
| 10 | atlassian | 25 | 1 | jira server (11) · jira server and data center (9) · bitbucket server (2) | ↓3 | |||
| 11 | siemens | 18 | sicam mmu (9) · sicam sgu (9) · sicam t (9) | ↑18 | ||||
| 12 | qualcomm | 16 | snapdragon auto snapdragon compute snapdragon mobile snapdragon wired infrastructure and networking (3) · snapdragon auto snapdragon compute snapdragon consumer electronics connectivity snapdragon consumer iot snapdragon industrial iot snapdragon mobile snapdragon voice music snapdragon wearables (2) · snapdragon auto snapdragon compute snapdragon consumer iot snapdragon industrial iot snapdragon mobile snapdragon voice music snapdragon wearables (2) | ↓6 | ||||
| 13 | juniper networks | 15 | 2 | junos os (14) · junos os evolved (3) · junos space (1) | · | |||
| 14 | sap se | 14 | 1 | 1 | 2 | sap disclosure management (5) · sap netweaver as java lm configuration wizard (2) · sap business objects business intelligence platform bi launchpad (1) | ↓2 | |
| 15 | huawei | 11 | ips module (4) · ngfw module (4) · secospace usg6300 (4) | ↑44 | ||||
| 16 | dell | 10 | 2 | 1 | omimssc openmanage integration for microsoft system center (2) · data protection advisor (1) · dell open manage server administrator (1) | ↑7 | ||
| 17 | mitsubishi electric | 10 | got2000 series gt27 gt25 and gt23 (6) · genbroker32 (4) · genbroker64 platform services workbench frameworx server (4) | ↑15 | ||||
| 18 | netgear | 10 | 3 | r6700 (10) | · | |||
| 19 | prestashop | 8 | prestashop (7) · dashproducts (1) | · | ||||
| 20 | open source | 7 | 1 | openclinic ga (7) | new | |||
| 21 | apache | 5 | 1 | 2 | apache airflow (5) | ↑5 | ||
| 22 | c more | 5 | 2 | hmi ea9 (5) | new | |||
| 23 | kubernetes | 5 | 2 | kubernetes (4) · ingress nginx (1) | ↑43 | |||
| 24 | mcafee | 5 | 1 | mcafee total protection mtp (3) · mcafee web gateway mwg (1) · network security management nsm (1) | ↓6 | |||
| 25 | d link | 4 | dap 1860 (1) · dir 842 (1) · dsl 7740c (1) | · | ||||
| 26 | electron | 4 | electron (4) | · | ||||
| 27 | iconics | 4 | genbroker32 (4) · genbroker64 platform services workbench frameworx server (4) · mc works32 (4) | · | ||||
| 28 | palo alto networks | 4 | 1 | pan os (4) | ↓7 | |||
| 29 | rockwell automation | 4 | 1 | 3 | factorytalk view se (4) | · | ||
| 30 | tobesoft | 4 | nexacro14 17 excommonapiv13 (2) · miplatform 320 320u 330 330u (1) · xplatform (1) | · | ||||
| 31 | canonical | 3 | snapd (2) · core (1) · trust store ubuntu (1) | · | ||||
| 32 | humantalk | 3 | davieindy (3) | new | ||||
| 33 | kujirahand | 3 | konawiki (3) | new | ||||
| 34 | phoenix contact | 3 | automation worx (2) · automation worx express (2) · plcnext engineer (1) | · | ||||
| 35 | phpzag | 3 | phpzag live add edit delete data tables records with ajax php mysql (3) | new | ||||
| 36 | the eclipse foundation | 3 | 1 | eclipse jetty (1) · eclipse openj9 (1) · eclipse web tools platform (1) | · | |||
| 37 | ubuntu | 3 | grub2 in ubuntu (3) | · | ||||
| 38 | ufactory | 3 | 3 | xarm5 lite xarm 6 and xarm 7 (2) · xarm 5 lite xarm 6 and xarm 7 (1) | new | |||
| 39 | vmware tanzu | 3 | 1 | vmware gemfire (2) · vmware tanzu gemfire for vms (2) · operations manager (1) | new | |||
| 40 | abb | 2 | 2 | irb140 (2) | · | |||
| 41 | elastic | 2 | kibana (2) | ↓21 | ||||
| 42 | faye | 2 | faye (1) · faye websocket (1) | · | ||||
| 43 | grundfos | 2 | cim 500 (2) | new | ||||
| 44 | lenovo | 2 | drivers management (2) | ↓27 | ||||
| 45 | october cms | 2 | october (2) | new | ||||
| 46 | osisoft | 2 | pi data archive (1) · pi vision (1) | · | ||||
| 47 | redhat | 2 | wildfly (2) | ↓28 | ||||
| 48 | schokokeksorg | 2 | freewvs (2) | new | ||||
| 49 | simpleledger | 2 | slp validate js (1) · slpjs (1) | · | ||||
| 50 | sonicwall | 2 | sonicos (1) · sonicwall netextender (1) | · |
One CVE is counted once per vendor, product or weakness class it lists, so a ranking column sums to more than the month's total. Only the month's top 100 keys per dimension are stored. The KEV column counts CVEs published in 2020-07 that are on the CISA KEV catalog today. The 0 in the headline is what CISA listed during the month, whenever those CVEs were published. All 50 ranked vendors are listed; a zero count renders as a dot.
Weaknesses
CWE classes by distinct CVEs
- 1CWE-784628 critical↑19
- 2CWE-79280 critical—
- 3CWE-20255 critical↓2
- 4CWE-89200 critical↑18
- 5CWE-284143 critical↑12
- 6CWE-22133 critical↑2
- 7CWE-306124 critical↑2
- 8CWE-400110 critical↑26
- 9CWE-20091 critical↓3
- 10CWE-28781 critical↑9
- 1CWE-50283 critical↓1
- 2CWE-11973 critical↓9
- 3CWE-12160 critical↑14
- 4CWE-12260 critical↑14
- 5CWE-12052 critical↑8
- 6CWE-28551 critical↑2
- 7CWE-34750 critical↑15
- 8CWE-61150 critical·
- 9CWE-20940 critical·
- 10CWE-26440 critical↓5
One CVE is counted once per vendor, product or weakness class it lists, so a ranking column sums to more than the month's total. Only the month's top 100 keys per dimension are stored.