month report
April 2016
Data as of Jun 11, 2026, 06:04 UTCSnapshot v1 Sources CVEList V5+NVD+GHSA+CSAF+FSTEC BDU+CISA KEV+EPSS+Nuclei templates Methodology →
April 2016 closed with 661 published CVEs. 80 criticals, oracle led volume, mostly via mysql. Top weakness class — CWE-119 (105 CVE). 10 vendors cracked the top-100 for the first time.
Total CVEs
661
— MoM— YoY
Severity mix
80 / 282
critical / high
KEV added
0
0 ransomware-linked
Nuclei coverage
0.6%
4 CVEs with templates
Time to exploit
How fast the community ships detection after a CVE drops.
Days → Nuclei (median)
3611.2
n=4
Within 7 days
0.0%
Within 30 days
0.0%
Days → KEV (median)
2176
n=7
Weakness × Vendor
What's spreading where in April 2016
Cells shaded by share of vendor's hottest weakness. Click any cell to open the CWE history.
119Memory Buffer Bounds200Information Exposure264CWE-26420Improper Input Validation79XSS284CWE-284254CWE-254787Out-of-bounds Write399CWE-39919CWE-19oracle73133debian25105954413canonical162154721opensuse175451521redhat38363411google116166121google inc116165121oracle corp.111apache14439111fedoraproject651632111adobe1114linux151141
Most discussed CVEs — April 2016
No CVE mentions in the news this month yet.
First time in top-100
Vendors never in top-100 in the prior 24 periods.
- #29ecava8 CVE
- #30foxitsoftware8 CVE
- #32juniper networks8 CVE
- #37squid-cache7 CVE
- #38hiniarata6 CVE
- #42fedora project5 CVE
- #43jenkins5 CVE
- #44libtiff5 CVE
- #45optipng5 CVE
- #46the linux foundation5 CVE
Top vendors
Ranked by distinct CVE count this period.
- 119 CVE11 critCVSS 6.3KEV 1Nuclei 1PoC 2mysql (27) · linux (17) · solaris (13)
- 98 CVE12 critCVSS 7.0KEV 1PoC 26debian linux (98)
- 62 CVE11 critCVSS 7.1KEV 1PoC 12ubuntu linux (61) · ubuntu (13)
- 61 CVE12 critCVSS 7.3KEV 1PoC 7leap (43) · opensuse (38)
- 50 CVE6 critCVSS 7.3KEV 1PoC 3enterprise linux (20) · enterprise linux server (10) · enterprise linux workstation (10)
- 47 CVE11 critCVSS 7.8PoC 2android (37) · google chrome (9) · chrome (9)
- 30 CVE4 critCVSS 7.4KEV 1Nuclei 1PoC 13ranger (5) · jetspeed (5) · struts (5)
- 30 CVE7 critCVSS 7.6PoC 9fedora (29) · 389 directory server (1)
- 29 CVE2 critCVSS 8.7KEV 1PoC 3flash player (25) · air sdk (25) · air sdk \& compiler (25)
- 29 CVE1 critCVSS 6.1PoC 6linux kernel (29)
- 29 CVE4 critCVSS 7.5Nuclei 1PoC 12org.apache.struts:struts2-core (5) · org.apache.ranger:ranger (5) · org.jenkins-ci.main:jenkins-core (5)
- 29 CVE1 critCVSS 7.8KEV 4PoC 7windows 8.1 (10) · windows server 2012 (10) · windows 10 (8)
- 28 CVE9 critCVSS 7.7KEV 1PoC 4linux enterprise software development kit (16) · linux enterprise server (14) · linux enterprise debuginfo (12)
- 25 CVE4 critCVSS 7.3PoC 8debian gnu/linux (21) · xymon (4) · linux (3)
- 24 CVE5 critCVSS 7.8telepresence server (3) · ios (2) · prime infrastructure (2)
- 20 CVECVSS 7.1p8 firmware (8) · mate s firmware (8) · s9300 firmware (3)
- 19 CVE1 critCVSS 6.2PoC 8suse linux enterprise real time extension (12) · suse linux enterprise server (8) · suse linux enterprise debuginfo (8)
- 17 CVE4 critCVSS 6.3powerkvm (10) · tivoli storage manager fastback (5) · db2 (1)
- 16 CVE1 critCVSS 6.7pillow (4) · mercurial (3) · django (2)
- 14 CVECVSS 5.1mariadb (14)
- 14 CVECVSS 7.4firefox (14) · firefox esr (5)
- 12 CVE1 critCVSS 7.6KEV 1PoC 8netweaver application server java (5) · sap netweaver (3) · hana (2)
- 11 CVECVSS 7.1PoC 10drupal/drupal (10) · drupal/core (10) · silverstripe/cms (1)
- 11 CVECVSS 5.9PoC 1wireshark (11)
- 10 CVECVSS 7.2PoC 10drupal (10)
- 10 CVE5 critCVSS 8.3Nuclei 1PoC 1ibm tivoli storage manager fastback (5) · ibm call center for commerce (3) · zseries (1)
- 10 CVECVSS 6.5xen (10)
- 9 CVE8 critCVSS 9.7Nuclei 1PoC 1data protector (5) · hpe data protector (3) · xp7 command view advanced edition suite (1)
- 8 CVECVSS 6.1NEWintegraxor (8)
- 8 CVECVSS 7.4NEWfoxit reader (8) · phantompdf (7)
- 8 CVECVSS 7.4junos (7) · screenos (1)
- 8 CVECVSS 7.4NEWjunos (7) · screenos (1)
- 8 CVECVSS 6.3samba (8)
- 8 CVECVSS 6.3samba (8)
- 8 CVECVSS 6.3astra linux common edition (8)
- 7 CVE1 critCVSS 7.5Nuclei 1PoC 2struts (5) · activemq (1) · subversion (1)
- 7 CVECVSS 7.2NEWsquid (7)
- 6 CVECVSS 7.5NEWcasebook plugin (6)
- 6 CVE3 critCVSS 9.3opensuse (5) · opensuse leap (5) · suse linux enterprise debuginfo (2)
- 6 CVE1 critCVSS 7.8qemu (6)
- 5 CVE1 critCVSS 6.4PoC 2emc powerscale onefs (2) · bsafe crypto-j (1) · bsafe micro-edition-suite (1)
- 5 CVECVSS 5.7NEWPoC 1fedora (5)
- 5 CVE2 critCVSS 8.0NEWPoC 1jenkins (5)
- 5 CVECVSS 6.0NEWlibtiff (5)
- 5 CVECVSS 7.5NEWPoC 3optipng (5)
- 5 CVECVSS 5.7NEWxen (5)
- 5 CVE1 critCVSS 7.0NEWPoC 5xymon (5)
- 4 CVECVSS 5.9NEWenterprise server (4)
- 4 CVECVSS 8.8PoC 2cacti (4)
- 4 CVE1 critCVSS 8.1NEWdhcpcd (4)
| # | Vendor | CVEs | Crit | KEV | Nuclei | Signals | Top products | Δ | |
|---|---|---|---|---|---|---|---|---|---|
| 1 | oracle | 119 | 11 | 1 | 1 | KEV 1Nuclei 1PoC 2 | mysql (27) · linux (17) · solaris (13) | — | |
| 2 | debian | 98 | 12 | 1 | · | KEV 1PoC 26 | debian linux (98) | — | |
| 3 | canonical | 62 | 11 | 1 | · | KEV 1PoC 12 | ubuntu linux (61) · ubuntu (13) | — | |
| 4 | opensuse | 61 | 12 | 1 | · | KEV 1PoC 7 | leap (43) · opensuse (38) | — | |
| 5 | redhat | 50 | 6 | 1 | · | KEV 1PoC 3 | enterprise linux (20) · enterprise linux server (10) · enterprise linux workstation (10) | — | |
| 6 | 47 | 11 | · | · | PoC 2 | android (37) · google chrome (9) · chrome (9) | — | ||
| 7 | apache | 30 | 4 | 1 | 1 | KEV 1Nuclei 1PoC 13 | ranger (5) · jetspeed (5) · struts (5) | — | |
| 8 | fedoraproject | 30 | 7 | · | · | PoC 9 | fedora (29) · 389 directory server (1) | — | |
| 9 | adobe | 29 | 2 | 1 | · | KEV 1PoC 3 | flash player (25) · air sdk (25) · air sdk \& compiler (25) | — | |
| 10 | linux | 29 | 1 | · | · | PoC 6 | linux kernel (29) | — | |
| 11 | maven | 29 | 4 | · | 1 | Nuclei 1PoC 12 | org.apache.struts:struts2-core (5) · org.apache.ranger:ranger (5) · org.jenkins-ci.main:jenkins-core (5) | — | |
| 12 | microsoft | 29 | 1 | 4 | · | KEV 4PoC 7 | windows 8.1 (10) · windows server 2012 (10) · windows 10 (8) | — | |
| 13 | suse | 28 | 9 | 1 | · | KEV 1PoC 4 | linux enterprise software development kit (16) · linux enterprise server (14) · linux enterprise debuginfo (12) | — | |
| 14 | сообщество свободного программного обеспечения | 25 | 4 | · | · | PoC 8 | debian gnu/linux (21) · xymon (4) · linux (3) | — | |
| 15 | cisco | 24 | 5 | · | · | telepresence server (3) · ios (2) · prime infrastructure (2) | — | ||
| 16 | huawei | 20 | · | · | · | p8 firmware (8) · mate s firmware (8) · s9300 firmware (3) | — | ||
| 17 | novell | 19 | 1 | · | · | PoC 8 | suse linux enterprise real time extension (12) · suse linux enterprise server (8) · suse linux enterprise debuginfo (8) | — | |
| 18 | ibm | 17 | 4 | · | · | powerkvm (10) · tivoli storage manager fastback (5) · db2 (1) | — | ||
| 19 | pypi | 16 | 1 | · | · | pillow (4) · mercurial (3) · django (2) | — | ||
| 20 | mariadb | 14 | · | · | · | mariadb (14) | — | ||
| 21 | mozilla | 14 | · | · | · | firefox (14) · firefox esr (5) | — | ||
| 22 | sap | 12 | 1 | 1 | · | KEV 1PoC 8 | netweaver application server java (5) · sap netweaver (3) · hana (2) | — | |
| 23 | packagist | 11 | · | · | · | PoC 10 | drupal/drupal (10) · drupal/core (10) · silverstripe/cms (1) | — | |
| 24 | wireshark | 11 | · | · | · | PoC 1 | wireshark (11) | — | |
| 25 | drupal | 10 | · | · | · | PoC 10 | drupal (10) | — | |
| 26 | ibm corp. | 10 | 5 | · | 1 | Nuclei 1PoC 1 | ibm tivoli storage manager fastback (5) · ibm call center for commerce (3) · zseries (1) | — | |
| 27 | xen | 10 | · | · | · | xen (10) | — | ||
| 28 | hp | 9 | 8 | · | 1 | Nuclei 1PoC 1 | data protector (5) · hpe data protector (3) · xp7 command view advanced edition suite (1) | — | |
| 29 | ecava | 8 | · | · | · | NEW | integraxor (8) | — | |
| 30 | foxitsoftware | 8 | · | · | · | NEW | foxit reader (8) · phantompdf (7) | — | |
| 31 | juniper | 8 | · | · | · | junos (7) · screenos (1) | — | ||
| 32 | juniper networks | 8 | · | · | · | NEW | junos (7) · screenos (1) | — | |
| 33 | samba | 8 | · | · | · | samba (8) | — | ||
| 34 | samba team | 8 | · | · | · | samba (8) | — | ||
| 35 | ооо «русбитех-астра» | 8 | · | · | · | astra linux common edition (8) | — | ||
| 36 | apache software foundation | 7 | 1 | · | 1 | Nuclei 1PoC 2 | struts (5) · activemq (1) · subversion (1) | — | |
| 37 | squid-cache | 7 | · | · | · | NEW | squid (7) | — | |
| 38 | hiniarata | 6 | · | · | · | NEW | casebook plugin (6) | — | |
| 39 | novell inc. | 6 | 3 | · | · | opensuse (5) · opensuse leap (5) · suse linux enterprise debuginfo (2) | — | ||
| 40 | qemu | 6 | 1 | · | · | qemu (6) | — | ||
| 41 | dell | 5 | 1 | · | · | PoC 2 | emc powerscale onefs (2) · bsafe crypto-j (1) · bsafe micro-edition-suite (1) | — | |
| 42 | fedora project | 5 | · | · | · | NEWPoC 1 | fedora (5) | — | |
| 43 | jenkins | 5 | 2 | · | · | NEWPoC 1 | jenkins (5) | — | |
| 44 | libtiff | 5 | · | · | · | NEW | libtiff (5) | — | |
| 45 | optipng | 5 | · | · | · | NEWPoC 3 | optipng (5) | — | |
| 46 | the linux foundation | 5 | · | · | · | NEW | xen (5) | — | |
| 47 | xymon | 5 | 1 | · | · | NEWPoC 5 | xymon (5) | — | |
| 48 | blackberry | 4 | · | · | · | NEW | enterprise server (4) | — | |
| 49 | cacti | 4 | · | · | · | PoC 2 | cacti (4) | — | |
| 50 | dhcpcd project | 4 | 1 | · | · | NEW | dhcpcd (4) | — |
Sectors
Solution categories ranked by distinct CVE count this period.
- Operating Systems254 CVE136 crit68 KEV29 vendorsCVSS 7.8debian linux (98) · ubuntu linux (61) · leap (43)
- Databases129 CVE31 crit6 KEV7 vendorsCVSS 7.5mysql (51) · linux (17) · solaris (15)
- OSS Libraries103 CVE15 crit32 vendorsCVSS 7.7libtiff (6) · optipng (6) · glibc (4)
- Enterprise Software81 CVE37 crit16 KEV24 vendorsCVSS 9.8powerkvm (10) · cacti (5) · data protector (5)
- Mobile Apps70 CVE23 crit5 vendorsCVSS 7.6android (72) · chrome (9) · google chrome (9)
- Web & CMS Plugins62 CVE7 crit1 KEV13 vendorsCVSS 7.2drupal (10) · struts (10) · jetspeed (5)
- 12 crit18 vendorsCVSS 8.4junos (14) · prime infrastructure (4) · telepresence server (3)
- Consumer Software54 CVE8 crit6 KEV9 vendorsCVSS 8.6flash player (49) · air sdk (25) · air sdk \& compiler (25)
- Security Products37 CVE6 crit18 vendorsCVSS 7.5wireshark (11) · salt (1)
- Cloud & SaaS32 CVE1 crit9 vendorsCVSS 7.8xen (10) · kubernetes (1)
- ICS / OT / IoT19 CVE4 crit8 vendorsCVSS 8.1integraxor (8) · proface gp-pro ex ex-ed (4) · proface gp-pro ex pfxexedls (4)
- Hardware Firmware13 CVE2 crit8 vendorsCVSS 8.7aquos hn-pp150 firmware (1) · eva animator (1) · lexmark (1)
- DevTools & CI12 CVE7 crit6 vendorsCVSS 9.4git (5) · mercurial (3)
- Communications11 CVE5 crit10 vendorsCVSS 9.8claws-mail (2) · groupware (2) · exim (1)
- AI / ML2 CVE1 crit1 vendorsCVSS 8.1foomatic-filters (2) · cups-filters (1)
- Unclassified8 CVE6 vendorsCVSS 7.6keymouse firmware (3) · bluedriver (1) · electron (1)
| Sector | CVEs | Crit | KEV | Vendors | Products | Avg CVSS | Top products |
|---|---|---|---|---|---|---|---|
| Operating Systems▸ 4 | 254 | 136 | 68 | 29 | 141 | 7.8 | debian linux (98) · ubuntu linux (61) · leap (43) |
| Databases▸ 2 | 129 | 31 | 6 | 7 | 56 | 7.5 | mysql (51) · linux (17) · solaris (15) |
| OSS Libraries▸ 8 | 103 | 15 | · | 32 | 61 | 7.7 | libtiff (6) · optipng (6) · glibc (4) |
| Enterprise Software▸ 5 | 81 | 37 | 16 | 24 | 62 | 9.8 | powerkvm (10) · cacti (5) · data protector (5) |
| Mobile Apps▸ 2 | 70 | 23 | · | 5 | 30 | 7.6 | android (72) · chrome (9) · google chrome (9) |
| Web & CMS Plugins▸ 3 | 62 | 7 | 1 | 13 | 26 | 7.2 | drupal (10) · struts (10) · jetspeed (5) |
| Networking Infrastructure▸ 6 | 57 | 12 | · | 18 | 51 | 8.4 | junos (14) · prime infrastructure (4) · telepresence server (3) |
| Consumer Software▸ 4 | 54 | 8 | 6 | 9 | 25 | 8.6 | flash player (49) · air sdk (25) · air sdk \& compiler (25) |
| Security Products▸ 5 | 37 | 6 | · | 18 | 51 | 7.5 | wireshark (11) · salt (1) |
| Cloud & SaaS▸ 3 | 32 | 1 | · | 9 | 15 | 7.8 | xen (10) · kubernetes (1) |
| ICS / OT / IoT▸ 3 | 19 | 4 | · | 8 | 11 | 8.1 | integraxor (8) · proface gp-pro ex ex-ed (4) · proface gp-pro ex pfxexedls (4) |
| Hardware Firmware▸ 4 | 13 | 2 | · | 8 | 12 | 8.7 | aquos hn-pp150 firmware (1) · eva animator (1) · lexmark (1) |
| DevTools & CI▸ 2 | 12 | 7 | · | 6 | 4 | 9.4 | git (5) · mercurial (3) |
| Communications▸ 3 | 11 | 5 | · | 10 | 12 | 9.8 | claws-mail (2) · groupware (2) · exim (1) |
| AI / ML▸ 1 | 2 | 1 | · | 1 | 2 | 8.1 | foomatic-filters (2) · cups-filters (1) |
| Unclassified | 8 | · | · | 6 | 6 | 7.6 | keymouse firmware (3) · bluedriver (1) · electron (1) |
Weakness × Sector
Which weaknesses hit which solution categories in April 2016
Cells shaded by share of the sector's hottest weakness. Click a row to open the sector history.
119Memory Buffer Bounds200Information Exposure264CWE-26420Improper Input Validation79XSS284CWE-284254CWE-254787Out-of-bounds Write399CWE-39919CWE-19Operating Systems62293326141414175OSS Libraries27161011106121514Enterprise Software88555221Consumer Software25432253142Databases6114122Networking Infrastructure19351225183Web & CMS Plugins1641123211Hardware Firmware10245535Cloud & SaaS583316111Security Products42434311