month report
September 2016
Data as of Jun 11, 2026, 06:04 UTCSnapshot v1 Sources CVEList V5+NVD+GHSA+CSAF+FSTEC BDU+CISA KEV+EPSS+Nuclei templates Methodology →
September 2016 closed with 597 published CVEs — +19.6% YoY . 76 criticals, apple led volume, mostly via iphone os. Biggest breakout: php group at ×8.5 their 12-month median. Top weakness class — CWE-119 (99 CVE). 10 vendors cracked the top-100 for the first time.
Total CVEs
597
— MoM+19.6% YoY
Severity mix
76 / 279
critical / high
KEV added
0
0 ransomware-linked
Nuclei coverage
0.0%
0 CVEs with templates
Time to exploit
How fast the community ships detection after a CVE drops.
Days → Nuclei (median)
—
n=0
Within 7 days
—%
Within 30 days
—%
Days → KEV (median)
2256
n=2
Weakness × Vendor
What's spreading where in September 2016
Cells shaded by share of vendor's hottest weakness. Click any cell to open the CWE history.
119Memory Buffer Bounds200Information Exposure264CWE-26420Improper Input Validation79XSS284CWE-284416Use After Free787Out-of-bounds Write399CWE-399125Out-of-bounds Readapple33204712113google7102014105microsoft20107212ibm193175microsoft corp167512adobe811411cisco441139debian81311242canonical34311opensuse2112423huawei1522102libarchive5518
Most discussed CVEs — September 2016
No CVE mentions in the news this month yet.
Breakout vendors
CVE count ≥3× their own 12-period median.
- 8.5×php group17 CVE
- 7.0×emc14 CVE
- 4.0×python4 CVE
- 4.0×huawei28 CVE
- 4.0×siemens4 CVE
- 4.0×fabrice bellard4 CVE
- 4.0×gnu8 CVE
- 3.9×сообщество свободного программного обеспечения27 CVE
- 3.2×php19 CVE
- 3.0×ооо «русбитех-астра»6 CVE
First time in top-100
Vendors never in top-100 in the prior 24 periods.
- #36cloudfoundry4 CVE
- #44aver3 CVE
- #45misp-project3 CVE
- #47pivotal3 CVE
- #50ооо «инновационные технологии в бизнесе»3 CVE
- #52aternity2 CVE
- #53barry warsaw2 CVE
- #56irssi2 CVE
- #57jose-php project2 CVE
- #59node.js foundation2 CVE
Top vendors
Ranked by distinct CVE count this period.
- 80 CVE4 critCVSS 7.7iphone os (48) · mac os x (47) · tvos (28)
- 72 CVE1 critCVSS 7.1PoC 1android (39) · chrome (32) · chrome os (1)
- 53 CVECVSS 7.1KEV 1PoC 6windows 10 (19) · windows 8.1 (15) · windows rt 8.1 (15)
- 47 CVE8 critCVSS 7.2PoC 10ubuntu linux (29) · ubuntu (19)
- 42 CVECVSS 5.7connections (14) · security privileged identity manager virtual appliance (7) · tealeaf customer experience (6)
- 39 CVE11 critCVSS 8.7PoC 2flash player desktop runtime (26) · flash player (26) · digital editions (9)
- 39 CVE4 critCVSS 6.9KEV 1PoC 4ios (9) · firesight system software (4) · small business 220 series smart plus switches (4)
- 32 CVE6 critCVSS 7.3PoC 5debian linux (32)
- 29 CVE1 critCVSS 7.3PoC 1leap (29) · opensuse (6) · libstorage (1)
- 28 CVE3 critCVSS 7.1×4.0PoC 1honor 4c firmware (5) · rh1288 v3 server firmware (4) · xh620 v3 server firmware (4)
- 28 CVECVSS 6.5PoC 8libarchive (28)
- 28 CVE4 critCVSS 7.6PoC 4enterprise linux workstation (8) · enterprise linux server (8) · enterprise linux server aus (8)
- 27 CVE11 critCVSS 8.1×3.9PoC 4debian gnu/linux (25) · libarchive (1) · libxml2 (1)
- 20 CVE8 critCVSS 8.5firefox (20) · firefox esr (3) · thunderbird (3)
- 20 CVE2 critCVSS 7.4PoC 6linux (13) · vm server (5) · solaris (3)
- 19 CVE10 critCVSS 8.7×3.2PoC 5php (19)
- 17 CVE9 critCVSS 8.6×8.5PoC 4php (17)
- 14 CVE3 critCVSS 7.2×7.0avamar server (5) · vipr srm (5) · documentum d2 (1)
- 13 CVE3 critCVSS 7.7PoC 2openssl (13)
- 11 CVE2 critCVSS 7.7PoC 1integrated lights-out 3 firmware (2) · network automation (2) · performance center (2)
- 11 CVE1 critCVSS 6.7PoC 1suse linux enterprise software development kit (7) · suse linux enterprise desktop (7) · suse linux enterprise server (7)
- 11 CVE3 critCVSS 7.7PoC 1openssl (11)
- 10 CVE2 critCVSS 7.7PoC 1org.jboss.mod_cluster:mod_cluster-parent (1) · org.jboss.resteasy:resteasy-client (1) · org.jboss.resteasy:resteasy-jaxrs (1)
- 9 CVE3 critCVSS 7.9cloud foundry elastic runtime (6) · cloud foundry uaa (3) · cloud foundry (3)
- 9 CVECVSS 6.0PoC 4linux enterprise desktop (9) · linux enterprise server (9) · linux enterprise software development kit (9)
- 8 CVECVSS 7.9×4.0PoC 1libidn (4) · mailman (2) · wget (1)
- 7 CVE2 critCVSS 8.4PoC 1opensuse leap (6) · suse linux enterprise desktop (3) · suse linux enterprise server (3)
- 6 CVE1 critCVSS 7.7PoC 2ranger (1) · activemq artemis (1) · cxf fediz (1)
- 6 CVECVSS 7.3PoC 1fedora (6)
- 6 CVE1 critCVSS 7.4×3.0fortiwan (5) · fortiswitch (1)
- 6 CVE1 critCVSS 7.5×3.0PoC 2node.js (6)
- 6 CVECVSS 5.9wireshark (6)
- 6 CVE1 critCVSS 6.8×3.0astra linux common edition (4) · astra linux special edition (2)
- 5 CVE1 critCVSS 7.2junos (5)
- 5 CVECVSS 5.8qemu (5)
- 4 CVE1 critCVSS 7.8NEWcloud foundry uaa bosh (3) · php-buildpack (1)
- 4 CVECVSS 5.6×4.0qemu (4)
- 4 CVECVSS 7.8libtiff (4)
- 4 CVE1 critCVSS 7.4PoC 1trytond (2) · murano (1) · jwcrypto (1)
- 4 CVE1 critCVSS 7.5×4.0PoC 1python (4)
- 4 CVE1 critCVSS 6.7PoC 4trex (2) · hana db (1) · hana (1)
- 4 CVE1 critCVSS 6.8×4.0en100 ethernet module firmware (3) · scalance m-800 firmware (1) · scalance s615 firmware (1)
- 4 CVECVSS 6.8xen (4)
- 3 CVE2 critCVSS 9.0NEWeh6108h\+ firmware (3)
- 3 CVE2 critCVSS 8.6NEWmalware information sharing platform (3)
- 3 CVECVSS 7.9oncommand shift (1) · oncommand system manager (1) · plug-in for symantec netbackup (1)
- 3 CVE1 critCVSS 8.2NEWcloud foundry elastic runtime (2) · operations manager (1)
- 3 CVECVSS 7.3authoritative (2) · authoritative server (1)
- 3 CVE1 critCVSS 7.8PoC 2actionview (1) · activerecord (1) · nokogiri (1)
- 3 CVE2 critCVSS 9.0NEWemias os (3)
| # | Vendor | CVEs | Crit | KEV | Nuclei | Signals | Top products | Δ | |
|---|---|---|---|---|---|---|---|---|---|
| 1 | apple | 80 | 4 | · | · | iphone os (48) · mac os x (47) · tvos (28) | — | ||
| 2 | 72 | 1 | · | · | PoC 1 | android (39) · chrome (32) · chrome os (1) | — | ||
| 3 | microsoft | 53 | · | 1 | · | KEV 1PoC 6 | windows 10 (19) · windows 8.1 (15) · windows rt 8.1 (15) | — | |
| 4 | canonical | 47 | 8 | · | · | PoC 10 | ubuntu linux (29) · ubuntu (19) | — | |
| 5 | ibm | 42 | · | · | · | connections (14) · security privileged identity manager virtual appliance (7) · tealeaf customer experience (6) | — | ||
| 6 | adobe | 39 | 11 | · | · | PoC 2 | flash player desktop runtime (26) · flash player (26) · digital editions (9) | — | |
| 7 | cisco | 39 | 4 | 1 | · | KEV 1PoC 4 | ios (9) · firesight system software (4) · small business 220 series smart plus switches (4) | — | |
| 8 | debian | 32 | 6 | · | · | PoC 5 | debian linux (32) | — | |
| 9 | opensuse | 29 | 1 | · | · | PoC 1 | leap (29) · opensuse (6) · libstorage (1) | — | |
| 10 | huawei | 28 | 3 | · | · | ×4.0PoC 1 | honor 4c firmware (5) · rh1288 v3 server firmware (4) · xh620 v3 server firmware (4) | — | |
| 11 | libarchive | 28 | · | · | · | PoC 8 | libarchive (28) | — | |
| 12 | redhat | 28 | 4 | · | · | PoC 4 | enterprise linux workstation (8) · enterprise linux server (8) · enterprise linux server aus (8) | — | |
| 13 | сообщество свободного программного обеспечения | 27 | 11 | · | · | ×3.9PoC 4 | debian gnu/linux (25) · libarchive (1) · libxml2 (1) | — | |
| 14 | mozilla | 20 | 8 | · | · | firefox (20) · firefox esr (3) · thunderbird (3) | — | ||
| 15 | oracle | 20 | 2 | · | · | PoC 6 | linux (13) · vm server (5) · solaris (3) | — | |
| 16 | php | 19 | 10 | · | · | ×3.2PoC 5 | php (19) | — | |
| 17 | php group | 17 | 9 | · | · | ×8.5PoC 4 | php (17) | — | |
| 18 | emc | 14 | 3 | · | · | ×7.0 | avamar server (5) · vipr srm (5) · documentum d2 (1) | — | |
| 19 | openssl | 13 | 3 | · | · | PoC 2 | openssl (13) | — | |
| 20 | hp | 11 | 2 | · | · | PoC 1 | integrated lights-out 3 firmware (2) · network automation (2) · performance center (2) | — | |
| 21 | novell | 11 | 1 | · | · | PoC 1 | suse linux enterprise software development kit (7) · suse linux enterprise desktop (7) · suse linux enterprise server (7) | — | |
| 22 | openssl software foundation | 11 | 3 | · | · | PoC 1 | openssl (11) | — | |
| 23 | maven | 10 | 2 | · | · | PoC 1 | org.jboss.mod_cluster:mod_cluster-parent (1) · org.jboss.resteasy:resteasy-client (1) · org.jboss.resteasy:resteasy-jaxrs (1) | — | |
| 24 | pivotal software | 9 | 3 | · | · | cloud foundry elastic runtime (6) · cloud foundry uaa (3) · cloud foundry (3) | — | ||
| 25 | suse | 9 | · | · | · | PoC 4 | linux enterprise desktop (9) · linux enterprise server (9) · linux enterprise software development kit (9) | — | |
| 26 | gnu | 8 | · | · | · | ×4.0PoC 1 | libidn (4) · mailman (2) · wget (1) | — | |
| 27 | novell inc. | 7 | 2 | · | · | PoC 1 | opensuse leap (6) · suse linux enterprise desktop (3) · suse linux enterprise server (3) | — | |
| 28 | apache | 6 | 1 | · | · | PoC 2 | ranger (1) · activemq artemis (1) · cxf fediz (1) | — | |
| 29 | fedoraproject | 6 | · | · | · | PoC 1 | fedora (6) | — | |
| 30 | fortinet | 6 | 1 | · | · | ×3.0 | fortiwan (5) · fortiswitch (1) | — | |
| 31 | nodejs | 6 | 1 | · | · | ×3.0PoC 2 | node.js (6) | — | |
| 32 | wireshark | 6 | · | · | · | wireshark (6) | — | ||
| 33 | ооо «русбитех-астра» | 6 | 1 | · | · | ×3.0 | astra linux common edition (4) · astra linux special edition (2) | — | |
| 34 | juniper | 5 | 1 | · | · | junos (5) | — | ||
| 35 | qemu | 5 | · | · | · | qemu (5) | — | ||
| 36 | cloudfoundry | 4 | 1 | · | · | NEW | cloud foundry uaa bosh (3) · php-buildpack (1) | — | |
| 37 | fabrice bellard | 4 | · | · | · | ×4.0 | qemu (4) | — | |
| 38 | libtiff | 4 | · | · | · | libtiff (4) | — | ||
| 39 | pypi | 4 | 1 | · | · | PoC 1 | trytond (2) · murano (1) · jwcrypto (1) | — | |
| 40 | python | 4 | 1 | · | · | ×4.0PoC 1 | python (4) | — | |
| 41 | sap | 4 | 1 | · | · | PoC 4 | trex (2) · hana db (1) · hana (1) | — | |
| 42 | siemens | 4 | 1 | · | · | ×4.0 | en100 ethernet module firmware (3) · scalance m-800 firmware (1) · scalance s615 firmware (1) | — | |
| 43 | xen | 4 | · | · | · | xen (4) | — | ||
| 44 | aver | 3 | 2 | · | · | NEW | eh6108h\+ firmware (3) | — | |
| 45 | misp-project | 3 | 2 | · | · | NEW | malware information sharing platform (3) | — | |
| 46 | netapp | 3 | · | · | · | oncommand shift (1) · oncommand system manager (1) · plug-in for symantec netbackup (1) | — | ||
| 47 | pivotal | 3 | 1 | · | · | NEW | cloud foundry elastic runtime (2) · operations manager (1) | — | |
| 48 | powerdns | 3 | · | · | · | authoritative (2) · authoritative server (1) | — | ||
| 49 | rubygems | 3 | 1 | · | · | PoC 2 | actionview (1) · activerecord (1) · nokogiri (1) | — | |
| 50 | ооо «инновационные технологии в бизнесе» | 3 | 2 | · | · | NEW | emias os (3) | — |
Sectors
Solution categories ranked by distinct CVE count this period.
- Mobile Apps180 CVE28 crit5 vendorsCVSS 7.7android (40) · chrome (32) · honor 4c firmware (5)
- Operating Systems177 CVE46 crit4 KEV17 vendorsCVSS 7.3debian linux (32) · leap (29) · ubuntu linux (29)
- OSS Libraries110 CVE41 crit27 vendorsCVSS 8.1php (36) · libarchive (28) · openssl (24)
- Enterprise Software69 CVE11 crit9 vendorsCVSS 9.8connections (14) · security privileged identity manager virtual appliance (7) · tealeaf customer experience (6)
- Consumer Software62 CVE31 crit8 vendorsCVSS 8.7flash player (37) · flash player desktop runtime (26) · digital editions (9)
- 7 crit3 KEV9 vendorsCVSS 9.8ios (9) · junos (7) · firesight system software (4)
- Cloud & SaaS37 CVE14 crit11 vendorsCVSS 8.1cloud foundry elastic runtime (8) · cloud foundry (3) · cloud foundry ops manager (3)
- Security Products34 CVE30 crit8 vendorsCVSS 8.9avamar server (5) · vipr srm (5) · documentum d2 (1)
- Databases21 CVE4 crit6 vendorsCVSS 7.5linux (14) · vm server (5) · solaris (3)
- Web & CMS Plugins12 CVE2 crit7 vendorsCVSS 8.6drupal (2) · zookeeper (2) · activemq artemis (1)
- ICS / OT / IoT8 CVE2 crit5 vendorsCVSS 9.0eh6108h\+ firmware (3)
- Communications5 CVE3 vendorsCVSS 8.8irssi (2) · inspircd (1)
- Hardware Firmware2 CVE1 crit2 vendorsCVSS 9.8bios (1)
- Unclassified6 CVE2 crit5 vendorsCVSS 8.0aternity (2) · charybdis (1) · imaging suite (1)
| Sector | CVEs | Crit | KEV | Vendors | Products | Avg CVSS | Top products |
|---|---|---|---|---|---|---|---|
| Mobile Apps▸ 2 | 180 | 28 | · | 5 | 58 | 7.7 | android (40) · chrome (32) · honor 4c firmware (5) |
| Operating Systems▸ 2 | 177 | 46 | 4 | 17 | 119 | 7.3 | debian linux (32) · leap (29) · ubuntu linux (29) |
| OSS Libraries▸ 8 | 110 | 41 | · | 27 | 45 | 8.1 | php (36) · libarchive (28) · openssl (24) |
| Enterprise Software▸ 4 | 69 | 11 | · | 9 | 53 | 9.8 | connections (14) · security privileged identity manager virtual appliance (7) · tealeaf customer experience (6) |
| Consumer Software▸ 3 | 62 | 31 | · | 8 | 17 | 8.7 | flash player (37) · flash player desktop runtime (26) · digital editions (9) |
| Networking Infrastructure▸ 3 | 51 | 7 | 3 | 9 | 58 | 9.8 | ios (9) · junos (7) · firesight system software (4) |
| Cloud & SaaS▸ 4 | 37 | 14 | · | 11 | 20 | 8.1 | cloud foundry elastic runtime (8) · cloud foundry (3) · cloud foundry ops manager (3) |
| Security Products▸ 4 | 34 | 30 | · | 8 | 39 | 8.9 | avamar server (5) · vipr srm (5) · documentum d2 (1) |
| Databases▸ 1 | 21 | 4 | · | 6 | 38 | 7.5 | linux (14) · vm server (5) · solaris (3) |
| Web & CMS Plugins▸ 3 | 12 | 2 | · | 7 | 11 | 8.6 | drupal (2) · zookeeper (2) · activemq artemis (1) |
| ICS / OT / IoT▸ 4 | 8 | 2 | · | 5 | 9 | 9.0 | eh6108h\+ firmware (3) |
| Communications▸ 2 | 5 | · | · | 3 | 3 | 8.8 | irssi (2) · inspircd (1) |
| Hardware Firmware▸ 2 | 2 | 1 | · | 2 | 2 | 9.8 | bios (1) |
| Unclassified | 6 | 2 | · | 5 | 5 | 8.0 | aternity (2) · charybdis (1) · imaging suite (1) |
Weakness × Sector
Which weaknesses hit which solution categories in September 2016
Cells shaded by share of the sector's hottest weakness. Click a row to open the sector history.
119Memory Buffer Bounds200Information Exposure264CWE-26420Improper Input Validation79XSS284CWE-284416Use After Free787Out-of-bounds Write399CWE-399125Out-of-bounds ReadOperating Systems63353722613108414Consumer Software461365624132OSS Libraries241121123411314Networking Infrastructure464153211141Enterprise Software6102317411Security Products11510411Cloud & SaaS423333611Hardware Firmware512182Databases14251112Web & CMS Plugins52112