CVE Tools
Sign in
month report

May 2016

Data as of Jun 11, 2026, 06:04 UTCSnapshot v1 Sources CVEList V5+NVD+GHSA+CSAF+FSTEC BDU+CISA KEV+EPSS+Nuclei templates Methodology →

May 2016 closed with 617 published CVEs — +48.0% YoY . 154 criticals, adobe led volume, mostly via acrobat dc. Biggest breakout: php group at ×8.5 their 12-month median. Top weakness class — CWE-119 (136 CVE). 10 vendors cracked the top-100 for the first time.

Print view
Total CVEs
617
-6.7% MoM+48.0% YoY
Severity mix
154 / 287
critical / high
KEV added
0
0 ransomware-linked
Nuclei coverage
1.6%
10 CVEs with templates

Time to exploit

How fast the community ships detection after a CVE drops.

Days → Nuclei (median)
3575.8
n=10
Within 7 days
0.0%
Within 30 days
0.0%
Days → KEV (median)
2008
n=7
Detection gap

KEV pressure, no Nuclei coverage

May 2016 · vendors with active exploitation listed by CISA but no public detection template.

Weakness × Vendor

What's spreading where in May 2016

Cells shaded by share of vendor's hottest weakness. Click any cell to open the CWE history.

119Memory Buffer Bounds200Information Exposure20Improper Input Validation264CWE-264284CWE-28479XSS399CWE-399190Integer Overflow254CWE-254189CWE-189adobe4931181adobe systems inc.493181apple3794151apple inc.368415canonical9104412debian1558242123microsoft961051linux1932221microsoft corp86951redhat68731221php1111211311php group1111211311

Most discussed CVEs — May 2016

No CVE mentions in the news this month yet.

Breakout vendors

CVE count ≥3× their own 12-period median.

First time in top-100

Vendors never in top-100 in the prior 24 periods.

Top vendors

Ranked by distinct CVE count this period.

  • 1adobe↑8
    121 CVE89 critCVSS 9.5
    ×3.6KEV 1PoC 10
    acrobat dc (92) · adobe reader (92) · adobe reader document cloud (92)
  • 2apple↑103
    77 CVE4 critCVSS 7.3
    PoC 21
    mac os x (67) · os x (64) · ios (39)
  • 3canonical·
    74 CVE5 critCVSS 6.8
    KEV 3PoC 22
    ubuntu linux (64) · ubuntu (17) · ubuntu core (3)
  • 4debian↓2
    58 CVE7 critCVSS 7.4
    KEV 1PoC 9
    debian linux (58)
  • 5microsoft↑7
    58 CVECVSS 7.5
    KEV 2PoC 16
    microsoft edge (28) · edge (28) · internet explorer (28)
  • 6linux↑4
    56 CVECVSS 6.4
    ×6.6PoC 12
    linux kernel (56)
  • 7redhat↓2
    56 CVE10 critCVSS 7.0
    ×3.0KEV 3PoC 20
    enterprise linux desktop (35) · enterprise linux server (35) · enterprise linux workstation (35)
  • 8php↑149
    53 CVE30 critCVSS 8.6
    ×5.3PoC 20
    php (53)
  • 9php group—
    51 CVE30 critCVSS 8.7
    ×8.5PoC 19
    php (51)
  • 10google↓4
    49 CVE5 critCVSS 7.5
    PoC 2
    android (35) · chrome (12) · google chrome (3)
  • 11opensuse↓7
    43 CVE18 critCVSS 8.3
    KEV 4PoC 17
    opensuse (29) · leap (27) · evergreen (1)
  • 12сообщество свободного программного обеспечения↑2
    27 CVE2 critCVSS 7.2
    ×3.9PoC 13
    debian gnu/linux (21) · libxml2 (4) · libarchive (1)
  • 13cisco↑2
    22 CVE1 critCVSS 7.6
    web security appliance \(wsa\) (2) · adaptive security appliance software (2) · cisco ios (2)
  • 14fedoraproject↓6
    21 CVE8 critCVSS 8.2
    PoC 6
    fedora (21)
  • 15oracle↓14
    18 CVE1 critCVSS 7.2
    KEV 2PoC 4
    linux (12) · vm server (5) · solaris (3)
  • 16hp↑12
    16 CVE2 critCVSS 7.1
    PoC 1
    network node manager i (6) · system management homepage (2) · helion openstack (2)
  • 17novell·
    16 CVECVSS 5.1
    ×3.2PoC 5
    suse linux enterprise software development kit (16) · suse linux enterprise server (16) · suse linux enterprise workstation extension (13)
  • 18packagist↑5
    11 CVECVSS 5.4
    ×3.7Nuclei 1PoC 1
    moodle/moodle (10) · contao-components/mediaelement (1) · contao/core (1)
  • 19xmlsoft↑83
    11 CVECVSS 6.6
    ×7.3PoC 3
    libxml2 (11)
  • 20mcafee↑43
    10 CVE1 critCVSS 6.3
    ×5.0PoC 6
    web gateway (7) · livesafe (1) · policy auditor (1)
  • 21moodle—
    10 CVECVSS 5.2
    moodle (10)
  • 22фссп россии—
    10 CVECVSS 6.7
    ×6.7PoC 3
    ос тд аис фссп россии (10)
  • 23botan—
    9 CVE2 critCVSS 8.0
    NEW
    botan (9)
  • 24wordpress—
    9 CVECVSS 6.2
    Nuclei 9PoC 1
    wordpress (9)
  • 25emc↑56
    8 CVECVSS 5.6
    PoC 7
    rsa data loss prevention (4) · rsa authentication manager (3) · isilonsd edge onefs (1)
  • 26enlightenment—
    8 CVE1 critCVSS 7.9
    NEW
    imlib2 (8)
  • 27maven↓16
    8 CVECVSS 5.4
    org.jenkins-ci.main:jenkins-core (7) · com.thoughtworks.xstream:xstream (1)
  • 28moxa—
    8 CVECVSS 7.8
    ×4.0
    edr-g903 firmware (5) · miineport e1 4641 firmware (3) · miineport e1 7080 firmware (3)
  • 29qemu↑11
    8 CVECVSS 6.7
    ×4.0
    qemu (8)
  • 30suse↓17
    8 CVE3 critCVSS 6.7
    KEV 4PoC 5
    linux enterprise software development kit (5) · linux enterprise server (4) · linux enterprise desktop (4)
  • 31apache↓24
    7 CVE1 critCVSS 5.9
    PoC 2
    subversion (2) · ambari (2) · cordova (2)
  • 32huawei↓16
    7 CVE1 critCVSS 8.1
    PoC 1
    ngfw module firmware (2) · mate 8 firmware (2) · secospace usg6300 firmware (2)
  • 33ibm↓15
    7 CVECVSS 6.2
    algo one (1) · b2b advanced communications (1) · bluemix (1)
  • 34ivanti—
    7 CVE1 critCVSS 7.0
    NEW
    connect secure (7)
  • 35jenkins↑8
    7 CVECVSS 5.1
    jenkins (7)
  • 36juniper networks↓4
    7 CVECVSS 6.7
    ×3.5PoC 3
    junos space (7)
  • 37openssl—
    7 CVE1 critCVSS 7.7
    PoC 6
    openssl (7)
  • 38wireshark↓14
    7 CVECVSS 5.9
    PoC 1
    wireshark (7)
  • 39novell inc.·
    6 CVECVSS 7.6
    PoC 4
    suse linux enterprise server (5) · opensuse leap (4) · opensuse tumbleweed (4)
  • 40pulsesecure↑121
    6 CVE1 critCVSS 7.3
    ×4.0
    pulse connect secure (6)
  • 41ооо «русбитех-астра»↓6
    6 CVECVSS 7.3
    ×3.0PoC 5
    astra linux common edition (4) · astra linux special edition (2)
  • 42imagemagick—
    5 CVECVSS 5.6
    NEWKEV 3PoC 5
    imagemagick (5)
  • 43openssl software foundation—
    5 CVE1 critCVSS 8.1
    PoC 5
    openssl (5)
  • 44webkitgtk—
    5 CVECVSS 8.3
    ×3.3PoC 5
    webkitgtk\+ (5)
  • 45accellion—
    4 CVE1 critCVSS 8.1
    NEWPoC 2
    file transfer appliance (4)
  • 46panasonic—
    4 CVECVSS 4.5
    fpwin pro (4)
  • 47squid-cache↓10
    4 CVECVSS 8.1
    ×4.0
    squid (4)
  • 48gnome—
    3 CVECVSS 7.5
    librsvg (3)
  • 49meteocontrol—
    3 CVE3 critCVSS 9.5
    NEWPoC 1
    web\'log basic 100 (3) · web\'log light (3) · web\'log pro (3)
  • 50nodejs↑42
    3 CVECVSS 7.4
    PoC 2
    node.js (3)

Top weaknesses

CWE classes by distinct CVE count.

1CWE-119136·
2CWE-20063·
3CWE-2057↑1
4CWE-26457↓1
5CWE-28441↑1
6CWE-7926↓1
7CWE-39915↑2
8CWE-1907↑22
9CWE-2547↓2
10CWE-1896↑7
11CWE-2875↑9
12CWE-3105↑3
13CWE-3625↑1
14CWE-1254↑13
15CWE-2694↑17
16CWE-4164·
17CWE-4764↑4
18CWE-894↓5
19CWE-3453↑5
20CWE-3523↓8

Sectors

Solution categories ranked by distinct CVE count this period.

  • Operating Systems259 CVE
    115 crit80 KEV24 vendorsCVSS 7.6
    ubuntu linux (64) · debian linux (58) · linux kernel (56)
  • Mobile Apps133 CVE
    24 crit5 vendorsCVSS 7.7
    mac os x (67) · os x (64) · ios (39)
  • Consumer Software131 CVE
    701 crit2 KEV6 vendorsCVSS 9.5
    acrobat dc (92) · acrobat reader dc (92) · adobe acrobat (92)
  • OSS Libraries124 CVE
    69 crit5 KEV33 vendorsCVSS 8.8
    php (104) · openssl (12) · libxml2 (11)
  • Networking Infrastructure44 CVE
    3 crit9 vendorsCVSS 8.3
    junos space (7) · adaptive security appliance software (2) · cisco ios (2)
  • Security Products44 CVE
    6 crit12 vendorsCVSS 7.3
    web gateway (7) · anti-virus engine (1) · email encryption gateway (1)
  • Web & CMS Plugins30 CVE
    3 crit9 vendorsCVSS 9.8
    moodle (12) · wordpress (9) · ambari (2)
  • Enterprise Software30 CVE
    4 crit1 KEV8 vendorsCVSS 10.0
    network node manager i (6) · foreman (2) · helion openstack (2)
  • Databases18 CVE
    1 crit4 KEV2 vendorsCVSS 7.2
    linux (12) · vm server (5) · solaris (3)
  • Cloud & SaaS17 CVE
    9 crit6 vendorsCVSS 8.9
    qemu (8)
  • ICS / OT / IoT16 CVE
    14 crit4 vendorsCVSS 9.5
    edr-g903 firmware (5) · miineport e1 4641 firmware (3) · miineport e1 7080 firmware (3)
  • DevTools & CI9 CVE
    3 vendorsCVSS 8.8
    jenkins (7)
  • Hardware Firmware2 CVE
    1 vendorsCVSS 7.5
    shareit (2)
  • Communications1 CVE
    1 vendorsCVSS 6.5
    alertwerks servsensor contact firmware (1) · alertwerks servsensor firmware (1) · alertwerks servsensor junior firmware (1)
  • Unclassified17 CVE
    2 crit5 vendorsCVSS 7.1
    ос тд аис фссп россии (10) · esc 8832 data controller (2) · intuitive 650 tdb controller (2)
Weakness × Sector

Which weaknesses hit which solution categories in May 2016

Cells shaded by share of the sector's hottest weakness. Click a row to open the sector history.

119Memory Buffer Bounds200Information Exposure20Improper Input Validation264CWE-264284CWE-28479XSS399CWE-399190Integer Overflow254CWE-254189CWE-189Operating Systems683633431624536Consumer Software637731211OSS Libraries2611246415422Networking Infrastructure11412368Security Products3324712Web & CMS Plugins414210ICS / OT / IoT352111Cloud & SaaS43231Enterprise Software36261Databases2111111