Month report
May 2021
Rolled up 2026-08-09 20:45 from 370,652 CVE records
1,494 CVEs published, +46.9% on the same month last year. 34 rated critical, 0 listed by CISA as exploited. tensorflow led with 108; the most common weakness class was CWE-79 (78). github climbed 60 places, the largest move. 17 vendors ranked for the first time.
Published
1,494
-17.8%on the previous month
Critical / high
34 / 176
of the 548 scored
Medium / low
209 / 129
the rest of the scored bands
Added to CISA KEV
0
listed as exploited this month
Public exploit
59
exploit code indexed publicly
Scanner template
0
0% of the month
Publication to KEV
How long before CISA listed them
19 published this month and listed since — not the 0 listed during it.
Median days to listing
180
from publication to CISA's date added
Listed within 7 days
0%
of the 19
Listed within 30 days
0%
of the 19
Weakness × vendor
Where the two overlap
CVEs carrying both. Each row is shaded against its own worst class.
| Vendor | CWE-79 | CWE-125 | CWE-369 | CWE-20 | CWE-416 | CWE-476 | CWE-119 | CWE-787 |
|---|---|---|---|---|---|---|---|---|
| tensorflow | 11 | 32 | 13 | 5 | 5 | |||
| ibm | ||||||||
| cisco | 3 | 8 | 4 | |||||
| microsoft | 1 | |||||||
| foxit | 14 | 11 | 5 | |||||
| siemens | 1 | 2 | 1 | |||||
| qualcomm | 1 | |||||||
| jenkins project |
Vendors
Ranked by distinct CVEs this month
Δ is the move against last month's rank.
| # | Vendor | Top products | ||||||
|---|---|---|---|---|---|---|---|---|
| 1 | tensorflow | 108 | tensorflow (108) | · | ||||
| 2 | ibm | 70 | 2 | qradar siem (12) · cognos analytics (10) · security guardium (8) | ↑6 | |||
| 3 | cisco | 59 | 7 | 2 | 3 | cisco business wireless access point software (11) · cisco sd wan vmanage (10) · cisco anyconnect secure mobility client (7) | ↑2 | |
| 4 | microsoft | 52 | 2 | 2 | 5 | windows 10 version 2004 (21) · windows 10 version 20h2 (20) · windows server version 2004 (19) | ↓1 | |
| 5 | foxit | 33 | reader (33) | ↑20 | ||||
| 6 | siemens | 23 | 2 | scalance w721 1 rj45 (8) · scalance w722 1 rj45 (8) · scalance w734 1 rj45 (8) | ↑5 | |||
| 7 | qualcomm | 20 | 2 | 1 | snapdragon auto snapdragon compute snapdragon connectivity snapdragon consumer iot snapdragon industrial iot snapdragon mobile snapdragon voice music snapdragon wearables (3) · snapdragon auto snapdragon compute snapdragon connectivity snapdragon consumer electronics connectivity snapdragon consumer iot snapdragon industrial iot snapdragon mobile snapdragon voice music snapdragon wired infrastructure and networking (2) · snapdragon auto snapdragon compute snapdragon connectivity snapdragon consumer iot snapdragon industrial iot snapdragon iot snapdragon mobile snapdragon voice music snapdragon wearables (2) | ↑7 | ||
| 8 | jenkins project | 13 | jenkins p4 plugin (2) · jenkins s3 publisher plugin (2) · jenkins xray test management for jira plugin (2) | ↑13 | ||||
| 9 | zephyrproject rtos | 12 | 1 | zephyr (12) | · | |||
| 10 | apache | 10 | 3 | apache dubbo (5) · apache airflow (1) · apache fineract (1) | ↑7 | |||
| 11 | sap se | 8 | sap business one version for sap hana cookbooks (2) · sap process integration integration builder framework (2) · sap business one cookbooks (1) | ↑5 | ||||
| 12 | trend micro | 8 | trend micro home network security (5) · trend micro housecall for home networks (2) · trend micro im security (1) | ↑17 | ||||
| 13 | wago | 8 | 2 | 0852 0303 (6) · 0852 1305 (6) · 0852 1305 000 001 (6) | · | |||
| 14 | wp buy | 8 | captchinoo google recaptcha for admin login page (1) · login as user or customer user switching (1) · login protection limit failed login attempts (1) | new | ||||
| 15 | business directory team | 6 | business directory plugin easy listing directories for wordpress (6) | new | ||||
| 16 | dell | 6 | 1 | 1 | powerscale onefs (2) · dbutil (1) · dell emc integrated system for microsoft azure stack hub (1) | ↓7 | ||
| 17 | elastic | 6 | elasticsearch (3) · kibana (2) · elastic app search (1) | · | ||||
| 18 | drupal | 5 | drupal core (5) | · | ||||
| 19 | gitlab | 5 | 2 | gitlab (5) | — | |||
| 20 | linux | 5 | 1 | kernel (3) · linux kernel (2) | ↑42 | |||
| 21 | query solutions | 5 | redirection for contact form 7 (5) | new | ||||
| 22 | atlassian | 4 | 1 | confluence server (2) · atlassian connect spring boot acsb (1) · jira data center (1) | ↓2 | |||
| 23 | jun he technology | 4 | erp pos (2) · quan fang wei tong xun system (2) | new | ||||
| 24 | qnap systems | 4 | 1 | 1 | hbs 1 3 (1) · hbs 2 (1) · hbs 3 (1) | ↑15 | ||
| 25 | sitel | 4 | 1 | cap prx (4) | new | |||
| 26 | joomla project | 3 | joomla cms (3) | ↑35 | ||||
| 27 | mcafee | 3 | mcafee total protection mtp (2) · mcafee endpoint security ens for linux (1) | ↓1 | ||||
| 28 | php factory | 3 | calendar01 free edition (1) · mailform01 free edition (1) · telop01 free edition (1) | · | ||||
| 29 | supsystic | 3 | 3 | contact form by supsystic (1) · popup by supsystic (1) · ultimate maps by supsystic (1) | new | |||
| 30 | sysjust | 3 | cts web (3) | new | ||||
| 31 | amd | 2 | sev sev es (2) | new | ||||
| 32 | bitdefender | 2 | endpoint security tools for linux (1) · gravityzone business security (1) | ↑46 | ||||
| 33 | bitorbit | 2 | wpbakery page builder visual composer clipboard (2) | new | ||||
| 34 | dav git | 2 | dav cogs (2) | new | ||||
| 35 | esri | 2 | arcgis earth (1) · arcgis geoevent server (1) | · | ||||
| 36 | exiv2 | 2 | exiv2 (2) | ↓12 | ||||
| 37 | github | 2 | codeql action (1) · github enterprise server (1) | ↑60 | ||||
| 38 | hundred plus | 2 | 101eip (2) | new | ||||
| 39 | kujirahand | 2 | konawiki2 (2) | · | ||||
| 40 | matrix org | 2 | matrix react sdk (1) · synapse (1) | ↓18 | ||||
| 41 | moove agency | 2 | 2 | redirect 404 to parent (1) · select all categories and taxonomies change checkbox to radio buttons (1) | new | |||
| 42 | nationalsecurityagency | 2 | emissary (2) | new | ||||
| 43 | openapitools | 2 | 1 | openapi generator (2) | new | |||
| 44 | opensuse | 2 | factory (2) · opensuse leap 15 2 (1) · suse linux enterprise server 11 sp4 ltss (1) | · | ||||
| 45 | pickplugins | 2 | 1 | accordion (1) · pickplugins product slider for woocommerce (1) | new | |||
| 46 | redis | 2 | redis (2) | · | ||||
| 47 | solarwinds | 2 | 1 | network performance monitor (1) · orion job scheduler (1) | ↑21 | |||
| 48 | sonicwall | 2 | email security virtual appliance (1) · sonicwall nsm on prem (1) | ↓8 | ||||
| 49 | store locator plus | 2 | store locator plus for wordpress (2) | new | ||||
| 50 | sylabs | 2 | sif (1) · singularity (1) | new |
One CVE is counted once per vendor, product or weakness class it lists, so a ranking column sums to more than the month's total. Only the month's top 100 keys per dimension are stored. The KEV column counts CVEs published in 2021-05 that are on the CISA KEV catalog today. The 0 in the headline is what CISA listed during the month, whenever those CVEs were published. All 50 ranked vendors are listed; a zero count renders as a dot.
Weaknesses
CWE classes by distinct CVEs
- 1CWE-79780 critical—
- 2CWE-125451 critical↑8
- 3CWE-369350 critical·
- 4CWE-20286 critical↓1
- 5CWE-416271 critical↑23
- 6CWE-476240 critical↑32
- 7CWE-119232 critical↑2
- 8CWE-787231 critical↑3
- 9CWE-200210 critical↓4
- 10CWE-400170 critical↓2
- 1CWE-89150 critical↓7
- 2CWE-190140 critical↑22
- 3CWE-269121 critical↑6
- 4CWE-285122 critical↑7
- 5CWE-77120 critical↑16
- 6CWE-78122 critical↓4
- 7CWE-754110 critical↑13
- 8CWE-284100 critical↓11
- 9CWE-352100 critical↓6
- 10CWE-43491 critical↓6
One CVE is counted once per vendor, product or weakness class it lists, so a ranking column sums to more than the month's total. Only the month's top 100 keys per dimension are stored.