July 2015

644 CVEs published, +29% on June 2015 and −2% on July 2014. CISA added 0 to KEV.

2015, month by month. Point at another month to read it.

2015: CVEs published per month
Year	Jan	Feb	Mar	Apr	May	Jun	Jul	Aug	Sep	Oct	Nov	Dec	Year total
2015	January 2015: 737 CVEs	February 2015: 496 CVEs	March 2015: 457 CVEs	April 2015: 558 CVEs	May 2015: 417 CVEs	June 2015: 499 CVEs	July 2015: 644 CVEs	August 2015: 625 CVEs	September 2015: 499 CVEs	October 2015: 739 CVEs	November 2015: 368 CVEs	December 2015: 567 CVEs	6,606−18%

Critical: 12620% of the 637 with a CVSS score
Added to CISA KEV: 09 of this month's CVEs are in KEV, listed a median 2443 days after publication
Vendors: 129419 products
Top weakness: Memory Buffer BoundsCWE-119 · 108 CVEs

Who drove it

Vendors by distinct CVEs this month, with how many of those CVEs are now in CISA KEV and how far each moved in the ranking.

Severity

How this month's CVEs score on CVSS; 7 have no score yet. Severity is not exploitation.

Critical12620%
High9916%
Medium35856%
Low548%

Breakouts

Vendors with at least three times their own 12-month median.

New in the top 100

Not in the top 100 in any of the 24 months before.

What kind of weakness

Weakness classes (CWE) by distinct CVEs, with how far each moved in the ranking.

Where it landed

The month's CVEs by the sector of the software they affect. A CVE that touches several sectors counts in each.

Area is CVEs this month. Point at a sector to read it.

Which weakness, where

The top weakness classes against the vendors and the sectors that carried them.

The lighter the cell, the more CVEs. Point at one to read it.

July 2015: weakness classes by vendor and by sector: By vendor
By vendor	119Memory Buffer Bounds	200Information Exposure	79XSS	20Improper Input Validation	264	284Improper Access Control	399	352CSRF	254	17
Oracle	6	2		1			2		1	6
Adobe	20	7		1		6
Oracle Corp.
Adobe Systems Inc.	20					5
Apple	38	6	1	1	5	5	1		7
Microsoft	26	11	1	3	7	2			1
Cisco	1	1	5	7	6	1	14	11
Microsoft Corp	25	10	1	1	6	2			1
Debian	8	1	1	2	1		2		3	7
Opensuse	7	3	2	1	1				3	3
Canonical	6			1	1		1			5
Red Hat	4	1	1	1	2				3	2

CVEs published in July 2015

11 vulnerabilities from this month that were exploited in the wild (CISA KEV), covered in the news, explained on cve.tools or searched for. Known-exploited first, then by CVSS.