Month report
May 2023
Rolled up 2026-08-09 20:45 from 370,662 CVE records
2,420 CVEs published, +12% on the same month last year. 246 rated critical, 19 listed by CISA as exploited. unisoc shanghai technologies co led with 66; the most common weakness class was CWE-79 (419). huawei climbed 65 places, the largest move. 9 vendors ranked for the first time.
Published
2,420
+5.1%on the previous month
Critical / high
246 / 764
of the 2,319 scored
Medium / low
1,197 / 112
the rest of the scored bands
Added to CISA KEV
19
listed as exploited this month
Public exploit
127
exploit code indexed publicly
Scanner template
0
0% of the month
Publication to KEV
How long before CISA listed them
8 published this month and listed since — not the 19 listed during it.
Median days to listing
13.5
from publication to CISA's date added
Listed within 7 days
25%
of the 8
Listed within 30 days
62.5%
of the 8
Weakness × vendor
Where the two overlap
CVEs carrying both. Each row is shaded against its own worst class.
| Vendor | CWE-79 | CWE-89 | CWE-352 | CWE-787 | CWE-22 | CWE-120 | CWE-20 | CWE-125 |
|---|---|---|---|---|---|---|---|---|
| unisoc shanghai technologies co | 22 | 8 | 3 | |||||
| apple | 7 | 8 | 5 | |||||
| sourcecodester | 16 | 39 | ||||||
| microsoft | 2 | 2 | ||||||
| 3 | ||||||||
| apache | 2 | 1 | 4 | |||||
| ibm | 6 | 1 | 1 | 4 | ||||
| jenkins project | 4 | 9 | 1 | 1 |
Detection gap
Listed as exploited, no public template
CVEs CISA listed this month
Listed this month
19
added to the CISA KEV catalog
With a template
4
21.1% covered
No template
15
nothing in the public index
Measured against the nuclei-templates CVE index only. No template there does not mean a CVE is undetectable by any other tool.
Vendors
Ranked by distinct CVEs this month
Δ is the move against last month's rank.
| # | Vendor | Top products | ||||||
|---|---|---|---|---|---|---|---|---|
| 1 | unisoc shanghai technologies co | 66 | sc9863a sc9832e sc7731e t610 t310 t606 t760 t610 t618 t606 t612 t616 t760 t770 t820 s8000 (66) | ↑26 | ||||
| 2 | apple | 65 | 4 | macos (58) · ios and ipados (39) · tvos (19) | ↑29 | |||
| 3 | sourcecodester | 57 | 1 | lost and found information system (12) · online exam system (8) · online computer and laptop store (5) | ↓1 | |||
| 4 | microsoft | 56 | 3 | 2 | 5 | windows 11 version 21h2 (36) · windows server 2019 (36) · windows server 2019 server core installation (36) | ↓3 | |
| 5 | 32 | chrome (31) · web stories for wordpress (1) | ↑10 | |||||
| 6 | apache | 31 | 10 | 1 | 2 | apache inlong (11) · inlong (10) · apache openmeetings (3) | ↑8 | |
| 7 | ibm | 31 | 1 | mq (5) · infosphere information server (4) · powervm hypervisor (2) | ↑4 | |||
| 8 | jenkins project | 31 | jenkins saml single sign on sso plugin (6) · jenkins azure vm agents plugin (3) · jenkins ansible plugin (2) | ↑9 | ||||
| 9 | samsung mobile | 31 | 1 | samsung mobile devices (21) · samsung blockchain keystore (6) · galaxy store (3) | · | |||
| 10 | cisco | 28 | 1 | 2 | cisco identity services engine software (11) · 250 series smart switches firmware (9) · 350 series managed switches firmware (9) | ↓5 | ||
| 11 | amd | 26 | 5 | ryzen 2000 series mobile processors raven ridge fp5 (12) · ryzen 3000 series mobile processors with radeon graphics renoir (12) · ryzen 5000 series desktop processor with radeon graphics cezanne am4 (12) | · | |||
| 12 | mediatek | 25 | 1 | mt6853 mt6853t mt6873 mt6875 mt6877 mt6879 mt6883 mt6885 mt6889 mt6891 mt6893 mt8183 mt8195 (4) · mt6580 mt6731 mt6735 mt6737 mt6739 mt6753 mt6757 mt6757c mt6757cd mt6757ch mt6761 mt6762 mt6763 mt6765 mt6768 mt6769 mt6771 mt6779 mt6781 mt6785 mt6789 mt6833 mt6853 mt6853t mt6855 mt6873 mt6875 mt6877 mt6879 mt6883 mt6885 mt6889 mt6891 mt6893 mt6895 mt6983 mt8185 mt8321 mt8385 mt8666 mt8667 mt8765 mt8766 mt8768 mt8781 mt8786 mt8788 mt8789 mt8791 mt8791t mt8797 (3) · mt6580 mt6731 mt6735 mt6737 mt6739 mt6753 mt6757 mt6757c mt6757cd mt6757ch mt6761 mt6762 mt6763 mt6765 mt6768 mt6769 mt6771 mt6779 mt6781 mt6785 mt6789 mt6833 mt6853 mt6853t mt6855 mt6873 mt6875 mt6877 mt6879 mt6883 mt6885 mt6889 mt6891 mt6893 mt6895 mt6983 mt8185 mt8321 mt8385 mt8666 mt8667 mt8673 mt8675 mt8765 mt8766 mt8768 mt8781 mt8786 mt8788 mt8789 mt8791 mt8791t mt8797 (2) | ↓2 | |||
| 13 | hewlett packard enterprise hpe | 24 | 8 | aruba access points running instantos and arubaos 10 (13) · aruba edgeconnect enterprise software (10) · hpe proliant rl300 gen11 (1) | ↑22 | |||
| 14 | schweitzer engineering laboratories | 20 | 2 | sel 3350 (20) · sel 3532 (20) · sel 3555 (20) | · | |||
| 15 | huawei | 19 | 3 | emui (17) · harmonyos (17) | ↑65 | |||
| 16 | codesys | 17 | codesys development system v3 (17) · codesys control for beaglebone sl (16) · codesys control for empc a imx6 sl (16) | · | ||||
| 17 | rockwell automation | 16 | 1 | armorstart st (10) · arena simulation (3) · factorytalk vantagepoint (1) | · | |||
| 18 | gitlab | 15 | 2 | 1 | gitlab (15) | ↑6 | ||
| 19 | siemens | 15 | 3 | simatic cloud connect 7 cc712 (7) · simatic cloud connect 7 cc716 (7) · scalance lpe9403 (4) | ↑7 | |||
| 20 | adobe | 14 | substance3d painter (14) | ↓16 | ||||
| 21 | liferay | 14 | dxp (14) · portal (14) | new | ||||
| 22 | sap se | 14 | 1 | sap businessobjects business intelligence platform (3) · sap crm webclient ui (2) · sap as netweaver java (1) | · | |||
| 23 | dell | 13 | powerpath windows (3) · dell vxrail hci (2) · alienware command center awcc (1) | ↑6 | ||||
| 24 | qualcomm | 13 | snapdragon (13) · 9206 lte modem firmware (3) · fastconnect 6900 firmware (3) | ↓15 | ||||
| 25 | jetbrains | 12 | 1 | teamcity (12) | ↑38 | |||
| 26 | pimcore | 12 | pimcore pimcore (7) · pimcore customer data framework (3) · customer data framework (1) | ↓6 | ||||
| 27 | canon | 11 | 6 | canon office small office multifunction printers and laser printers (9) · canon ij nw tool (2) | · | |||
| 28 | openemr | 11 | openemr openemr (11) | · | ||||
| 29 | acronis | 10 | 2 | 2 | acronis cyber protect 15 (8) · acronis agent (5) · acronis cyber backup 12 5 (2) | ↑39 | ||
| 30 | f5 | 10 | big ip (5) · big ip edge client (2) · nginx api connectivity manager (2) | · | ||||
| 31 | 10 | 7 | 1 | hermes (7) · fizz (1) · hhvm (1) | · | |||
| 32 | fortinet | 9 | fortinac (6) · fortiadc (2) · fortios (1) | ↓16 | ||||
| 33 | seiko solutions | 9 | skybridge mb a100 110 (5) · skybridge mb a200 and skybridge basic mb a130 (2) · skybridge mb a200 (1) | new | ||||
| 34 | sick | 9 | sick ftmg esd15axx air flow sensor (8) · sick ftmg esd20axx air flow sensor (8) · sick ftmg esd25axx air flow sensor (8) | new | ||||
| 35 | western digital | 9 | 1 | my cloud os 5 (6) · ibi (5) · my cloud home and my cloud home duo (5) | · | |||
| 36 | zyxel | 9 | 2 | 2 | nbg 418n v2 firmware (4) · atp series firmware (2) · usg20 w vpn firmware (2) | ↓8 | ||
| 37 | silabs com | 8 | gecko platform (8) | · | ||||
| 38 | snap one | 8 | ovrc cloud (8) | · | ||||
| 39 | teltonika | 8 | 1 | remote management system (6) · rut model routers (2) | new | |||
| 40 | nextcloud | 7 | security advisories (6) · cookbook (1) | ↓10 | ||||
| 41 | wireshark foundation | 7 | wireshark (7) | ↑53 | ||||
| 42 | cbot | 6 | 3 | chatbot (6) | new | |||
| 43 | craftcms | 6 | cms (6) | new | ||||
| 44 | esri | 6 | portal for arcgis (6) | · | ||||
| 45 | gpac | 6 | gpac gpac (6) | · | ||||
| 46 | riot os | 6 | 1 | riot (6) | — | |||
| 47 | sandisk | 6 | ibi (5) · my cloud home and my cloud home duo (5) · my cloud os 5 (3) | new | ||||
| 48 | shop beat | 6 | 2 | studio (6) | new | |||
| 49 | thorsten | 6 | thorsten phpmyfaq (6) | ↓27 | ||||
| 50 | trainingbusinesspros | 6 | groundhogg crm newsletters and marketing automation (6) | new |
One CVE is counted once per vendor, product or weakness class it lists, so a ranking column sums to more than the month's total. Only the month's top 100 keys per dimension are stored. The KEV column counts CVEs published in 2023-05 that are on the CISA KEV catalog today. The 19 in the headline is what CISA listed during the month, whenever those CVEs were published. All 50 ranked vendors are listed; a zero count renders as a dot.
Weaknesses
CWE classes by distinct CVEs
- 1CWE-794196 critical—
- 2CWE-8914137 critical—
- 3CWE-3521380 critical↑2
- 4CWE-7871289 critical↓1
- 5CWE-22618 critical↑3
- 6CWE-1206014 critical↑8
- 7CWE-20608 critical↓1
- 8CWE-125511 critical↓4
- 9CWE-774913 critical—
- 10CWE-862481 critical↑12
- 1CWE-284451 critical↓1
- 2CWE-863413 critical↑5
- 3CWE-416392 critical↓6
- 4CWE-78379 critical↑5
- 5CWE-4343617 critical↓4
- 6CWE-276294 critical↑13
- 7CWE-200261 critical↑3
- 8CWE-94239 critical↑7
- 9CWE-732221 critical↑13
- 10CWE-285211 critical↑27
One CVE is counted once per vendor, product or weakness class it lists, so a ranking column sums to more than the month's total. Only the month's top 100 keys per dimension are stored.