Month report
May 2026
Rolled up 2026-09-15 11:40 from 371,739 CVE records
6,937 CVEs published, +74.3% on the same month last year. 669 rated critical, 21 listed by CISA as exploited. linux led with 1,028; the most common weakness class was CWE-79 (577). mattermost climbed 77 places, the largest move. 4 vendors ranked for the first time.
Published
6,937
Critical / high
669 / 2,746
Medium / low
2,512 / 319
Added to CISA KEV
21
Public exploit
286
Scanner template
62
Publication to KEV
How long before CISA listed them
Median days to listing
6.5
Listed within 7 days
50%
Listed within 30 days
68.2%
Detection gap
Listed as exploited, no public template
Listed this month
21
With a template
4
No template
17
- 1microsoft3of 3 listed
- 2siemens2of 3 listed
- 3palo alto networks1of 2 listed
- 4redhat1of 2 listed
- 5avb disc soft1of 1 listed
- 6cisco1of 1 listed
- 7ivanti1of 1 listed
- 8linux1of 1 listed
Measured against the nuclei-templates CVE index only. No template there does not mean a CVE is undetectable by any other tool.
Vendors
Ranked by distinct CVEs this month
| # | Vendor | Top products | ||||||
|---|---|---|---|---|---|---|---|---|
| 1 | linux | 1,028 | 43 | 15 | linux (1028) · simatic s7 1500 cpu 1518 4 pn dp mfp (44) · simatic s7 1500 cpu 1518f 4 pn dp mfp (44) | — | ||
| 2 | 372 | 13 | 6 | chrome (370) · android (1) · mcp toolbox for databases (1) | ↑3 | |||
| 3 | redhat | 309 | 55 | 3 | 37 | 6 | red hat enterprise linux 8 (188) · red hat enterprise linux 9 (186) · red hat enterprise linux 10 (177) | ↓1 |
| 4 | microsoft | 171 | 24 | 4 | 11 | windows server 2025 (65) · windows server 2025 server core installation (65) · windows 11 version 24h2 (60) | ↓1 | |
| 5 | apple | 100 | 6 | macos (90) · ios and ipados (70) · visionos (48) | ↑39 | |||
| 6 | apache | 87 | 19 | 12 | apache ofbiz (17) · apache http server (11) · red hat fuse 7 (8) | ↑3 | ||
| 7 | siemens | 80 | 11 | 2 | 9 | 1 | simatic s7 1500 cpu 1518 4 pn dp mfp (48) · simatic s7 1500 cpu 1518f 4 pn dp mfp (48) · siplus s7 1500 cpu 1518 4 pn dp mfp (48) | — |
| 8 | openclaw | 74 | 8 | openclaw (69) · crabbox (5) | ↓4 | |||
| 9 | edimax | 59 | ew 7438rpn (24) · br 6675nd (12) · br 6478ac (11) | · | ||||
| 10 | open webui | 59 | 1 | 2 | 2 | open webui (59) | · | |
| 11 | f5 | 53 | 4 | big ip (44) · big iq (9) · nginx open source (7) | · | |||
| 12 | adobe | 51 | 2 | adobe commerce (15) · cai content credentials (14) · substance3d designer (5) | — | |||
| 13 | totolink | 50 | 31 | 1 | a8000ru (26) · ca750 poe (9) · n300rh (7) | ↓2 | ||
| 14 | amd | 49 | 1 | amd ryzen embedded 8000 series processors (19) · amd ryzen 7035 series processors with radeon graphics formerly codenamed rembrandt r (12) · amd ryzen 7040 series mobile processors with radeon graphics (12) | · | |||
| 15 | ibm | 49 | 6 | http server (8) · db2 (6) · aspera high speed transfer endpoint (4) | — | |||
| 16 | concrete cms | 44 | 1 | 5 | 3 | concrete cms (44) | · | |
| 17 | open ises | 44 | tickets (37) · open ises project (7) | new | ||||
| 18 | mozilla | 43 | 8 | 2 | firefox (41) · thunderbird (37) · red hat enterprise linux 10 (16) | ↓4 | ||
| 19 | helmholz | 42 | mbconnect24 (40) · mymbconnect24 (40) · myrex24v2 (40) | · | ||||
| 20 | mb connect line | 42 | mbconnect24 (40) · mymbconnect24 (40) · myrex24v2 (40) | · | ||||
| 21 | mattermost | 36 | mattermost (36) | ↑77 | ||||
| 22 | sourcecodester | 34 | hospitals patient records management system (6) · sup online shopping (5) · indian invoicing system (4) | ↓9 | ||||
| 23 | netatalk | 33 | 1 | netatalk (33) | · | |||
| 24 | nvidia | 33 | 1 | 1 | 1 | geforce (12) · nvidia rtx quadro nvs (12) · tesla (12) | ↑25 | |
| 25 | hewlett packard enterprise hpe | 32 | hpe aruba networking wireless operating system aos (27) · arubaos aos (5) | · | ||||
| 26 | oracle | 32 | 9 | 1 | 1 | oracle rest data services (10) · oracle database server (3) · oracle payroll (3) | ↓20 | |
| 27 | gitlab | 31 | gitlab (31) | ↑4 | ||||
| 28 | palo alto networks | 27 | 1 | 2 | 3 | 1 | cloud ngfw (9) · pan os (9) · prisma access (9) | · |
| 29 | trendnet | 26 | tew 432brp (20) · tew 821dap (6) | · | ||||
| 30 | hcl | 24 | aion (9) · bigfix service management sm (8) · dfxanalytics (5) | · | ||||
| 31 | code projects | 23 | 3 | employee management system (9) · online hospital management system (3) · bloodbank managing system (2) | ↓23 | |||
| 32 | jetbrains | 22 | teamcity (12) · youtrack (5) · intellij idea (4) | · | ||||
| 33 | wwbn | 22 | avideo (22) | ↓9 | ||||
| 34 | budibase | 21 | 2 | budibase (21) | new | |||
| 35 | d link | 21 | 6 | di 8100 (6) · dir 816 (3) · dns 320 (3) | ↓8 | |||
| 36 | dell | 21 | 1 | powerflex manager (8) · powerflex manager appliance (8) · powerflex manager rack (8) | ↓20 | |||
| 37 | cisco | 20 | 2 | 1 | 4 | cisco catalyst sd wan manager (4) · cisco iot field network director iot fnd (3) · cisco identity services engine software (2) | ↓14 | |
| 38 | free5gc | 20 | 5 | free5gc (20) | ↑57 | |||
| 39 | joomla project | 20 | 1 | joomla cms (18) · joomla framework filter package (2) | · | |||
| 40 | patriksimek | 19 | 13 | 1 | vm2 (19) · red hat developer hub (16) · red hat ansible automation platform 2 1 (11) | · | ||
| 41 | vercel | 19 | 2 | 1 | next js (12) · red hat enterprise linux 10 (7) · red hat enterprise linux 7 (7) | · | ||
| 42 | givanz | 18 | 1 | vvveb (18) | · | |||
| 43 | synology | 18 | 1 | surveillance station (6) · beedrive for desktop (2) · active backup for business (1) | · | |||
| 44 | mantisbt | 17 | mantisbt (17) | · | ||||
| 45 | thorsten | 17 | 2 | 1 | phpmyfaq (17) | · | ||
| 46 | waterfall | 17 | 8 | wf 500 (17) | new | |||
| 47 | sap se | 16 | 2 | business server pages application taf applauncher (1) · sap application server abap for sap netweaver and abap platform (1) · sap businessobjects business intelligence platform (1) | ↓4 | |||
| 48 | trend micro | 16 | 2 | 1 | 1 | trendai apex one (12) · trendai apex one as a service (12) · trendai apex one mac (4) | · | |
| 49 | mcdope | 15 | pam usb (15) | new | ||||
| 50 | tenda | 15 | w12 (5) · ac6 (4) · f1202 (4) | ↓40 |
One CVE is counted once per vendor, product or weakness class it lists, so a ranking column sums to more than the month's total. Only the month's top 100 keys per dimension are stored. The KEV column counts CVEs published in 2026-05 that are on the CISA KEV catalog today. The 21 in the headline is what CISA listed during the month, whenever those CVEs were published. All 50 ranked vendors are listed; a zero count renders as a dot.
Weaknesses
CWE classes by distinct CVEs
- 1CWE-7957715 critical—
- 2CWE-8937734 critical—
- 3CWE-86228630 critical—
- 4CWE-2222233 critical—
- 5CWE-7820975 critical—
- 6CWE-41620011 critical↑5
- 7CWE-9419662 critical—
- 8CWE-7718542 critical↑1
- 9CWE-9181769 critical↓1
- 10CWE-2016919 critical↑7
- 1CWE-741651 critical↓5
- 2CWE-28416422 critical↓2
- 3CWE-1191629 critical—
- 4CWE-86314214 critical↑6
- 5CWE-6391357 critical↓1
- 6CWE-3521312 critical↑7
- 7CWE-12112412 critical↑1
- 8CWE-1251223 critical↑1
- 9CWE-2001209 critical↓3
- 10CWE-78710712 critical↓5
One CVE is counted once per vendor, product or weakness class it lists, so a ranking column sums to more than the month's total. Only the month's top 100 keys per dimension are stored.