month report
December 2016
Data as of Jun 11, 2026, 06:04 UTCSnapshot v1 Sources CVEList V5+NVD+GHSA+CSAF+FSTEC BDU+CISA KEV+EPSS+Nuclei templates Methodology →
December 2016 closed with 527 published CVEs — -7.1% YoY . 60 criticals, phpmyadmin led volume, mostly via phpmyadmin. Biggest breakout: vmware at ×21.0 their 12-month median. Top weakness class — CWE-119 (67 CVE). 10 vendors cracked the top-100 for the first time.
Total CVEs
527
— MoM-7.1% YoY
Severity mix
60 / 214
critical / high
KEV added
0
0 ransomware-linked
Nuclei coverage
0.6%
3 CVEs with templates
Time to exploit
How fast the community ships detection after a CVE drops.
Days → Nuclei (median)
3369.1
n=3
Within 7 days
0.0%
Within 30 days
0.0%
Days → KEV (median)
1918
n=4
Weakness × Vendor
What's spreading where in December 2016
Cells shaded by share of vendor's hottest weakness. Click any cell to open the CWE history.
119Memory Buffer Bounds79XSS200Information Exposure20Improper Input Validation264CWE-264125Out-of-bounds Read476NULL Pointer Dereference284CWE-284787Out-of-bounds Write416Use After Freephpmyadmin51161qemu1312322microsoft1236236debian1211321cisco14375tats16112adobe36387packagist343open-xchange153google22352134vmware51232adobe systems inc.287
Most discussed CVEs — December 2016
No CVE mentions in the news this month yet.
Breakout vendors
CVE count ≥3× their own 12-period median.
- 21.0×vmware21 CVE
- 12.0×phpmyadmin48 CVE
- 11.5×qemu46 CVE
- 10.0×fabrice bellard10 CVE
- 5.0×nvidia15 CVE
- 4.0×intel4 CVE
- 3.7×packagist26 CVE
- 3.7×ffmpeg11 CVE
- 3.5×siemens7 CVE
- 3.0×s9y3 CVE
First time in top-100
Vendors never in top-100 in the prior 24 periods.
- #6tats31 CVE
- #15nvidia corporation15 CVE
- #23imagemagick10 CVE
- #25bluez9 CVE
- #29joyent6 CVE
- #38bmc3 CVE
- #46samsung electronics3 CVE
- #53libvncserver project2 CVE
- #56percona2 CVE
- #57phpmailer project2 CVE
Top vendors
Ranked by distinct CVE count this period.
- 48 CVE5 critCVSS 6.7×12.0phpmyadmin (48)
- 46 CVECVSS 5.6×11.5qemu (46)
- 41 CVE1 critCVSS 7.2KEV 1PoC 5edge (11) · windows server 2016 (10) · windows 10 (10)
- 38 CVE2 critCVSS 6.0debian linux (38)
- 33 CVE1 critCVSS 7.0PoC 1web security appliance (3) · ios (3) · email security appliance (3)
- 31 CVECVSS 7.0NEWw3m (31)
- 30 CVE3 critCVSS 8.6KEV 1PoC 1flash player (17) · flash player desktop runtime (17) · flash player for linux (17)
- 26 CVE6 critCVSS 7.1×3.7KEV 1Nuclei 1PoC 4phpmyadmin/phpmyadmin (22) · phpmailer/phpmailer (2) · swiftmailer/swiftmailer (1)
- 24 CVECVSS 5.9PoC 10open-xchange appsuite (19) · ox guard (5)
- 22 CVECVSS 6.5chrome (13) · android (9)
- 21 CVE3 critCVSS 7.6×21.0PoC 2workstation player (7) · workstation pro (7) · tools (3)
- 19 CVECVSS 7.1PoC 2linux kernel (19)
- 18 CVE11 critCVSS 8.9PoC 1fedora (18)
- 15 CVECVSS 7.4×5.0gpu driver (14) · geforce experience (1)
- 15 CVECVSS 7.4NEWquadro, nvs, geforce, grid and tesla (8) · windows gpu display driver (6) · geforce experience (1)
- 14 CVE10 critCVSS 9.1libxi (2) · libx11 (2) · libxrandr (2)
- 13 CVE5 critCVSS 8.2PoC 4solaris (10) · mysql (3)
- 12 CVE1 critCVSS 6.2leap (12) · opensuse (2)
- 11 CVECVSS 6.1×3.7ffmpeg (11)
- 11 CVE1 critCVSS 7.1powerkvm (3) · filenet workplace (2) · network path manager (1)
- 11 CVE1 critCVSS 6.5virtualization (7) · openstack (6) · enterprise linux hpc node (2)
- 10 CVECVSS 6.2×10.0qemu (10)
- 10 CVE6 critCVSS 9.0NEWPoC 1imagemagick (10)
- 10 CVE5 critCVSS 8.6KEV 1Nuclei 1PoC 3debian gnu/linux (5) · linux (4) · libvncserver (2)
- 9 CVECVSS 5.5NEWPoC 1bluez (9)
- 7 CVECVSS 5.4PoC 3hybris (4) · download manager (2) · solution manager (1)
- 7 CVE1 critCVSS 7.4×3.5simatic s7-300 cpu family (2) · simatic s7-300 cpu firmware (2) · simatic s7-400 cpu firmware (2)
- 6 CVE1 critCVSS 7.8PoC 3ubuntu linux (6)
- 6 CVECVSS 7.4NEWPoC 5smartos (6)
- 6 CVE1 critCVSS 7.8rabbitmq (2) · cloud foundry elastic runtime (1) · cloud foundry ops manager (1)
- 5 CVE3 critCVSS 8.9KEV 1Nuclei 1PoC 4joomla\! (5)
- 5 CVECVSS 6.7kmail (3) · plasma-workspace (1) · kde-cli-tools (1)
- 5 CVE4 critCVSS 9.1PoC 1astra linux special edition (4) · astra linux special edition для «эльбрус» (1) · astra linux common edition (1)
- 4 CVECVSS 6.8×4.0PoC 1canyon bios (1) · citry bios (1) · city bios (1)
- 4 CVECVSS 6.7piwigo (4)
- 4 CVE1 critCVSS 8.3django (2) · bottle (1) · python-docx (1)
- 3 CVECVSS 7.4PoC 3apport (3)
- 3 CVE1 critCVSS 8.4NEWPoC 2bladelogic server automation console (1) · patrol (1) · remedy action request system (1)
- 3 CVE1 critCVSS 7.9vmware vsphere client (3) · vmware aria automation (1)
- 3 CVECVSS 6.5PoC 2mariadb (3)
- 3 CVECVSS 6.3org.springframework:spring-webmvc (1) · org.apache.tika:tika-server (1) · org.owasp.antisamy:antisamy (1)
- 3 CVECVSS 7.3modx revolution (3)
- 3 CVE2 critCVSS 8.7PoC 1pcre (3) · pcre2 (2)
- 3 CVE1 critCVSS 7.9×3.0serendipity (3)
- 3 CVE3 critCVSS 9.8samsung mobile (3)
- 3 CVE3 critCVSS 9.8NEWsamsung mobile (3)
- 3 CVECVSS 6.1spip (3)
- 3 CVECVSS 5.5wolfssl (3)
- 2 CVECVSS 6.4PoC 1http server (1) · tika (1)
- 2 CVECVSS 6.0asterisk (2) · certified asterisk (1)
| # | Vendor | CVEs | Crit | KEV | Nuclei | Signals | Top products | Δ | |
|---|---|---|---|---|---|---|---|---|---|
| 1 | phpmyadmin | 48 | 5 | · | · | ×12.0 | phpmyadmin (48) | — | |
| 2 | qemu | 46 | · | · | · | ×11.5 | qemu (46) | — | |
| 3 | microsoft | 41 | 1 | 1 | · | KEV 1PoC 5 | edge (11) · windows server 2016 (10) · windows 10 (10) | — | |
| 4 | debian | 38 | 2 | · | · | debian linux (38) | — | ||
| 5 | cisco | 33 | 1 | · | · | PoC 1 | web security appliance (3) · ios (3) · email security appliance (3) | — | |
| 6 | tats | 31 | · | · | · | NEW | w3m (31) | — | |
| 7 | adobe | 30 | 3 | 1 | · | KEV 1PoC 1 | flash player (17) · flash player desktop runtime (17) · flash player for linux (17) | — | |
| 8 | packagist | 26 | 6 | 1 | 1 | ×3.7KEV 1Nuclei 1PoC 4 | phpmyadmin/phpmyadmin (22) · phpmailer/phpmailer (2) · swiftmailer/swiftmailer (1) | — | |
| 9 | open-xchange | 24 | · | · | · | PoC 10 | open-xchange appsuite (19) · ox guard (5) | — | |
| 10 | 22 | · | · | · | chrome (13) · android (9) | — | |||
| 11 | vmware | 21 | 3 | · | · | ×21.0PoC 2 | workstation player (7) · workstation pro (7) · tools (3) | — | |
| 12 | linux | 19 | · | · | · | PoC 2 | linux kernel (19) | — | |
| 13 | fedoraproject | 18 | 11 | · | · | PoC 1 | fedora (18) | — | |
| 14 | nvidia | 15 | · | · | · | ×5.0 | gpu driver (14) · geforce experience (1) | — | |
| 15 | nvidia corporation | 15 | · | · | · | NEW | quadro, nvs, geforce, grid and tesla (8) · windows gpu display driver (6) · geforce experience (1) | — | |
| 16 | x.org | 14 | 10 | · | · | libxi (2) · libx11 (2) · libxrandr (2) | — | ||
| 17 | oracle | 13 | 5 | · | · | PoC 4 | solaris (10) · mysql (3) | — | |
| 18 | opensuse | 12 | 1 | · | · | leap (12) · opensuse (2) | — | ||
| 19 | ffmpeg | 11 | · | · | · | ×3.7 | ffmpeg (11) | — | |
| 20 | ibm | 11 | 1 | · | · | powerkvm (3) · filenet workplace (2) · network path manager (1) | — | ||
| 21 | redhat | 11 | 1 | · | · | virtualization (7) · openstack (6) · enterprise linux hpc node (2) | — | ||
| 22 | fabrice bellard | 10 | · | · | · | ×10.0 | qemu (10) | — | |
| 23 | imagemagick | 10 | 6 | · | · | NEWPoC 1 | imagemagick (10) | — | |
| 24 | сообщество свободного программного обеспечения | 10 | 5 | 1 | 1 | KEV 1Nuclei 1PoC 3 | debian gnu/linux (5) · linux (4) · libvncserver (2) | — | |
| 25 | bluez | 9 | · | · | · | NEWPoC 1 | bluez (9) | — | |
| 26 | sap | 7 | · | · | · | PoC 3 | hybris (4) · download manager (2) · solution manager (1) | — | |
| 27 | siemens | 7 | 1 | · | · | ×3.5 | simatic s7-300 cpu family (2) · simatic s7-300 cpu firmware (2) · simatic s7-400 cpu firmware (2) | — | |
| 28 | canonical | 6 | 1 | · | · | PoC 3 | ubuntu linux (6) | — | |
| 29 | joyent | 6 | · | · | · | NEWPoC 5 | smartos (6) | — | |
| 30 | pivotal software | 6 | 1 | · | · | rabbitmq (2) · cloud foundry elastic runtime (1) · cloud foundry ops manager (1) | — | ||
| 31 | joomla | 5 | 3 | 1 | 1 | KEV 1Nuclei 1PoC 4 | joomla\! (5) | — | |
| 32 | kde | 5 | · | · | · | kmail (3) · plasma-workspace (1) · kde-cli-tools (1) | — | ||
| 33 | ооо «русбитех-астра» | 5 | 4 | · | · | PoC 1 | astra linux special edition (4) · astra linux special edition для «эльбрус» (1) · astra linux common edition (1) | — | |
| 34 | intel | 4 | · | · | · | ×4.0PoC 1 | canyon bios (1) · citry bios (1) · city bios (1) | — | |
| 35 | piwigo | 4 | · | · | · | piwigo (4) | — | ||
| 36 | pypi | 4 | 1 | · | · | django (2) · bottle (1) · python-docx (1) | — | ||
| 37 | apport project | 3 | · | · | · | PoC 3 | apport (3) | — | |
| 38 | bmc | 3 | 1 | · | · | NEWPoC 2 | bladelogic server automation console (1) · patrol (1) · remedy action request system (1) | — | |
| 39 | broadcom inc. | 3 | 1 | · | · | vmware vsphere client (3) · vmware aria automation (1) | — | ||
| 40 | mariadb | 3 | · | · | · | PoC 2 | mariadb (3) | — | |
| 41 | maven | 3 | · | · | · | org.springframework:spring-webmvc (1) · org.apache.tika:tika-server (1) · org.owasp.antisamy:antisamy (1) | — | ||
| 42 | modx | 3 | · | · | · | modx revolution (3) | — | ||
| 43 | pcre | 3 | 2 | · | · | PoC 1 | pcre (3) · pcre2 (2) | — | |
| 44 | s9y | 3 | 1 | · | · | ×3.0 | serendipity (3) | — | |
| 45 | samsung | 3 | 3 | · | · | samsung mobile (3) | — | ||
| 46 | samsung electronics | 3 | 3 | · | · | NEW | samsung mobile (3) | — | |
| 47 | spip | 3 | · | · | · | spip (3) | — | ||
| 48 | wolfssl | 3 | · | · | · | wolfssl (3) | — | ||
| 49 | apache | 2 | · | · | · | PoC 1 | http server (1) · tika (1) | — | |
| 50 | digium | 2 | · | · | · | asterisk (2) · certified asterisk (1) | — |
Sectors
Solution categories ranked by distinct CVE count this period.
- Operating Systems167 CVE47 crit11 KEV26 vendorsCVSS 8.5debian linux (38) · linux kernel (19) · fedora (18)
- Cloud & SaaS85 CVE7 crit7 vendorsCVSS 8.1qemu (46)
- OSS Libraries75 CVE25 crit3 KEV22 vendorsCVSS 9.8ffmpeg (11) · imagemagick (10) · pcre (3)
- Consumer Software67 CVE7 crit4 KEV8 vendorsCVSS 8.5w3m (31) · lynx (1) · ngrinder (1)
- Databases65 CVE10 crit6 vendorsCVSS 7.7phpmyadmin (48)
- 2 crit22 KEV3 vendorsCVSS 9.8email security appliance (3) · ios (3) · web security appliance (3)
- Enterprise Software34 CVE6 crit9 vendorsCVSS 7.5powerkvm (3) · filenet workplace (2) · nagios (2)
- Communications33 CVE4 crit7 vendorsCVSS 9.8open-xchange appsuite (19) · ox guard (5) · webmail (2)
- Web & CMS Plugins30 CVE10 crit2 KEV16 vendorsCVSS 9.8joomla\! (5) · piwigo (4) · modx revolution (3)
- Mobile Apps25 CVE3 crit3 vendorsCVSS 6.9chrome (13) · android (10) · samsung mobile (3)
- Hardware Firmware21 CVE5 vendorsCVSS 8.0gpu driver (14) · quadro, nvs, geforce, grid and tesla (8) · windows gpu display driver (6)
- ICS / OT / IoT5 CVE3 crit4 vendorsCVSS 9.8samsung mobile (3)
- Security Products2 CVE2 vendorsCVSS 5.4gnupg (1) · libgcrypt (1)
- DevTools & CI1 CVE1 crit1 vendorsCVSS 9.8artifactory (1)
- Unclassified2 CVE3 crit3 vendorsCVSS 9.8barclamp-trove (1) · bdwgc (1) · crowbar-openstack (1)
| Sector | CVEs | Crit | KEV | Vendors | Products | Avg CVSS | Top products |
|---|---|---|---|---|---|---|---|
| Operating Systems▸ 4 | 167 | 47 | 11 | 26 | 85 | 8.5 | debian linux (38) · linux kernel (19) · fedora (18) |
| Cloud & SaaS▸ 3 | 85 | 7 | · | 7 | 27 | 8.1 | qemu (46) |
| OSS Libraries▸ 6 | 75 | 25 | 3 | 22 | 30 | 9.8 | ffmpeg (11) · imagemagick (10) · pcre (3) |
| Consumer Software▸ 3 | 67 | 7 | 4 | 8 | 20 | 8.5 | w3m (31) · lynx (1) · ngrinder (1) |
| Databases▸ 3 | 65 | 10 | · | 6 | 10 | 7.7 | phpmyadmin (48) |
| Networking Infrastructure▸ 2 | 35 | 2 | 22 | 3 | 48 | 9.8 | email security appliance (3) · ios (3) · web security appliance (3) |
| Enterprise Software▸ 3 | 34 | 6 | · | 9 | 89 | 7.5 | powerkvm (3) · filenet workplace (2) · nagios (2) |
| Communications▸ 3 | 33 | 4 | · | 7 | 9 | 9.8 | open-xchange appsuite (19) · ox guard (5) · webmail (2) |
| Web & CMS Plugins▸ 3 | 30 | 10 | 2 | 16 | 17 | 9.8 | joomla\! (5) · piwigo (4) · modx revolution (3) |
| Mobile Apps▸ 1 | 25 | 3 | · | 3 | 3 | 6.9 | chrome (13) · android (10) · samsung mobile (3) |
| Hardware Firmware▸ 2 | 21 | · | · | 5 | 16 | 8.0 | gpu driver (14) · quadro, nvs, geforce, grid and tesla (8) · windows gpu display driver (6) |
| ICS / OT / IoT▸ 2 | 5 | 3 | · | 4 | 6 | 9.8 | samsung mobile (3) |
| Security Products▸ 2 | 2 | · | · | 2 | 3 | 5.4 | gnupg (1) · libgcrypt (1) |
| DevTools & CI▸ 1 | 1 | 1 | · | 1 | 1 | 9.8 | artifactory (1) |
| Unclassified | 2 | 3 | · | 3 | 3 | 9.8 | barclamp-trove (1) · bdwgc (1) · crowbar-openstack (1) |
Weakness × Sector
Which weaknesses hit which solution categories in December 2016
Cells shaded by share of the sector's hottest weakness. Click a row to open the sector history.
119Memory Buffer Bounds79XSS200Information Exposure20Improper Input Validation264CWE-264125Out-of-bounds Read476NULL Pointer Dereference284CWE-284787Out-of-bounds Write416Use After FreeOperating Systems18117121564107Consumer Software3395618132811OSS Libraries94118110313Cloud & SaaS6141323122Databases51161211Communications3173112Networking Infrastructure14385Enterprise Software3942242Web & CMS Plugins19327Hardware Firmware423422