Month report
July 2021
Rolled up 2026-08-09 20:45 from 370,700 CVE records
1,581 CVEs published, +11.6% on the same month last year. 71 rated critical, 0 listed by CISA as exploited. oracle led with 131; the most common weakness class was CWE-79 (62). esri climbed 70 places, the largest move. 17 vendors ranked for the first time.
Published
1,581
Critical / high
71 / 280
Medium / low
333 / 31
Added to CISA KEV
0
Public exploit
46
Scanner template
0
Publication to KEV
How long before CISA listed them
Median days to listing
112
Listed within 7 days
0%
Listed within 30 days
0%
Vendors
Ranked by distinct CVEs this month
| # | Vendor | Top products | ||||||
|---|---|---|---|---|---|---|---|---|
| 1 | oracle | 131 | 8 | 2 | mysql server (33) · outside in technology (10) · database enterprise edition (9) | · | ||
| 2 | microsoft | 119 | 3 | 9 | 8 | windows server 2019 (78) · windows server version 20h2 (77) · windows server version 2004 (76) | — | |
| 3 | ibm | 74 | 1 | security verify access docker (15) · cloud pak for applications (12) · guardium data encryption (7) | — | |||
| 4 | siemens | 56 | jt2go (43) · teamcenter visualization (43) · solid edge se2021 (4) | ↑27 | ||||
| 5 | qsan | 30 | 14 | storage manager (23) · sanos (7) · xevo (7) | new | |||
| 6 | cisco | 24 | 1 | cisco identity services engine software (5) · cisco intersight virtual appliance (4) · cisco video surveillance 7000 series ip cameras (4) | ↑3 | |||
| 7 | dell | 24 | 5 | dell openmanage enterprise (3) · unity (3) · avamar (2) | ↑12 | |||
| 8 | qualcomm | 23 | 2 | 1 | snapdragon auto snapdragon compute snapdragon connectivity snapdragon consumer iot snapdragon industrial iot snapdragon iot snapdragon voice music snapdragon wearables (4) · snapdragon consumer iot snapdragon industrial iot snapdragon mobile snapdragon voice music snapdragon wearables (3) · snapdragon auto snapdragon compute snapdragon connectivity snapdragon consumer electronics connectivity snapdragon consumer iot snapdragon industrial iot snapdragon mobile snapdragon voice music snapdragon wired infrastructure and networking (2) | — | ||
| 9 | juniper networks | 19 | 1 | junos os (15) · junos os evolved (7) · contrail cloud (1) | · | |||
| 10 | samsung mobile | 17 | samsung mobile devices (5) · tizen wearable devices (5) · samsung members (3) | ↓6 | ||||
| 11 | fortinet | 16 | 1 | 1 | fortinet fortimail (9) · fortinet fortisandbox (2) · fortiauthenticator (1) | ↑18 | ||
| 12 | apache | 15 | apache commons compress (4) · apache tomcat (3) · apache ant (2) | ↑1 | ||||
| 13 | nextcloud | 15 | security advisories (15) | ↑8 | ||||
| 14 | nvidia | 15 | nvidia gpu display driver (8) · nvidia virtual gpu software (7) | ↓4 | ||||
| 15 | sap se | 13 | sap 3d visual enterprise viewer (2) · sap netweaver as abap and abap platform (2) · sap business objects web intelligence bi launchpad (1) | ↓10 | ||||
| 16 | gitlab | 11 | gitlab (11) | ↑1 | ||||
| 17 | esri | 6 | 1 | arcgis server (6) | ↑70 | |||
| 18 | learningdigital com | 6 | 2 | orca hcm (6) | new | |||
| 19 | qnap systems | 6 | 1 | qts (3) · quts hero (3) · hbs 3 (1) | ↑4 | |||
| 20 | japan total system co | 5 | groupsession (5) | · | ||||
| 21 | joomla project | 5 | joomla cms (5) | · | ||||
| 22 | otrs | 5 | otrs (4) · otrs community edition (4) · time accounting (1) | ↑33 | ||||
| 23 | trend micro | 5 | 2 | trend micro apex one (3) · trend micro worry free business security (3) · trend micro officescan (2) | ↑40 | |||
| 24 | atlassian | 4 | 1 | jira data center (4) · jira server (3) · jira core data center (1) | ↑15 | |||
| 25 | combodo | 4 | itop (4) | · | ||||
| 26 | d link | 4 | dap 1330 (4) | · | ||||
| 27 | 4 | 1 | chrome (4) | ↓26 | ||||
| 28 | icinga | 4 | icinga2 (2) · icingaweb2 (2) | new | ||||
| 29 | lenovo | 4 | bios (1) · notebook bios (1) · pcmanager (1) | · | ||||
| 30 | profilepress | 4 | 4 | 1 | profilepress (4) | new | ||
| 31 | properfraction | 4 | 4 | 1 | profilepress (4) | new | ||
| 32 | sage | 4 | 1 | 2 | x3 (4) | new | ||
| 33 | the eclipse foundation | 4 | 1 | eclipse mosquitto (2) · eclipse jetty (1) · eclipse tinydtls (1) | ↑12 | |||
| 34 | typo3 | 4 | typo3 cms (4) | · | ||||
| 35 | zmartzone | 4 | mod auth openidc (4) | new | ||||
| 36 | akkadian | 3 | provisioning manager engine pme (3) | new | ||||
| 37 | boldgrid | 3 | w3 total cache (3) | new | ||||
| 38 | rancher | 3 | 1 | rancher (3) · suse linux enterprise server 15 (1) | new | |||
| 39 | wp upload restriction | 3 | wp upload restriction (3) | new | ||||
| 40 | xwiki | 3 | xwiki platform (3) | · | ||||
| 41 | collaboraonline | 2 | 1 | online (2) | new | |||
| 42 | discourse | 2 | discourse (2) | new | ||||
| 43 | elecom co | 2 | wrc 1167fs w wrc 1167fs b and wrc 1167fsa (1) · wrc 300febk wrc f300nf wrc 733febk wrh 300rd wrh 300bk wrh 300sv wrh 300wh wrh h300wh wrh h300bk wrh 300bk s and wrh 300wh s (1) | · | ||||
| 44 | hyperium | 2 | hyper (2) | · | ||||
| 45 | ivanti | 2 | mobileiron core (2) | new | ||||
| 46 | jeff starr | 2 | prismatic (2) | new | ||||
| 47 | johnson controls | 2 | c cure 9000 (1) · facility explorer snc series supervisory controllers f4 snc (1) | ↓4 | ||||
| 48 | justarchinet | 2 | archisteamfarm (2) | new | ||||
| 49 | nodejs | 2 | node (2) | · | ||||
| 50 | octopus deploy | 2 | octopus server (2) | new |
One CVE is counted once per vendor, product or weakness class it lists, so a ranking column sums to more than the month's total. Only the month's top 100 keys per dimension are stored. The KEV column counts CVEs published in 2021-07 that are on the CISA KEV catalog today. The 0 in the headline is what CISA listed during the month, whenever those CVEs were published. All 50 ranked vendors are listed; a zero count renders as a dot.
Weaknesses
CWE classes by distinct CVEs
- 1CWE-79625 critical—
- 2CWE-200290 critical↑3
- 3CWE-787211 critical↓1
- 4CWE-20170 critical↓1
- 5CWE-78179 critical↑7
- 6CWE-284132 critical↑9
- 7CWE-22120 critical↑6
- 8CWE-126110 critical·
- 9CWE-125100 critical↓5
- 10CWE-12290 critical↓1
- 1CWE-35280 critical↑23
- 2CWE-41680 critical↓1
- 3CWE-52282 critical·
- 4CWE-79884 critical↑18
- 5CWE-11971 critical↓7
- 6CWE-26972 critical↑8
- 7CWE-8971 critical↓10
- 8CWE-12060 critical—
- 9CWE-28561 critical—
- 10CWE-28762 critical↓10
One CVE is counted once per vendor, product or weakness class it lists, so a ranking column sums to more than the month's total. Only the month's top 100 keys per dimension are stored.