CVE Tools
Sign in
month report

January 2018

Data as of Jun 11, 2026, 06:04 UTCSnapshot v1 Sources CVEList V5+NVD+GHSA+CSAF+FSTEC BDU+CISA KEV+EPSS+Nuclei templates Methodology →

January 2018 closed with 1,715 published CVEs. 170 criticals, oracle led volume, mostly via mysql server. Top weakness class — CWE-79 (189 CVE). 10 vendors cracked the top-100 for the first time.

Print view
Total CVEs
1,715
— MoM— YoY
Severity mix
170 / 574
critical / high
KEV added
0
0 ransomware-linked
Nuclei coverage
5.0%
86 CVEs with templates

Time to exploit

How fast the community ships detection after a CVE drops.

Days → Nuclei (median)
2975.3
n=86
Within 7 days
0.0%
Within 30 days
0.0%
Days → KEV (median)
1431
n=4
Detection gap

KEV pressure, no Nuclei coverage

January 2018 · vendors with active exploitation listed by CISA but no public detection template.

Weakness × Vendor

What's spreading where in January 2018

Cells shaded by share of vendor's hottest weakness. Click any cell to open the CWE history.

79XSS20Improper Input Validation200Information Exposure119Memory Buffer Bounds787Out-of-bounds Write22Path Traversal89SQL Injection352CSRF287Improper Authentication78OS Command Injectionoracle111oracle corporation11debian2151106212google719146maven111192413canonical21113microsoft12181microsoft corporation12181ibm16462131redhat131122google inc.51346сообщество свободного программного обеспечения324311

Most discussed CVEs — January 2018

No CVE mentions in the news this month yet.

First time in top-100

Vendors never in top-100 in the prior 24 periods.

Top vendors

Ranked by distinct CVE count this period.

  • 1oracle—
    181 CVE9 critCVSS 6.6
    KEV 1Nuclei 1PoC 8
    mysql server (20) · jdk (20) · jre (20)
  • 2debian—
    115 CVE26 critCVSS 7.4
    PoC 21
    debian linux (115)
  • 3google—
    76 CVE11 critCVSS 8.0
    PoC 3
    android (74) · chrome (2) · libvpx (1)
  • 4maven—
    70 CVE8 critCVSS 7.1
    KEV 2Nuclei 3PoC 7
    org.jenkins-ci.main:jenkins-core (16) · org.apache.geode:geode-core (3) · org.webjars.npm:jquery (3)
  • 5canonical—
    67 CVE3 critCVSS 6.6
    PoC 12
    ubuntu linux (65) · ubuntu (16)
  • 6microsoft—
    60 CVECVSS 7.8
    KEV 2PoC 18
    office (20) · edge (18) · microsoft office 2016 (18)
  • 7microsoft corporation—
    60 CVECVSS 7.3
    NEWKEV 2PoC 18
    microsoft edge (16) · equation editor (12) · windows kernel (6)
  • 8ibm—
    59 CVE3 critCVSS 6.3
    Nuclei 1PoC 1
    security key lifecycle manager (10) · engineering requirements management doors (7) · rational doors (7)
  • 9redhat—
    56 CVE4 critCVSS 6.5
    PoC 5
    enterprise linux server (35) · enterprise linux workstation (34) · enterprise linux desktop (34)
  • 10google inc.—
    51 CVE10 critCVSS 8.0
    NEWPoC 2
    android (51)
  • 11сообщество свободного программного обеспечения—
    48 CVE4 critCVSS 7.0
    PoC 12
    debian gnu/linux (32) · linux (12) · retirejs (2)
  • 12ооо «русбитех-астра»—
    40 CVE1 critCVSS 6.9
    PoC 11
    astra linux special edition (32) · astra linux common edition (11) · astra linux special edition для «эльбрус» (7)
  • 13jenkins—
    35 CVE1 critCVSS 6.9
    KEV 1Nuclei 1PoC 1
    jenkins (16) · ec2 (1) · findbugs (1)
  • 14cisco—
    32 CVE2 critCVSS 6.4
    Nuclei 1PoC 3
    webex meetings server (6) · nx-os (3) · sf550x-48mp firmware (2)
  • 15packagist—
    30 CVE1 critCVSS 6.6
    Nuclei 7PoC 12
    wpglobus/wpglobus (7) · moodle/moodle (4) · mautic/core (3)
  • 16hp—
    25 CVE2 critCVSS 8.2
    PoC 1
    xp p9000 command view (16) · xp command view (16) · xp7 command view (16)
  • 17k7computing—
    25 CVECVSS 7.2
    NEWPoC 14
    antivirus (24) · total security (11) · endpoint (10)
  • 18tp-link—
    25 CVECVSS 7.2
    NEWPoC 25
    er5110g firmware (25) · er5120g firmware (25) · er5510g firmware (25)
  • 19netgain systems—
    23 CVE5 critCVSS 7.8
    NEW
    netgain systems enterprise manager (23)
  • 20netgain-systems—
    23 CVE5 critCVSS 7.8
    NEW
    enterprise manager (23)
  • 21rubygems—
    21 CVECVSS 7.0
    PoC 15
    jquery-rails (3) · vladtheenterprising (2) · brbackup (1)
  • 22qualcomm, inc.—
    20 CVE1 critCVSS 7.7
    NEW
    android for msm, firefox os for msm, qrd android (20)
  • 23linux—
    19 CVE2 critCVSS 6.9
    PoC 1
    linux kernel (18) · linux kernel i40e\/i40evf (1) · linux kernel ixgbe (1)
  • 24schneider-electric—
    19 CVECVSS 5.6
    Nuclei 1
    struxureware data center expert (16) · pelco videoxpert (3)
  • 25ао «нтц ит роса»—
    19 CVE2 critCVSS 6.8
    PoC 5
    роса кобальт (15) · роса хром (4) · rels (3)
  • 26apache—
    18 CVE4 critCVSS 7.2
    PoC 1
    nifi (3) · geode (3) · hadoop (2)
  • 27apache software foundation—
    17 CVE3 critCVSS 7.3
    PoC 1
    apache nifi (3) · apache geode (3) · apache hadoop (2)
  • 28netapp—
    17 CVE1 critCVSS 6.9
    PoC 3
    oncommand insight (12) · active iq unified manager (9) · oncommand workflow automation (9)
  • 29pypi—
    16 CVE1 critCVSS 6.6
    PoC 2
    opencv-python (4) · plone (4) · opencv-contrib-python (4)
  • 30juniper networks—
    15 CVE2 critCVSS 6.9
    PoC 12
    junos os (8) · junos space (5) · junos (4)
  • 31juniper—
    14 CVE2 critCVSS 6.9
    PoC 11
    junos (9) · junos space (4) · screenos (1)
  • 32novell inc.—
    14 CVE1 critCVSS 6.2
    PoC 6
    opensuse leap (13) · suse linux enterprise module for server applications (2) · suse linux enterprise module for public cloud (1)
  • 33imagemagick—
    13 CVECVSS 6.7
    PoC 3
    imagemagick (13)
  • 34npm—
    13 CVECVSS 6.8
    Nuclei 1PoC 7
    jquery (3) · electron (2) · marked (1)
  • 35talos—
    13 CVECVSS 7.8
    NEWPoC 3
    cpp-ethereum (9) · tinysvcmdns (1) · delayed_job_web rails gem (1)
  • 36x.org—
    12 CVE12 critCVSS 9.8
    NEW
    x server (12)
  • 37the x.org foundation—
    11 CVE11 critCVSS 9.8
    NEW
    xorg-x11-server (11)
  • 38atlassian—
    10 CVECVSS 6.4
    jira (6) · sourcetree (2) · crowd (1)
  • 39malwarebytes—
    10 CVECVSS 7.3
    NEWPoC 10
    malwarebytes (10)
  • 40red hat, inc.—
    10 CVECVSS 7.2
    NEW
    389-ds-base (1) · hibernate-validator (1) · libpam4j (1)
  • 41responsive coming soon page project—
    10 CVECVSS 5.2
    NEWNuclei 10PoC 5
    responsive coming soon page (10)
  • 42advantech—
    9 CVE3 critCVSS 7.7
    PoC 2
    webaccess (7) · webaccess\/scada (2)
  • 43ethereum—
    9 CVECVSS 7.9
    NEWPoC 2
    cpp-ethereum (7) · ethereum virtual machine (1) · aleth (1)
  • 44vmware—
    9 CVE2 critCVSS 7.4
    Nuclei 1PoC 2
    workstation (5) · fusion (4) · workstation pro / player (2)
  • 45asus—
    8 CVE4 critCVSS 8.3
    NEWPoC 6
    asuswrt (6) · dsl-ac56u firmware (2) · dsl-ac750 firmware (2)
  • 46gd rating system project—
    8 CVECVSS 6.8
    NEWNuclei 8PoC 5
    gd rating system (8)
  • 47advanced real estate script project—
    7 CVECVSS 5.1
    NEWPoC 2
    advanced real estate script (7)
  • 48clamav—
    7 CVE2 critCVSS 7.9
    PoC 4
    clamav (7)
  • 49flexense—
    7 CVE2 critCVSS 8.7
    NEWPoC 7
    syncbreeze (2) · diskboss (2) · dupscout (1)
  • 50intel—
    7 CVECVSS 5.6
    PoC 2
    xeon silver (3) · xeon (3) · xeon bronze 3104 (3)

Top weaknesses

CWE classes by distinct CVE count.

1CWE-79189—
2CWE-20111—
3CWE-20087—
4CWE-11957—
5CWE-78747—
6CWE-2245—
7CWE-8944—
8CWE-35235—
9CWE-28722—
10CWE-7821—
11CWE-12519—
12CWE-19018—
13CWE-41618—
14CWE-86317—
15CWE-47615—
16CWE-61115—
17CWE-29514—
18CWE-40014—
19CWE-77214—
20CWE-43413—

Sectors

Solution categories ranked by distinct CVE count this period.

  • Operating Systems327 CVE
    114 crit30 KEV37 vendorsCVSS 9.3
    debian linux (115) · ubuntu linux (65) · enterprise linux server (35)
  • OSS Libraries273 CVE
    23 crit3 KEV63 vendorsCVSS 9.8
    imagemagick (18) · cpp-ethereum (7) · podofo (6)
  • Databases187 CVE
    23 crit2 KEV9 vendorsCVSS 8.8
    mysql (24) · mysql server (23) · vm virtualbox (21)
  • Enterprise Software183 CVE
    307 crit41 vendorsCVSS 9.1
    enterprise manager (23) · netgain systems enterprise manager (23) · xp command view (16)
  • Web & CMS Plugins172 CVE
    24 crit85 vendorsCVSS 6.9
    gd rating system (8) · advanced real estate script (7) · cms made simple (5)
  • Networking Infrastructure117 CVE
    28 crit36 vendorsCVSS 8.2
    er5110g firmware (25) · er5120g firmware (25) · er5510g firmware (25)
  • Security Products111 CVE
    21 crit36 vendorsCVSS 8.0
    antivirus (24) · total security (11) · endpoint (10)
  • Mobile Apps88 CVE
    24 crit9 vendorsCVSS 8.0
    android (97) · chrome (2) · s5300 firmware (2)
  • ICS / OT / IoT64 CVE
    78 crit17 vendorsCVSS 9.3
    struxureware data center expert (16) · webaccess (7) · centum vp (3)
  • Cloud & SaaS45 CVE
    8 crit21 vendorsCVSS 7.6
    389-ds-base (1) · cdm (1) · cloud magnum orchestration (1)
  • DevTools & CI42 CVE
    3 crit2 KEV8 vendorsCVSS 7.8
    jenkins (17) · octopus deploy (2) · active choices (1)
  • Consumer Software34 CVE
    3 crit27 vendorsCVSS 8.2
    desktop (1) · flash player (1) · gcab (1)
  • Hardware Firmware33 CVE
    39 crit17 vendorsCVSS 9.7
    asuswrt (6) · dsl-ac51 firmware (2) · dsl-ac52u firmware (2)
  • Communications13 CVE
    3 crit11 vendorsCVSS 8.3
    irssi (4) · livezilla (1) · phpfreechat (1)
  • AI / ML4 CVE
    1 vendorsCVSS 6.8
    open source computer vision library (opencv) (4)
  • Unclassified70 CVE
    14 crit54 vendorsCVSS 7.4
    read and understood (3) · shanghai onstar (3) · contractorweb.net (2)
Weakness × Sector

Which weaknesses hit which solution categories in January 2018

Cells shaded by share of the sector's hottest weakness. Click a row to open the sector history.

79XSS20Improper Input Validation200Information Exposure119Memory Buffer Bounds787Out-of-bounds Write22Path Traversal89SQL Injection352CSRF287Improper Authentication78OS Command InjectionOperating Systems425262932422OSS Libraries411923105721048Enterprise Software2961333186554Web & CMS Plugins9146216211322Security Products184974843234Networking Infrastructure1989821414Databases324121Hardware Firmware43111121251Consumer Software75562222ICS / OT / IoT24751433