month report
May 2017
Data as of Jun 11, 2026, 06:04 UTCSnapshot v1 Sources CVEList V5+NVD+GHSA+CSAF+FSTEC BDU+CISA KEV+EPSS+Nuclei templates Methodology →
May 2017 closed with 4,155 published CVEs. 153 criticals, google led volume, mostly via android. Biggest breakout: ао «концерн вниинс» at ×14.0 their 12-month median. Top weakness class — CWE-119 (141 CVE). 10 vendors cracked the top-100 for the first time.
Total CVEs
4,155
— MoM— YoY
Severity mix
153 / 469
critical / high
KEV added
0
0 ransomware-linked
Nuclei coverage
0.7%
31 CVEs with templates
Time to exploit
How fast the community ships detection after a CVE drops.
Days → Nuclei (median)
3214.3
n=31
Within 7 days
0.0%
Within 30 days
0.0%
Days → KEV (median)
1753
n=10
Detection gap
KEV pressure, no Nuclei coverage
May 2017 · vendors with active exploitation listed by CISA but no public detection template.
- KEV 6microsoft70 CVE
- KEV 6microsoft corporation69 CVE
- KEV 1сообщество свободного программного обеспечения50 CVE
- KEV 1ооо «русбитех-астра»30 CVE
- KEV 1canonical22 CVE
Weakness × Vendor
What's spreading where in May 2017
Cells shaded by share of vendor's hottest weakness. Click any cell to open the CWE history.
119Memory Buffer Bounds79XSS200Information Exposure20Improper Input Validation125Out-of-bounds Read264CWE-264295Improper Certificate Validation352CSRF476NULL Pointer Dereference787Out-of-bounds Writeapple4652521google inc1041821google inc.61621611microsoft261149152microsoft corporation261149152google114382linux16321111autotrace project121158сообщество свободного программного обеспечения5338231debian1373212cisco2197161apple inc.231
Most discussed CVEs — May 2017
No CVE mentions in the news this month yet.
Breakout vendors
CVE count ≥3× their own 12-period median.
- 14.0×ао «концерн вниинс»14 CVE
- 10.7×packagist32 CVE
- 10.0×apache software foundation10 CVE
- 10.0×vmware10 CVE
- 6.7×ооо «русбитех-астра»30 CVE
- 6.5×juniper networks13 CVE
- 6.0×nextcloud6 CVE
- 6.0×ао "нппкт"6 CVE
- 6.0×videolan6 CVE
- 5.0×pivotal15 CVE
First time in top-100
Vendors never in top-100 in the prior 24 periods.
- #3google inc.70 CVE
- #5microsoft corporation69 CVE
- #7autotrace project50 CVE
- #15ibm corporation23 CVE
- #16qualcomm, inc.23 CVE
- #21nvidia corporation15 CVE
- #23ао «концерн вниинс»14 CVE
- #26accellion12 CVE
- #29basercms users community12 CVE
- #38entropymine9 CVE
Top vendors
Ranked by distinct CVE count this period.
- 87 CVE1 critCVSS 7.3PoC 1android (84) · qualcomm secure execution environment (18) · chrome (2)
- 78 CVE10 critCVSS 8.2PoC 30iphone os (53) · mac os x (44) · tvos (35)
- 70 CVECVSS 6.6NEWPoC 1android (70)
- 70 CVE3 critCVSS 6.9KEV 6PoC 16windows server 2008 (27) · windows 7 (26) · windows server 2016 (25)
- 69 CVE2 critCVSS 6.8NEWKEV 6PoC 16microsoft edge (12) · microsoft windows (11) · malware protection engine (7)
- 58 CVECVSS 6.3×3.4PoC 3linux kernel (58)
- 50 CVE33 critCVSS 9.0NEWautotrace (50)
- 50 CVE8 critCVSS 7.5KEV 1PoC 6debian gnu/linux (42) · linux (9) · libxml2 (5)
- 48 CVE10 critCVSS 7.7KEV 1Nuclei 6PoC 5debian linux (47) · lintian (1)
- 35 CVE2 critCVSS 7.0PoC 1remote expert manager (7) · prime collaboration provisioning (5) · firepower threat defense (2)
- 32 CVE3 critCVSS 6.5×10.7PoC 10genix/cms (6) · modx/revolution (5) · baserproject/basercms (4)
- 31 CVE8 critCVSS 8.5KEV 1Nuclei 1PoC 3enterprise linux workstation (12) · enterprise linux desktop (12) · red hat enterprise linux (12)
- 30 CVE6 critCVSS 7.6×6.7KEV 1PoC 5astra linux special edition (22) · astra linux common edition (17) · astra linux special edition для «эльбрус» (11)
- 27 CVE1 critCVSS 6.2PoC 1rational team concert (4) · rational quality manager (4) · maximo asset management essentials (3)
- 23 CVE1 critCVSS 6.7NEWPoC 1rational collaborative lifecycle management (4) · marketing platform (2) · interact (2)
- 23 CVECVSS 7.5NEWall qualcomm products (20) · android for msm, firefox os for msm, qrd android (3)
- 22 CVE7 critCVSS 7.7KEV 1PoC 6ubuntu (15) · ubuntu linux (12) · juju (1)
- 17 CVECVSS 6.9binutils (15) · glibc (1) · libtasn1 (1)
- 16 CVE2 critCVSS 7.8Nuclei 1PoC 1org.springframework.security:spring-security-core (3) · org.cloudfoundry.identity:cloudfoundry-identity-server (2) · org.springframework:spring-core (2)
- 15 CVECVSS 7.2gpu driver (15)
- 15 CVECVSS 7.2NEWgpu display driver (15)
- 15 CVE3 critCVSS 7.8×5.0Nuclei 1cloud foundry (10) · spring security (3) · spring framework (2)
- 14 CVE2 critCVSS 7.2NEW×14.0PoC 2ос он «стрелец» (14)
- 13 CVE1 critCVSS 7.3×6.5junos space (7) · junos (3) · junos os running on qfx3500, qfx3600, qfx5100, qfx5200, ex4300, ex4600 devices (1)
- 13 CVE3 critCVSS 7.2PoC 3opensuse leap (10) · suse linux enterprise desktop (7) · opensuse (5)
- 12 CVE5 critCVSS 7.9NEWPoC 5file transfer appliance (12)
- 12 CVECVSS 7.5ambari (2) · cxf fediz (2) · bookkeeper (1)
- 12 CVECVSS 7.8basercms (12) · mail (2)
- 12 CVECVSS 8.0NEWbasercms (4) · basercms plugin blog (3) · basercms plugin mail (3)
- 12 CVECVSS 7.0junos space (7) · junos (5)
- 12 CVE2 critCVSS 7.3cloud foundry elastic runtime (10) · cloud foundry uaa (5) · cloud foundry (3)
- 10 CVECVSS 7.5×10.0apache ambari (2) · apache cxf fediz (2) · apache qpid broker-j (1)
- 10 CVE1 critCVSS 7.6big-ip access policy manager (10) · big-ip application acceleration manager (8) · big-ip application security manager (8)
- 10 CVE1 critCVSS 8.4big-ip (4) · big-ip apm (2) · big-ip advanced firewall manager (1)
- 10 CVE2 critCVSS 7.0×4.0PoC 1microsoft.chakracore (6) · microsoft.aspnetcore.mvc.cors (4) · microsoft.aspnetcore.mvc.dataannotations (4)
- 10 CVE2 critCVSS 7.0×10.0PoC 3spring security (3) · spring framework (3) · airwatch agent (2)
- 9 CVE1 critCVSS 7.0cf-release (6) · cloud foundry uaa bosh (2) · garden linux (1)
- 9 CVECVSS 6.5NEWimageworsener (9)
- 9 CVE1 critCVSS 6.5fortiportal (5) · fortimanager firmware (1) · fortinet fortios (1)
- 9 CVECVSS 6.6PoC 1imagemagick (9)
- 9 CVECVSS 6.1×3.0Nuclei 1network data loss prevention (7) · network data loss prevention (ndlp) (7) · epolicy orchestrator (1)
- 9 CVE7 critCVSS 9.2PoC 4php (9)
- 8 CVECVSS 8.7PoC 1flash player desktop runtime (7) · flash player (7) · experience manager forms (1)
- 8 CVE1 critCVSS 7.0NEWfortinet fortiportal (5) · fortinet fortiweb (1) · fortinet fortiwlc-sd (1)
- 8 CVE1 critCVSS 7.9PoC 6serverprotect (6) · officescan (2)
- 7 CVECVSS 7.5NEWopenexr (7)
- 7 CVE2 critCVSS 8.1node.js (7)
- 7 CVECVSS 7.5NEWopenexr (7)
- 7 CVECVSS 7.1PoC 2openssl (7)
- 7 CVECVSS 7.0PoC 2openssl (7)
| # | Vendor | CVEs | Crit | KEV | Nuclei | Signals | Top products | Δ | |
|---|---|---|---|---|---|---|---|---|---|
| 1 | 87 | 1 | · | · | PoC 1 | android (84) · qualcomm secure execution environment (18) · chrome (2) | — | ||
| 2 | apple | 78 | 10 | · | · | PoC 30 | iphone os (53) · mac os x (44) · tvos (35) | — | |
| 3 | google inc. | 70 | · | · | · | NEWPoC 1 | android (70) | — | |
| 4 | microsoft | 70 | 3 | 6 | · | KEV 6PoC 16 | windows server 2008 (27) · windows 7 (26) · windows server 2016 (25) | — | |
| 5 | microsoft corporation | 69 | 2 | 6 | · | NEWKEV 6PoC 16 | microsoft edge (12) · microsoft windows (11) · malware protection engine (7) | — | |
| 6 | linux | 58 | · | · | · | ×3.4PoC 3 | linux kernel (58) | — | |
| 7 | autotrace project | 50 | 33 | · | · | NEW | autotrace (50) | — | |
| 8 | сообщество свободного программного обеспечения | 50 | 8 | 1 | · | KEV 1PoC 6 | debian gnu/linux (42) · linux (9) · libxml2 (5) | — | |
| 9 | debian | 48 | 10 | 1 | 6 | KEV 1Nuclei 6PoC 5 | debian linux (47) · lintian (1) | — | |
| 10 | cisco | 35 | 2 | · | · | PoC 1 | remote expert manager (7) · prime collaboration provisioning (5) · firepower threat defense (2) | — | |
| 11 | packagist | 32 | 3 | · | · | ×10.7PoC 10 | genix/cms (6) · modx/revolution (5) · baserproject/basercms (4) | — | |
| 12 | redhat | 31 | 8 | 1 | 1 | KEV 1Nuclei 1PoC 3 | enterprise linux workstation (12) · enterprise linux desktop (12) · red hat enterprise linux (12) | — | |
| 13 | ооо «русбитех-астра» | 30 | 6 | 1 | · | ×6.7KEV 1PoC 5 | astra linux special edition (22) · astra linux common edition (17) · astra linux special edition для «эльбрус» (11) | — | |
| 14 | ibm | 27 | 1 | · | · | PoC 1 | rational team concert (4) · rational quality manager (4) · maximo asset management essentials (3) | — | |
| 15 | ibm corporation | 23 | 1 | · | · | NEWPoC 1 | rational collaborative lifecycle management (4) · marketing platform (2) · interact (2) | — | |
| 16 | qualcomm, inc. | 23 | · | · | · | NEW | all qualcomm products (20) · android for msm, firefox os for msm, qrd android (3) | — | |
| 17 | canonical | 22 | 7 | 1 | · | KEV 1PoC 6 | ubuntu (15) · ubuntu linux (12) · juju (1) | — | |
| 18 | gnu | 17 | · | · | · | binutils (15) · glibc (1) · libtasn1 (1) | — | ||
| 19 | maven | 16 | 2 | · | 1 | Nuclei 1PoC 1 | org.springframework.security:spring-security-core (3) · org.cloudfoundry.identity:cloudfoundry-identity-server (2) · org.springframework:spring-core (2) | — | |
| 20 | nvidia | 15 | · | · | · | gpu driver (15) | — | ||
| 21 | nvidia corporation | 15 | · | · | · | NEW | gpu display driver (15) | — | |
| 22 | pivotal | 15 | 3 | · | 1 | ×5.0Nuclei 1 | cloud foundry (10) · spring security (3) · spring framework (2) | — | |
| 23 | ао «концерн вниинс» | 14 | 2 | · | · | NEW×14.0PoC 2 | ос он «стрелец» (14) | — | |
| 24 | juniper networks | 13 | 1 | · | · | ×6.5 | junos space (7) · junos (3) · junos os running on qfx3500, qfx3600, qfx5100, qfx5200, ex4300, ex4600 devices (1) | — | |
| 25 | novell inc. | 13 | 3 | · | · | PoC 3 | opensuse leap (10) · suse linux enterprise desktop (7) · opensuse (5) | — | |
| 26 | accellion | 12 | 5 | · | · | NEWPoC 5 | file transfer appliance (12) | — | |
| 27 | apache | 12 | · | · | · | ambari (2) · cxf fediz (2) · bookkeeper (1) | — | ||
| 28 | basercms | 12 | · | · | · | basercms (12) · mail (2) | — | ||
| 29 | basercms users community | 12 | · | · | · | NEW | basercms (4) · basercms plugin blog (3) · basercms plugin mail (3) | — | |
| 30 | juniper | 12 | · | · | · | junos space (7) · junos (5) | — | ||
| 31 | pivotal software | 12 | 2 | · | · | cloud foundry elastic runtime (10) · cloud foundry uaa (5) · cloud foundry (3) | — | ||
| 32 | apache software foundation | 10 | · | · | · | ×10.0 | apache ambari (2) · apache cxf fediz (2) · apache qpid broker-j (1) | — | |
| 33 | f5 | 10 | 1 | · | · | big-ip access policy manager (10) · big-ip application acceleration manager (8) · big-ip application security manager (8) | — | ||
| 34 | f5 networks, inc. | 10 | 1 | · | · | big-ip (4) · big-ip apm (2) · big-ip advanced firewall manager (1) | — | ||
| 35 | nuget | 10 | 2 | · | · | ×4.0PoC 1 | microsoft.chakracore (6) · microsoft.aspnetcore.mvc.cors (4) · microsoft.aspnetcore.mvc.dataannotations (4) | — | |
| 36 | vmware | 10 | 2 | · | · | ×10.0PoC 3 | spring security (3) · spring framework (3) · airwatch agent (2) | — | |
| 37 | cloudfoundry | 9 | 1 | · | · | cf-release (6) · cloud foundry uaa bosh (2) · garden linux (1) | — | ||
| 38 | entropymine | 9 | · | · | · | NEW | imageworsener (9) | — | |
| 39 | fortinet | 9 | 1 | · | · | fortiportal (5) · fortimanager firmware (1) · fortinet fortios (1) | — | ||
| 40 | imagemagick | 9 | · | · | · | PoC 1 | imagemagick (9) | — | |
| 41 | mcafee | 9 | · | · | 1 | ×3.0Nuclei 1 | network data loss prevention (7) · network data loss prevention (ndlp) (7) · epolicy orchestrator (1) | — | |
| 42 | php | 9 | 7 | · | · | PoC 4 | php (9) | — | |
| 43 | adobe | 8 | · | · | · | PoC 1 | flash player desktop runtime (7) · flash player (7) · experience manager forms (1) | — | |
| 44 | fortinet, inc. | 8 | 1 | · | · | NEW | fortinet fortiportal (5) · fortinet fortiweb (1) · fortinet fortiwlc-sd (1) | — | |
| 45 | trendmicro | 8 | 1 | · | · | PoC 6 | serverprotect (6) · officescan (2) | — | |
| 46 | ilmandmagic | 7 | · | · | · | NEW | openexr (7) | — | |
| 47 | nodejs | 7 | 2 | · | · | node.js (7) | — | ||
| 48 | openexr | 7 | · | · | · | NEW | openexr (7) | — | |
| 49 | openssl | 7 | · | · | · | PoC 2 | openssl (7) | — | |
| 50 | openssl software foundation | 7 | · | · | · | PoC 2 | openssl (7) | — |
Sectors
Solution categories ranked by distinct CVE count this period.
- Operating Systems336 CVE95 crit87 KEV37 vendorsCVSS 7.6linux kernel (58) · debian linux (47) · debian gnu/linux (42)
- OSS Libraries244 CVE98 crit64 vendorsCVSS 9.8autotrace (50) · php (16) · binutils (15)
- Mobile Apps170 CVE54 crit8 vendorsCVSS 8.2android (117) · qualcomm secure execution environment (18) · chrome (2)
- Enterprise Software93 CVE79 crit35 KEV43 vendorsCVSS 7.6device manager (5) · rational collaborative lifecycle management (5) · interact (4)
- Security Products93 CVE36 crit30 vendorsCVSS 7.8network data loss prevention (7) · network data loss prevention (ndlp) (7) · serverprotect (7)
- Web & CMS Plugins88 CVE10 crit40 vendorsCVSS 7.7basercms (16) · wordpress (7) · genixcms (6)
- 27 crit5 KEV23 vendorsCVSS 9.1junos space (14) · junos (8) · remote expert manager (7)
- Cloud & SaaS76 CVE22 crit21 vendorsCVSS 7.9cloud foundry (13) · cloud foundry elastic runtime (10) · cloud foundry uaa (5)
- Hardware Firmware45 CVE7 crit4 KEV13 vendorsCVSS 9.8gpu display driver (15) · gpu driver (15) · manycore platform software stack (mpss) (4)
- Consumer Software39 CVE7 crit26 vendorsCVSS 8.7flash player (14) · flash player desktop runtime (7) · foxit reader (3)
- ICS / OT / IoT28 CVE96 crit65 KEV17 vendorsCVSS 9.2atvise scada (2) · vampset (2) · web server (2)
- Databases25 CVE15 crit12 vendorsCVSS 9.8postgresql (9) · database server (6) · app connect enterprise certified container (4)
- Communications18 CVE5 crit11 vendorsCVSS 9.8zimbra collaboration suite (4) · roundcube webmail (3) · webmail (3)
- DevTools & CI5 CVE1 crit4 vendorsCVSS 7.6config-model (2) · perltidy (1) · tex live (1)
- Unclassified44 CVE5 crit1 KEV32 vendorsCVSS 6.3imageworsener (9) · empirical project monitor - extended (3) · flashair (3)
| Sector | CVEs | Crit | KEV | Vendors | Products | Avg CVSS | Top products |
|---|---|---|---|---|---|---|---|
| Operating Systems▸ 5 | 336 | 95 | 87 | 37 | 195 | 7.6 | linux kernel (58) · debian linux (47) · debian gnu/linux (42) |
| OSS Libraries▸ 9 | 244 | 98 | · | 64 | 112 | 9.8 | autotrace (50) · php (16) · binutils (15) |
| Mobile Apps▸ 3 | 170 | 54 | · | 8 | 23 | 8.2 | android (117) · qualcomm secure execution environment (18) · chrome (2) |
| Enterprise Software▸ 7 | 93 | 79 | 35 | 43 | 490 | 7.6 | device manager (5) · rational collaborative lifecycle management (5) · interact (4) |
| Security Products▸ 6 | 93 | 36 | · | 30 | 77 | 7.8 | network data loss prevention (7) · network data loss prevention (ndlp) (7) · serverprotect (7) |
| Web & CMS Plugins▸ 4 | 88 | 10 | · | 40 | 117 | 7.7 | basercms (16) · wordpress (7) · genixcms (6) |
| Networking Infrastructure▸ 6 | 83 | 27 | 5 | 23 | 80 | 9.1 | junos space (14) · junos (8) · remote expert manager (7) |
| Cloud & SaaS▸ 4 | 76 | 22 | · | 21 | 46 | 7.9 | cloud foundry (13) · cloud foundry elastic runtime (10) · cloud foundry uaa (5) |
| Hardware Firmware▸ 4 | 45 | 7 | 4 | 13 | 19 | 9.8 | gpu display driver (15) · gpu driver (15) · manycore platform software stack (mpss) (4) |
| Consumer Software▸ 5 | 39 | 7 | · | 26 | 33 | 8.7 | flash player (14) · flash player desktop runtime (7) · foxit reader (3) |
| ICS / OT / IoT▸ 4 | 28 | 96 | 65 | 17 | 105 | 9.2 | atvise scada (2) · vampset (2) · web server (2) |
| Databases▸ 4 | 25 | 15 | · | 12 | 32 | 9.8 | postgresql (9) · database server (6) · app connect enterprise certified container (4) |
| Communications▸ 4 | 18 | 5 | · | 11 | 12 | 9.8 | zimbra collaboration suite (4) · roundcube webmail (3) · webmail (3) |
| DevTools & CI▸ 2 | 5 | 1 | · | 4 | 4 | 7.6 | config-model (2) · perltidy (1) · tex live (1) |
| Unclassified | 44 | 5 | 1 | 32 | 41 | 6.3 | imageworsener (9) · empirical project monitor - extended (3) · flashair (3) |
Weakness × Sector
Which weaknesses hit which solution categories in May 2017
Cells shaded by share of the sector's hottest weakness. Click a row to open the sector history.
119Memory Buffer Bounds79XSS200Information Exposure20Improper Input Validation125Out-of-bounds Read264CWE-264295Improper Certificate Validation352CSRF476NULL Pointer Dereference787Out-of-bounds WriteOperating Systems871240261119331310OSS Libraries4516514423691615Security Products12208323354Consumer Software407178617Networking Infrastructure541812311121Web & CMS Plugins229321315Hardware Firmware727102325Enterprise Software2165425411Cloud & SaaS354423221ICS / OT / IoT4222111