Month report
May 2024
Rolled up 2026-08-09 20:45 from 375,787 CVE records
4,992 CVEs published, +106.3% on the same month last year. 402 rated critical, 14 listed by CISA as exploited. linux led with 1,075; the most common weakness class was CWE-79 (660). netgear climbed 79 places, the largest move. 11 vendors ranked for the first time.
Published
4,992
Critical / high
402 / 1,907
Medium / low
1,854 / 271
Added to CISA KEV
14
Public exploit
156
Scanner template
0
Publication to KEV
How long before CISA listed them
Median days to listing
5
Listed within 7 days
61.5%
Listed within 30 days
69.2%
Detection gap
Listed as exploited, no public template
Listed this month
14
With a template
5
No template
9
- 1google4of 4 listed
- 2microsoft2of 2 listed
- 3dlink1of 2 listed
- 4fedoraproject1of 1 listed
- 5javs1of 1 listed
- 6justice av solutions1of 1 listed
- 7linux1of 1 listed
Measured against the nuclei-templates CVE index only. No template there does not mean a CVE is undetectable by any other tool.
Vendors
Ranked by distinct CVEs this month
| # | Vendor | Top products | ||||||
|---|---|---|---|---|---|---|---|---|
| 1 | linux | 1,075 | 42 | 3 | linux (1072) · simatic s7 1500 tm mfp gnu linux subsystem (104) · linux kernel (97) | — | ||
| 2 | d link | 214 | 6 | 2 | dap 2622 (54) · dap 2622 firmware (47) · dap 1325 (36) | ↑73 | ||
| 3 | siemens | 168 | 9 | 1 | linux (107) · simatic s7 1500 tm mfp gnu linux subsystem (104) · ruggedcom rst2428p (32) | ↑5 | ||
| 4 | dlink | 143 | 1 | 1 | dap 2622 (47) · dap 2622 firmware (47) · dap 1325 (28) | · | ||
| 5 | campcodes | 135 | 16 | complete web based school management system (102) · legal case management system (15) · online examination system (9) | ↑12 | |||
| 6 | pdf xchange | 101 | pdf xchange editor (101) · pdf tools (23) · pdf xchange pro (23) | ↑42 | ||||
| 7 | foxit | 76 | 1 | pdf reader (64) · pdf editor (48) · phantompdf (12) | ↓1 | |||
| 8 | kofax | 76 | power pdf (76) · dap 2622 (2) | ↑23 | ||||
| 9 | sourcecodester | 76 | 2 | 7 | simple online bidding system (9) · event registration system (7) · best house rental management system (6) | ↓4 | ||
| 10 | intel | 72 | 1 | power gadget software (11) · graphics performance analyzer (6) · intel r power gadget software for windows (6) | · | |||
| 11 | microsoft | 63 | 2 | 4 | windows server 2022 (45) · windows server 2019 (44) · windows server 2019 server core installation (44) | ↓9 | ||
| 12 | ibm | 53 | 1 | 1 | cognos controller (10) · app connect enterprise (6) · security guardium (5) | ↓3 | ||
| 13 | adobe | 45 | acrobat reader (20) · acrobat reader dc (19) · acrobat (14) | ↑2 | ||||
| 14 | 44 | 6 | 4 | 5 | chrome (25) · android (16) · fedora (1) | ↓7 | ||
| 15 | totolink | 39 | 10 | cp450 (9) · cp450 firmware (7) · x5000r firmware (6) | ↑6 | |||
| 16 | ashlar vellum | 38 | cobalt (32) · graphite (3) · argon (1) | new | ||||
| 17 | netgear | 38 | 1 | 3 | rax30 (16) · prosafe network management system (15) · rax30 firmware (11) | ↑79 | ||
| 18 | ashlar | 34 | cobalt (28) · graphite (3) · argon (1) | new | ||||
| 19 | apple | 28 | 2 | 3 | macos (23) · ios and ipados (14) · ipad os (9) | · | ||
| 20 | arubanetworks | 28 | 12 | 1 | arubaos (28) · aos 8 instant and aos 10 ap (18) · instant (18) | · | ||
| 21 | hewlett packard enterprise hpe | 28 | 12 | 1 | arubaos (28) · aos 8 instant and aos 10 ap (18) · instant (18) | · | ||
| 22 | hdfgroup | 27 | 7 | hdf5 (27) | new | |||
| 23 | lg | 27 | 7 | 2 | simple editor (25) · supersign media editor (2) | new | ||
| 24 | wordpress | 24 | 1 | 1 | acf on the go (1) · contact form drag and drop form builder (1) · counter box (1) | ↓13 | ||
| 25 | tenda | 23 | 6 | fh1206 firmware (7) · i21 (7) · ax1806 firmware (5) | ↓21 | |||
| 26 | huawei | 22 | emui (16) · harmonyos (16) · curiem wfg9b (5) | ↓14 | ||||
| 27 | jetbrains | 22 | teamcity (21) · youtrack (1) | · | ||||
| 28 | kashipara | 21 | college management system (21) | ↑37 | ||||
| 29 | cisco | 20 | cisco firepower threat defense software (5) · firepower management center (5) · cisco network services orchestrator (4) | ↓10 | ||||
| 30 | ivanti | 20 | 6 | 1 | 2 | epm (11) · endpoint manager (10) · endpoint manager mobile (3) | ↓17 | |
| 31 | ruijie | 19 | rg uac (19) · ru uac firmware (1) | new | ||||
| 32 | samsung mobile | 19 | samsung mobile devices (14) · android (6) · cocktailbarservice (1) | ↑4 | ||||
| 33 | idccms project | 18 | 1 | idccms (18) | new | |||
| 34 | inductive automation | 18 | 2 | ignition (18) | · | |||
| 35 | inductiveautomation | 18 | 2 | ignition (18) | new | |||
| 36 | qualcomm | 18 | snapdragon (18) · fastconnect 7800 firmware (15) · qca6574au firmware (14) | ↓9 | ||||
| 37 | ruvar | 18 | 16 | ruvaroa (18) | new | |||
| 38 | tp link | 18 | 1 | 1 | 1 | omada er605 (5) · archer ax21 (2) · archer ax21 firmware (2) | ↓6 | |
| 39 | voltronic power | 18 | 10 | viewpower (13) · viewpower pro (6) | new | |||
| 40 | f5 | 17 | 2 | big ip (8) · big ip next central manager (4) · nginx (4) | · | |||
| 41 | libigl | 17 | 3 | libigl (17) · ligibl (1) | new | |||
| 42 | motorola | 17 | phones (17) · smartphone firmware (2) · device help (1) | · | ||||
| 43 | mozilla | 17 | 2 | 1 | firefox (16) · firefox esr (6) · thunderbird (6) | ↓19 | ||
| 44 | opentext | 17 | imanager (11) · arcsight enterprise security manager (2) · arcsight platform (2) | · | ||||
| 45 | automationdirect | 15 | 5 | p3 550e (15) · p3 550e firmware (12) | · | |||
| 46 | dell | 15 | powerscale onefs (6) · data manager appliance software dmas (2) · dell openmanage enterprise (2) | — | ||||
| 47 | devitemsllc | 15 | 1 | ht mega addons for elementor elementor widgets template builder (10) · shoplentor all in one woocommerce growth store enhancement plugin (5) · shoplentor (1) | ↑46 | |||
| 48 | samsung | 15 | samsung mobile devices (9) · android (6) · magician (2) | · | ||||
| 49 | cyberpower | 14 | 5 | powerpanel business (9) · cyberpower powerpanel enterprise (5) · powerpanel enterprise (5) | · | |||
| 50 | j2eefast | 14 | 6 | j2eefast (14) | new |
One CVE is counted once per vendor, product or weakness class it lists, so a ranking column sums to more than the month's total. Only the month's top 100 keys per dimension are stored. The KEV column counts CVEs published in 2024-05 that are on the CISA KEV catalog today. The 14 in the headline is what CISA listed during the month, whenever those CVEs were published. All 50 ranked vendors are listed; a zero count renders as a dot.
Weaknesses
CWE classes by distinct CVEs
- 1CWE-796605 critical—
- 2CWE-8932285 critical—
- 3CWE-12122619 critical↑2
- 4CWE-41617312 critical↑5
- 5CWE-1251692 critical↑1
- 6CWE-7871383 critical↑10
- 7CWE-8621345 critical↓3
- 8CWE-7812910 critical↑10
- 9CWE-2212315 critical↓1
- 10CWE-3521042 critical↓7
- 1CWE-208613 critical—
- 2CWE-122835 critical↑1
- 3CWE-2698218 critical↑8
- 4CWE-4347126 critical—
- 5CWE-284706 critical↓5
- 6CWE-200631 critical↓9
- 7CWE-1205811 critical↓2
- 8CWE-476563 critical↑1
- 9CWE-945511 critical↓7
- 10CWE-400520 critical↑2
One CVE is counted once per vendor, product or weakness class it lists, so a ranking column sums to more than the month's total. Only the month's top 100 keys per dimension are stored.