month report
October 2016
Data as of Jun 11, 2026, 06:04 UTCSnapshot v1 Sources CVEList V5+NVD+GHSA+CSAF+FSTEC BDU+CISA KEV+EPSS+Nuclei templates Methodology →
October 2016 closed with 697 published CVEs — -5.7% YoY . 143 criticals, oracle led volume, mostly via mysql. Biggest breakout: nuget at ×7.0 their 12-month median. Top weakness class — CWE-284 (95 CVE). 10 vendors cracked the top-100 for the first time.
Total CVEs
697
— MoM-5.7% YoY
Severity mix
143 / 270
critical / high
KEV added
0
0 ransomware-linked
Nuclei coverage
6.7%
47 CVEs with templates
Time to exploit
How fast the community ships detection after a CVE drops.
Days → Nuclei (median)
3434.0
n=47
Within 7 days
0.0%
Within 30 days
0.0%
Days → KEV (median)
2048
n=3
Detection gap
KEV pressure, no Nuclei coverage
October 2016 · vendors with active exploitation listed by CISA but no public detection template.
- KEV 3microsoft36 CVE
Weakness × Vendor
What's spreading where in October 2016
Cells shaded by share of vendor's hottest weakness. Click any cell to open the CWE history.
284CWE-284119Memory Buffer Bounds200Information Exposure79XSS264CWE-26420Improper Input Validation416Use After Free399CWE-39989SQL Injection254CWE-254oracle69261413adobe251231adobe systems inc.248221google451725711cisco344415152microsoft213991ibm357311microsoft corp11224linux312112redhat2121111huge-it711libtiff
Most discussed CVEs — October 2016
No CVE mentions in the news this month yet.
Breakout vendors
CVE count ≥3× their own 12-period median.
First time in top-100
Vendors never in top-100 in the prior 24 periods.
- #9huge-it13 CVE
- #23yandex6 CVE
- #24ооо «яндекс»6 CVE
- #28yandex n.v.5 CVE
- #30animas4 CVE
- #32hpe4 CVE
- #34ruckus4 CVE
- #39filedownload project3 CVE
- #41libcsp3 CVE
- #45american auto-matrix2 CVE
Top vendors
Ranked by distinct CVE count this period.
- 159 CVE12 critCVSS 6.4×5.3PoC 2mysql (25) · agile product lifecycle management (11) · solaris (10)
- 88 CVE74 critCVSS 9.7PoC 1acrobat dc (74) · reader (74) · acrobat (74)
- 73 CVE10 critCVSS 7.3PoC 3android (72) · chrome (1) · google chrome (1)
- 56 CVE4 critCVSS 8.2PoC 3ios (11) · ios xe (11) · email security appliance (10)
- 36 CVE1 critCVSS 7.1KEV 3PoC 7windows 10 (18) · windows rt 8.1 (16) · windows 8.1 (16)
- 25 CVECVSS 6.6security guardium database activity monitor (5) · security guardium (4) · websphere application server (4)
- 19 CVE2 critCVSS 6.7PoC 2linux kernel (19)
- 16 CVECVSS 6.3PoC 4enterprise linux server (7) · enterprise linux desktop (6) · enterprise linux workstation (6)
- 13 CVE4 critCVSS 7.7NEWPoC 9slider (2) · slideshow (2) · catalog (2)
- 12 CVECVSS 7.4×4.0PoC 5libtiff (12)
- 11 CVE4 critCVSS 7.4debian linux (11)
- 9 CVECVSS 6.9×4.5PoC 3openjpeg (9)
- 8 CVE2 critCVSS 7.4PoC 1ubuntu linux (8)
- 8 CVECVSS 7.4keyview (4) · system management homepage (4)
- 8 CVECVSS 5.6mariadb (8)
- 7 CVE4 critCVSS 8.8PoC 3tomcat (3) · commons fileupload (1) · derby (1)
- 7 CVE4 critCVSS 8.2Nuclei 1PoC 2commons-fileupload:commons-fileupload (1) · io.undertow:undertow-core (1) · org.apache.derby:derby (1)
- 7 CVECVSS 7.5×7.0microsoft.chakracore (7)
- 7 CVECVSS 7.3PoC 1opensuse (5) · leap (5)
- 7 CVE1 critCVSS 6.9PoC 1netweaver (4) · sap aba (1) · sap basis (1)
- 6 CVECVSS 7.4reader (6) · phantompdf (5)
- 6 CVE1 critCVSS 6.3s12700 firmware (2) · s5300 firmware (2) · s5700 firmware (2)
- 6 CVECVSS 6.1NEWyandex browser (5) · yandex.browser (1)
- 6 CVECVSS 6.1NEWяндекс бразуер (6)
- 5 CVE2 critCVSS 8.0Nuclei 1PoC 1fedora (5)
- 5 CVE1 critCVSS 5.5qemu (5)
- 5 CVE1 critCVSS 5.4×3.3automation license manager (3) · siemens simatic step 7 (tia portal) (2) · simatic step 7 (2)
- 5 CVECVSS 6.2NEWyandex browser for desktop (5)
- 4 CVE2 critCVSS 8.0PoC 3open source security information and event management (4) · unified security management (4)
- 4 CVE2 critCVSS 8.7NEWonetouch ping firmware (4)
- 4 CVE2 critCVSS 8.7PoC 2mujs (4)
- 4 CVECVSS 6.7NEWhpe system management homepage before v7.6 (4)
- 4 CVE1 critCVSS 5.6PoC 3drupal/core (3) · drupal/drupal (3) · adodb/adodb-php (1)
- 4 CVECVSS 7.6NEWPoC 1wireless h500 (4)
- 4 CVECVSS 7.3libtiff (4)
- 3 CVE3 critCVSS 9.6struts (2) · commons fileupload (1) · derby (1)
- 3 CVECVSS 4.9PoC 3drupal (3)
- 3 CVE2 critCVSS 9.5solutions enabler (2) · unisphere (2) · networker module for microsoft applications (1)
- 3 CVE1 critCVSS 8.0NEWNuclei 3PoC 1filedownload (3)
- 3 CVE1 critCVSS 7.0fortiwlc (2) · fortimanager firmware (1) · fortianalyzer firmware (1)
- 3 CVE3 critCVSS 9.8NEWlibcsp (3)
- 3 CVE1 critCVSS 7.3node.js (3)
- 3 CVECVSS 7.5PoC 1cinder (1) · django (1) · flask-oidc (1)
- 3 CVECVSS 7.5debian gnu/linux (3) · dbd-mysql (1) · openjpeg (1)
- 2 CVECVSS 8.1NEWaspect-matrix building automation front-end solutions application (2) · aspect-nexus building automation front-end solutions application (2)
- 2 CVE2 critCVSS 9.1embedded pc images (2) · twincat (2) · twincat components featuring automation device specification (ads) communication (2)
- 2 CVECVSS 7.5NEWestore (2)
- 2 CVECVSS 7.9license server (1) · license server vpx (1) · netscaler application delivery controller firmware (1)
- 2 CVECVSS 5.5PoC 1clamav (2)
- 2 CVE1 critCVSS 9.3emc unisphere (2)
| # | Vendor | CVEs | Crit | KEV | Nuclei | Signals | Top products | Δ | |
|---|---|---|---|---|---|---|---|---|---|
| 1 | oracle | 159 | 12 | · | · | ×5.3PoC 2 | mysql (25) · agile product lifecycle management (11) · solaris (10) | — | |
| 2 | adobe | 88 | 74 | · | · | PoC 1 | acrobat dc (74) · reader (74) · acrobat (74) | — | |
| 3 | 73 | 10 | · | · | PoC 3 | android (72) · chrome (1) · google chrome (1) | — | ||
| 4 | cisco | 56 | 4 | · | · | PoC 3 | ios (11) · ios xe (11) · email security appliance (10) | — | |
| 5 | microsoft | 36 | 1 | 3 | · | KEV 3PoC 7 | windows 10 (18) · windows rt 8.1 (16) · windows 8.1 (16) | — | |
| 6 | ibm | 25 | · | · | · | security guardium database activity monitor (5) · security guardium (4) · websphere application server (4) | — | ||
| 7 | linux | 19 | 2 | · | · | PoC 2 | linux kernel (19) | — | |
| 8 | redhat | 16 | · | · | · | PoC 4 | enterprise linux server (7) · enterprise linux desktop (6) · enterprise linux workstation (6) | — | |
| 9 | huge-it | 13 | 4 | · | · | NEWPoC 9 | slider (2) · slideshow (2) · catalog (2) | — | |
| 10 | libtiff | 12 | · | · | · | ×4.0PoC 5 | libtiff (12) | — | |
| 11 | debian | 11 | 4 | · | · | debian linux (11) | — | ||
| 12 | uclouvain | 9 | · | · | · | ×4.5PoC 3 | openjpeg (9) | — | |
| 13 | canonical | 8 | 2 | · | · | PoC 1 | ubuntu linux (8) | — | |
| 14 | hp | 8 | · | · | · | keyview (4) · system management homepage (4) | — | ||
| 15 | mariadb | 8 | · | · | · | mariadb (8) | — | ||
| 16 | apache | 7 | 4 | · | · | PoC 3 | tomcat (3) · commons fileupload (1) · derby (1) | — | |
| 17 | maven | 7 | 4 | · | 1 | Nuclei 1PoC 2 | commons-fileupload:commons-fileupload (1) · io.undertow:undertow-core (1) · org.apache.derby:derby (1) | — | |
| 18 | nuget | 7 | · | · | · | ×7.0 | microsoft.chakracore (7) | — | |
| 19 | opensuse | 7 | · | · | · | PoC 1 | opensuse (5) · leap (5) | — | |
| 20 | sap | 7 | 1 | · | · | PoC 1 | netweaver (4) · sap aba (1) · sap basis (1) | — | |
| 21 | foxitsoftware | 6 | · | · | · | reader (6) · phantompdf (5) | — | ||
| 22 | huawei | 6 | 1 | · | · | s12700 firmware (2) · s5300 firmware (2) · s5700 firmware (2) | — | ||
| 23 | yandex | 6 | · | · | · | NEW | yandex browser (5) · yandex.browser (1) | — | |
| 24 | ооо «яндекс» | 6 | · | · | · | NEW | яндекс бразуер (6) | — | |
| 25 | fedoraproject | 5 | 2 | · | 1 | Nuclei 1PoC 1 | fedora (5) | — | |
| 26 | qemu | 5 | 1 | · | · | qemu (5) | — | ||
| 27 | siemens | 5 | 1 | · | · | ×3.3 | automation license manager (3) · siemens simatic step 7 (tia portal) (2) · simatic step 7 (2) | — | |
| 28 | yandex n.v. | 5 | · | · | · | NEW | yandex browser for desktop (5) | — | |
| 29 | alienvault | 4 | 2 | · | · | PoC 3 | open source security information and event management (4) · unified security management (4) | — | |
| 30 | animas | 4 | 2 | · | · | NEW | onetouch ping firmware (4) | — | |
| 31 | artifex | 4 | 2 | · | · | PoC 2 | mujs (4) | — | |
| 32 | hpe | 4 | · | · | · | NEW | hpe system management homepage before v7.6 (4) | — | |
| 33 | packagist | 4 | 1 | · | · | PoC 3 | drupal/core (3) · drupal/drupal (3) · adodb/adodb-php (1) | — | |
| 34 | ruckus | 4 | · | · | · | NEWPoC 1 | wireless h500 (4) | — | |
| 35 | silicon graphics corp. | 4 | · | · | · | libtiff (4) | — | ||
| 36 | apache software foundation | 3 | 3 | · | · | struts (2) · commons fileupload (1) · derby (1) | — | ||
| 37 | drupal | 3 | · | · | · | PoC 3 | drupal (3) | — | |
| 38 | emc | 3 | 2 | · | · | solutions enabler (2) · unisphere (2) · networker module for microsoft applications (1) | — | ||
| 39 | filedownload project | 3 | 1 | · | 3 | NEWNuclei 3PoC 1 | filedownload (3) | — | |
| 40 | fortinet | 3 | 1 | · | · | fortiwlc (2) · fortimanager firmware (1) · fortianalyzer firmware (1) | — | ||
| 41 | libcsp | 3 | 3 | · | · | NEW | libcsp (3) | — | |
| 42 | nodejs | 3 | 1 | · | · | node.js (3) | — | ||
| 43 | pypi | 3 | · | · | · | PoC 1 | cinder (1) · django (1) · flask-oidc (1) | — | |
| 44 | сообщество свободного программного обеспечения | 3 | · | · | · | debian gnu/linux (3) · dbd-mysql (1) · openjpeg (1) | — | ||
| 45 | american auto-matrix | 2 | · | · | · | NEW | aspect-matrix building automation front-end solutions application (2) · aspect-nexus building automation front-end solutions application (2) | — | |
| 46 | beckhoff | 2 | 2 | · | · | embedded pc images (2) · twincat (2) · twincat components featuring automation device specification (ads) communication (2) | — | ||
| 47 | brooky | 2 | · | · | · | NEW | estore (2) | — | |
| 48 | citrix | 2 | · | · | · | license server (1) · license server vpx (1) · netscaler application delivery controller firmware (1) | — | ||
| 49 | clamav | 2 | · | · | · | PoC 1 | clamav (2) | — | |
| 50 | dell | 2 | 1 | · | · | emc unisphere (2) | — |
Sectors
Solution categories ranked by distinct CVE count this period.
- Databases168 CVE28 crit8 vendorsCVSS 9.8mysql (25) · agile product lifecycle management (11) · flexcube universal banking (10)
- Consumer Software104 CVE580 crit8 vendorsCVSS 9.7reader (80) · acrobat (74) · acrobat dc (74)
- Operating Systems102 CVE22 crit50 KEV16 vendorsCVSS 7.3linux kernel (19) · debian linux (11) · ubuntu linux (8)
- Mobile Apps79 CVE15 crit3 vendorsCVSS 7.1android (74) · ar firmware (2) · quidway s5300 firmware (2)
- OSS Libraries67 CVE16 crit23 vendorsCVSS 8.2libtiff (12) · openjpeg (9) · mujs (4)
- 41 crit6 vendorsCVSS 8.2ios (11) · ios xe (11) · email security appliance (10)
- Enterprise Software49 CVE3 crit8 vendorsCVSS 8.8security guardium database activity monitor (5) · keyview (4) · security guardium (4)
- Web & CMS Plugins48 CVE19 crit22 vendorsCVSS 8.0drupal (3) · struts (3) · tomcat (3)
- Security Products19 CVE18 crit8 vendorsCVSS 9.8identity manager (2) · solutions enabler (2) · unisphere (2)
- Cloud & SaaS13 CVE1 crit7 vendorsCVSS 7.9qemu (5)
- Hardware Firmware6 CVE2 vendorsCVSS 6.7hpe system management homepage before v7.6 (4)
- ICS / OT / IoT3 CVE6 crit2 vendorsCVSS 9.1embedded pc images (2) · twincat (2) · twincat components featuring automation device specification (ads) communication (2)
- DevTools & CI2 CVE2 vendorsCVSS 5.8docker2aci (1) · jetty (1)
- Unclassified27 CVE4 crit20 vendorsCVSS 7.4onetouch ping firmware (4) · argus (2) · aspect-matrix building automation front-end solutions application (2)
| Sector | CVEs | Crit | KEV | Vendors | Products | Avg CVSS | Top products |
|---|---|---|---|---|---|---|---|
| Databases▸ 4 | 168 | 28 | · | 8 | 71 | 9.8 | mysql (25) · agile product lifecycle management (11) · flexcube universal banking (10) |
| Consumer Software▸ 3 | 104 | 580 | · | 8 | 19 | 9.7 | reader (80) · acrobat (74) · acrobat dc (74) |
| Operating Systems▸ 3 | 102 | 22 | 50 | 16 | 84 | 7.3 | linux kernel (19) · debian linux (11) · ubuntu linux (8) |
| Mobile Apps▸ 1 | 79 | 15 | · | 3 | 18 | 7.1 | android (74) · ar firmware (2) · quidway s5300 firmware (2) |
| OSS Libraries▸ 7 | 67 | 16 | · | 23 | 34 | 8.2 | libtiff (12) · openjpeg (9) · mujs (4) |
| Networking Infrastructure▸ 3 | 63 | 41 | · | 6 | 67 | 8.2 | ios (11) · ios xe (11) · email security appliance (10) |
| Enterprise Software▸ 5 | 49 | 3 | · | 8 | 27 | 8.8 | security guardium database activity monitor (5) · keyview (4) · security guardium (4) |
| Web & CMS Plugins▸ 5 | 48 | 19 | · | 22 | 33 | 8.0 | drupal (3) · struts (3) · tomcat (3) |
| Security Products▸ 4 | 19 | 18 | · | 8 | 21 | 9.8 | identity manager (2) · solutions enabler (2) · unisphere (2) |
| Cloud & SaaS▸ 3 | 13 | 1 | · | 7 | 12 | 7.9 | qemu (5) |
| Hardware Firmware▸ 2 | 6 | · | · | 2 | 3 | 6.7 | hpe system management homepage before v7.6 (4) |
| ICS / OT / IoT▸ 2 | 3 | 6 | · | 2 | 4 | 9.1 | embedded pc images (2) · twincat (2) · twincat components featuring automation device specification (ads) communication (2) |
| DevTools & CI▸ 1 | 2 | · | · | 2 | 2 | 5.8 | docker2aci (1) · jetty (1) |
| Unclassified | 27 | 4 | · | 20 | 21 | 7.4 | onetouch ping firmware (4) · argus (2) · aspect-matrix building automation front-end solutions application (2) |
Weakness × Sector
Which weaknesses hit which solution categories in October 2016
Cells shaded by share of the sector's hottest weakness. Click a row to open the sector history.
284CWE-284119Memory Buffer Bounds200Information Exposure79XSS264CWE-26420Improper Input Validation416Use After Free399CWE-39989SQL Injection254CWE-254Operating Systems151229333121414Consumer Software3636341233Enterprise Software4041982113OSS Libraries121665321421Networking Infrastructure35756191532Databases14825322Web & CMS Plugins2232532151Security Products7156121Cloud & SaaS4313311ICS / OT / IoT1211112