CVE Tools
Sign in
month report

September 2017

Data as of Jun 11, 2026, 06:04 UTCSnapshot v1 Sources CVEList V5+NVD+GHSA+CSAF+FSTEC BDU+CISA KEV+EPSS+Nuclei templates Methodology →

September 2017 closed with 1,238 published CVEs. 247 criticals, tcpdump led volume, mostly via tcpdump. Biggest breakout: apache software foundation at ×23.0 their 12-month median. Top weakness class — CWE-119 (200 CVE). 10 vendors cracked the top-100 for the first time.

Print view
Total CVEs
1,238
— MoM— YoY
Severity mix
247 / 534
critical / high
KEV added
0
0 ransomware-linked
Nuclei coverage
6.9%
86 CVEs with templates

Time to exploit

How fast the community ships detection after a CVE drops.

Days → Nuclei (median)
3095.3
n=86
Within 7 days
0.0%
Within 30 days
0.0%
Days → KEV (median)
1617
n=13
Detection gap

KEV pressure, no Nuclei coverage

September 2017 · vendors with active exploitation listed by CISA but no public detection template.

Weakness × Vendor

What's spreading where in September 2017

Cells shaded by share of vendor's hottest weakness. Click any cell to open the CWE history.

119Memory Buffer Bounds79XSS125Out-of-bounds Read200Information Exposure20Improper Input Validation89SQL Injection476NULL Pointer Dereference287Improper Authentication352CSRF434Unrestricted File Uploadtcpdump1841microsoft333266google10113microsoft corporation303266debian812014511stdutility67сообщество свободного программного обеспечения91151111ооо «русбитех-астра»811411cisco46320141google inc.48google inc615ibm104413

Most discussed CVEs — September 2017

No CVE mentions in the news this month yet.

Breakout vendors

CVE count ≥3× their own 12-period median.

First time in top-100

Vendors never in top-100 in the prior 24 periods.

Top vendors

Ranked by distinct CVE count this period.

  • 1tcpdump—
    87 CVE85 critCVSS 9.7
    NEW
    tcpdump (87)
  • 2google—
    82 CVE2 critCVSS 7.3
    PoC 4
    android (80) · android studio (1) · protobuf (1)
  • 3microsoft—
    80 CVE1 critCVSS 6.8
    KEV 1PoC 17
    windows 10 (33) · windows server 2016 (31) · edge (27)
  • 4microsoft corporation—
    77 CVECVSS 6.3
    NEWKEV 1PoC 16
    microsoft edge (22) · microsoft office (9) · windows kernel (8)
  • 5debian—
    69 CVE13 critCVSS 7.5
    PoC 16
    debian linux (69)
  • 6stdutility—
    67 CVECVSS 7.8
    NEWPoC 67
    stdu viewer (67)
  • 7сообщество свободного программного обеспечения—
    65 CVE9 critCVSS 7.0
    PoC 12
    debian gnu/linux (59) · libarchive (4) · libsndfile (3)
  • 8ооо «русбитех-астра»—
    63 CVE7 critCVSS 7.1
    ×10.5Nuclei 1PoC 12
    astra linux special edition (46) · astra linux special edition для «эльбрус» (44) · astra linux common edition (30)
  • 9cisco—
    55 CVE5 critCVSS 6.9
    KEV 10Nuclei 1PoC 1
    ios (14) · ios xe (13) · cisco ios (11)
  • 10google inc.—
    52 CVECVSS 7.4
    NEWPoC 1
    android (52)
  • 11ibm—
    41 CVECVSS 6.7
    PoC 2
    business process manager (8) · db2 for linux, unix and windows (7) · db2 (7)
  • 12imagemagick—
    33 CVE5 critCVSS 7.2
    PoC 7
    imagemagick (33)
  • 13canonical—
    31 CVE5 critCVSS 6.9
    Nuclei 1PoC 11
    ubuntu linux (29) · ubuntu (5)
  • 14packagist—
    28 CVE5 critCVSS 7.1
    ×14.0PoC 10
    simplesamlphp/simplesamlphp (6) · genix/cms (6) · dolibarr/dolibarr (5)
  • 15redhat—
    28 CVE7 critCVSS 7.6
    KEV 1Nuclei 1PoC 6
    enterprise linux desktop (8) · enterprise linux server aus (8) · enterprise linux server (7)
  • 16ао «концерн вниинс»—
    28 CVE6 critCVSS 7.3
    NEWPoC 5
    ос он «стрелец» (28)
  • 17maven—
    27 CVE4 critCVSS 7.5
    KEV 2Nuclei 3PoC 3
    org.apache.struts:struts2-core (4) · org.apache.brooklyn:brooklyn (2) · org.apache.mesos:mesos (2)
  • 18apache—
    25 CVE6 critCVSS 7.9
    ×4.2KEV 2Nuclei 3PoC 4
    struts (7) · brooklyn (3) · traffic server (2)
  • 19apache software foundation—
    23 CVE6 critCVSS 8.0
    ×23.0KEV 2Nuclei 3PoC 4
    apache struts (6) · struts (4) · apache brooklyn (3)
  • 20imagemagick studio llc—
    22 CVE5 critCVSS 7.3
    NEWPoC 5
    imagemagick (22)
  • 21dlink—
    19 CVE4 critCVSS 8.4
    KEV 1PoC 8
    dir-850l firmware (18) · dir-850l (2) · dir-626l firmware (1)
  • 22xnview—
    19 CVECVSS 7.8
    NEWPoC 19
    xnview (19)
  • 23pypi—
    18 CVECVSS 7.1
    ×4.5Nuclei 1PoC 3
    plone (4) · ipython (3) · kallithea (2)
  • 24gnu—
    17 CVECVSS 6.1
    PoC 1
    binutils (14) · coreutils (1) · emacs (1)
  • 25bento4—
    15 CVECVSS 7.2
    NEWPoC 5
    bento4 (15)
  • 26gnu general public license—
    14 CVECVSS 6.0
    NEWPoC 1
    gnu binutils (14)
  • 27hp—
    14 CVE4 critCVSS 7.5
    arcsight enterprise security manager (6) · arcsight enterprise security manager express (6) · bsm platform application performance management system health (4)
  • 28linux—
    13 CVECVSS 6.1
    PoC 2
    linux kernel (13)
  • 29schneider-electric—
    12 CVE3 critCVSS 7.4
    u.motion builder (7) · powerscada anywhere (4) · citect anywhere (4)
  • 30schneider electric se—
    12 CVE3 critCVSS 7.5
    NEW
    u.motion (6) · citect anywhere (4) · powerscada anywhere (4)
  • 31fedoraproject—
    11 CVE2 critCVSS 7.1
    fedora (10) · 389 directory server (1) · python-fedora (1)
  • 32exiv2—
    10 CVECVSS 5.5
    NEWPoC 5
    exiv2 (10)
  • 33eyesofnetwork—
    10 CVE5 critCVSS 8.7
    NEWPoC 5
    eyesofnetwork (10)
  • 34freedesktop—
    9 CVECVSS 6.7
    NEWPoC 3
    poppler (9)
  • 35mp3gain—
    9 CVECVSS 6.3
    NEW
    mp3gain (9)
  • 36nvidia—
    9 CVECVSS 6.9
    PoC 1
    gpu driver (8) · jetson tk1 (1) · jetson tx1 (1)
  • 37sap—
    9 CVE1 critCVSS 6.9
    PoC 1
    sap netweaver (6) · enterprise portal (1) · e-recruiting (1)
  • 38wordpress—
    9 CVE1 critCVSS 6.7
    Nuclei 9
    wordpress (9)
  • 39nvidia corporation—
    8 CVECVSS 6.7
    NEW
    gpu display driver (8)
  • 40dasinfomedia—
    7 CVECVSS 8.5
    NEWNuclei 6PoC 7
    annual maintenance contract management system (1) · hospital management system (1) · school management system (1)
  • 41ffmpeg—
    7 CVECVSS 7.5
    ffmpeg (7)
  • 42ibm corp.—
    7 CVE1 critCVSS 7.6
    Nuclei 1
    ibm db2 (3) · ibm call center for commerce (2) · ibm db2 connect (2)
  • 43netapp—
    7 CVE1 critCVSS 8.1
    KEV 2Nuclei 2PoC 2
    oncommand balance (2) · clustered data ontap (2) · data ontap (2)
  • 44rubygems—
    7 CVECVSS 7.2
    PoC 6
    geminabox (2) · spina (1) · devise-two-factor (1)
  • 45schneider electric—
    7 CVE3 critCVSS 7.9
    NEW
    u.motion builder (7)
  • 46simplesamlphp—
    7 CVE2 critCVSS 7.5
    NEWPoC 7
    simplesamlphp (6) · infocard module (1)
  • 47artifex—
    6 CVECVSS 7.8
    ×3.0PoC 3
    gsview (3) · mupdf (3)
  • 48genixcms—
    6 CVECVSS 6.9
    NEWPoC 1
    genixcms (6)
  • 49graphicsmagick—
    6 CVECVSS 6.7
    NEW
    graphicsmagick (6)
  • 50graphicsmagick group—
    6 CVECVSS 6.7
    NEW
    graphicsmagick (6)

Top weaknesses

CWE classes by distinct CVE count.

1CWE-119200—
2CWE-79130—
3CWE-125121—
4CWE-20099—
5CWE-2076—
6CWE-8966—
7CWE-47631—
8CWE-28728—
9CWE-35224—
10CWE-43422—
11CWE-19017—
12CWE-2217—
13CWE-7817—
14CWE-26416—
15CWE-79816—
16CWE-36215—
17CWE-78715—
18CWE-39914—
19CWE-41614—
20CWE-61114—

Sectors

Solution categories ranked by distinct CVE count this period.

  • OSS Libraries325 CVE
    121 crit2 KEV61 vendorsCVSS 8.1
    tcpdump (87) · imagemagick (55) · binutils (14)
  • Operating Systems310 CVE
    83 crit28 KEV43 vendorsCVSS 8.3
    debian linux (69) · debian gnu/linux (59) · astra linux special edition (46)
  • Web & CMS Plugins151 CVE
    37 crit5 KEV68 vendorsCVSS 9.5
    struts (11) · wordpress (9) · apache struts (6)
  • Enterprise Software134 CVE
    28 crit4 KEV43 vendorsCVSS 8.1
    business process manager (8) · db2 (7) · db2 connect (7)
  • Consumer Software132 CVE
    4 crit21 vendorsCVSS 9.1
    stdu viewer (67) · mp3gain (9) · graphicsmagick (6)
  • Networking Infrastructure109 CVE
    56 crit43 KEV29 vendorsCVSS 8.6
    dir-850l firmware (18) · ios (14) · ios xe (13)
  • Mobile Apps95 CVE
    11 crit9 vendorsCVSS 9.2
    android (120) · protobuf (2) · wi-fi station l-02f firmware (2)
  • Security Products56 CVE
    19 crit29 vendorsCVSS 8.2
    mobile security (4) · hitmanpro (3) · mobile security (enterprise) (3)
  • Cloud & SaaS36 CVE
    6 crit20 vendorsCVSS 7.7
    bcm4355c0 firmware (2) · esxi (2) · fusion (2)
  • Hardware Firmware33 CVE
    9 crit19 vendorsCVSS 9.4
    gpu display driver (8) · gpu driver (8) · active management technology firmware (1)
  • DevTools & CI31 CVE
    2 crit14 vendorsCVSS 8.1
    bento4 (15) · testlink (2) · ansible-vault (1)
  • Communications31 CVE
    13 crit21 vendorsCVSS 9.8
    realpresence resource manager (5) · u-verse firmware (4) · kaltura server (3)
  • ICS / OT / IoT29 CVE
    16 crit13 vendorsCVSS 9.8
    u.motion builder (14) · citect anywhere (8) · powerscada anywhere (8)
  • Databases17 CVE
    1 crit7 vendorsCVSS 7.0
    ibm db2 (3) · ibm call center for commerce (2) · ibm db2 connect (2)
  • AI / ML3 CVE
    1 vendorsCVSS 7.0
    ipython (3)
  • Unclassified61 CVE
    30 crit34 vendorsCVSS 8.5
    eyesofnetwork (10) · sam2p (6) · dtracker (4)
Weakness × Sector

Which weaknesses hit which solution categories in September 2017

Cells shaded by share of the sector's hottest weakness. Click a row to open the sector history.

119Memory Buffer Bounds79XSS125Out-of-bounds Read200Information Exposure20Improper Input Validation89SQL Injection476NULL Pointer Dereference287Improper Authentication352CSRF434Unrestricted File UploadOperating Systems517324817115231OSS Libraries38201081213217672Consumer Software1264584223Web & CMS Plugins4775392812Enterprise Software334110815512Networking Infrastructure61362511722Security Products3141733522Hardware Firmware447311Communications2364111DevTools & CI442121721