month report
June 2018
Data as of Jun 11, 2026, 06:05 UTCSnapshot v1 Sources CVEList V5+NVD+GHSA+CSAF+FSTEC BDU+CISA KEV+EPSS+Nuclei templates Methodology →
June 2018 closed with 1,804 published CVEs. 292 criticals, npm led volume, mostly via serve. Top weakness class — CWE-200 (188 CVE). 10 vendors cracked the top-100 for the first time.
Total CVEs
1,804
— MoM— YoY
Severity mix
292 / 922
critical / high
KEV added
0
0 ransomware-linked
Nuclei coverage
2.5%
46 CVEs with templates
Time to exploit
How fast the community ships detection after a CVE drops.
Days → Nuclei (median)
2814.5
n=46
Within 7 days
0.0%
Within 30 days
0.0%
Days → KEV (median)
1383
n=3
Detection gap
KEV pressure, no Nuclei coverage
June 2018 · vendors with active exploitation listed by CISA but no public detection template.
- KEV 1microsoft59 CVE
Weakness × Vendor
What's spreading where in June 2018
Cells shaded by share of vendor's hottest weakness. Click any cell to open the CWE history.
200Information Exposure20Improper Input Validation22Path Traversal79XSS119Memory Buffer Bounds310CWE-310311Missing Encryption416Use After Free78OS Command Injection125Out-of-bounds Readnpm4491291710110431hackerone428128159910421mozilla3854113542619debian14215233224711canonical ltd.21251102924311ооо «русбитех-астра»22232727399mozilla corp.212710312458redhat151822322445novell inc.1718824396сообщество свободного программного обеспечения711312123729canonical151414192207red hat inc.4112212377
Most discussed CVEs — June 2018
No CVE mentions in the news this month yet.
First time in top-100
Vendors never in top-100 in the prior 24 periods.
- #2hackerone340 CVE
- #10ао «ивк»97 CVE
- #15quest52 CVE
- #17qualcomm, inc.32 CVE
- #18jenkins29 CVE
- #21[unknown]20 CVE
- #28bouncycastle11 CVE
- #32ca technologies10 CVE
- #34ecos10 CVE
- #36f5 networks, inc.10 CVE
Top vendors
Ranked by distinct CVE count this period.
- 351 CVE12 critCVSS 7.6Nuclei 2PoC 136serve (3) · sanitize-html (2) · express-cart (2)
- 340 CVE11 critCVSS 7.6NEWNuclei 2PoC 133coffeescript node module (3) · sanitize-html node module (2) · serve node module (2)
- 318 CVE110 critCVSS 8.1KEV 1Nuclei 1PoC 66firefox (309) · firefox esr (153) · thunderbird (152)
- 226 CVE76 critCVSS 7.8Nuclei 1PoC 40ubuntu (191) · ubuntu linux (135)
- 202 CVE91 critCVSS 8.2KEV 1Nuclei 5PoC 49debian linux (202)
- 187 CVE68 critCVSS 7.9Nuclei 1PoC 41astra linux special edition (181) · astra linux common edition (12) · astra linux special edition для «эльбрус» (11)
- 180 CVE88 critCVSS 8.4KEV 1Nuclei 2PoC 46enterprise linux workstation (145) · enterprise linux server (144) · enterprise linux desktop (144)
- 154 CVE61 critCVSS 8.6Nuclei 1PoC 29opensuse leap (154) · suse linux enterprise server (85) · suse linux enterprise desktop (84)
- 141 CVE65 critCVSS 8.3KEV 1Nuclei 3PoC 37debian gnu/linux (131) · liblouis (4) · linux (3)
- 97 CVE49 critCVSS 8.4NEWNuclei 1PoC 19альт линукс спт (97) · альт 8 сп сервер (6) · альт 8 сп рабочая станция (6)
- 71 CVE7 critCVSS 6.9Nuclei 5PoC 8org.bouncycastle:bcprov-jdk14 (11) · org.bouncycastle:bcprov-jdk15 (11) · org.bouncycastle:bcprov-jdk15on (11)
- 63 CVE12 critCVSS 7.8KEV 1Nuclei 1PoC 1nx-os (19) · prime collaboration (8) · prime collaboration provisioning (7)
- 59 CVECVSS 6.8KEV 1PoC 5windows 10 (29) · windows server 2016 (29) · windows 10 servers (27)
- 55 CVE1 critCVSS 7.3PoC 13iphone os (37) · mac os x (33) · watchos (20)
- 52 CVE1 critCVSS 8.7NEWPoC 52disk backup (52)
- 40 CVECVSS 7.3PoC 1android (37) · boringssl (1) · chromecast firmware (1)
- 32 CVECVSS 7.4NEWandroid for msm, firefox os for msm, qrd android (32)
- 29 CVECVSS 6.5NEWNuclei 2PoC 1jenkins (4) · github (3) · black duck hub (3)
- 25 CVE1 critCVSS 6.1websphere mq (3) · infosphere information server (3) · security access manager (3)
- 22 CVE3 critCVSS 7.3Nuclei 1PoC 9baserproject/basercms (7) · symfony/symfony (6) · symfony/security (4)
- 20 CVE2 critCVSS 5.9NEWPoC 5389-ds-base (2) · python (2) · ovirt-engine (2)
- 19 CVE7 critCVSS 8.2Nuclei 1PoC 3роса кобальт (17) · rosa virtualization (2) · rosa virtualization 3.0 (2)
- 17 CVE4 critCVSS 7.3Nuclei 4PoC 4retail xstore point of service (7) · enterprise manager base platform (5) · communications cloud native core automated test suite (4)
- 15 CVE1 critCVSS 6.2PoC 2linux kernel (15)
- 14 CVECVSS 7.9open build service (7) · leap (5) · obs-service-set_version (1)
- 13 CVE1 critCVSS 7.5PoC 2scalance m875 firmware (6) · scalance m875 (6) · scalance x-200 irt (3)
- 12 CVE4 critCVSS 8.8Nuclei 1PoC 2snap creator framework (4) · oncommand system manager (3) · e-series santricity os controller (3)
- 11 CVECVSS 6.8NEWPoC 1bc-java (10) · bouncy castle (1) · bouncy castle fips java api (bc-fja) (1)
- 11 CVE1 critCVSS 7.4PoC 3matrix-synapse (2) · ansible (1) · galaxy-app (1)
- 11 CVE2 critCVSS 7.2Nuclei 1PoC 10passenger (5) · ffi (1) · json-jwt (1)
- 10 CVE2 critCVSS 7.7Nuclei 1PoC 1apache storm (2) · http server (1) · apache cassandra (1)
- 10 CVE4 critCVSS 8.2NEWPoC 3ca privileged access manager (10)
- 10 CVECVSS 5.4office (7) · mailwise (3)
- 10 CVE2 critCVSS 7.3NEWsecure boot stick firmware (7) · system management appliance (3)
- 10 CVECVSS 6.2big-ip application security manager (9) · big-ip access policy manager (9) · big-ip application acceleration manager (8)
- 10 CVECVSS 6.2NEWbig-ip (ltm, aam, afm, analytics, apm, asm, dns, edge gateway, fps, gtm, link controller, pem, webaccelerator) (4) · big-ip (ltm, aam, afm, analytics, apm, asm, dns, edge gateway, gtm, link controller, pem, webaccelerator, websafe) (3) · big-ip (ltm, aam, afm, analytics, apm, asm, edge gateway, fps, link controller, pem, webaccelerator) (1)
- 10 CVE4 critCVSS 8.3NEWPoC 2intellivue patient monitors, avalon fetal/maternal monitors (3) · beckhoff twincat (2) · abb ip gateway (2)
- 10 CVE1 critCVSS 6.7PoC 1network security management (nsm) (3) · network security manager (3) · epolicy orchestrator (3)
- 10 CVECVSS 7.0NEWdiskstation manager (dsm) (2) · diskstation manager (2) · drive (2)
- 10 CVECVSS 7.1NEWPoC 3natus (3) · pixar renderman (2) · hopper (1)
- 9 CVE1 critCVSS 7.5PoC 1storm (2) · http server (1) · mxnet (1)
- 9 CVE4 critCVSS 8.4PoC 3privileged access manager (9)
- 9 CVECVSS 5.5NEWcybozu office (6) · cybozu mailwise (3)
- 9 CVE1 critCVSS 6.8PoC 2fedora (6) · 389 directory server (2) · sssd (1)
- 9 CVECVSS 8.6PoC 1rh2288h v3 firmware (4) · rh2288 v3 firmware (4) · xh310 v3 firmware (4)
- 9 CVECVSS 7.5NEWPoC 11288h v5; 2288h v5; 2488 v5 ; ch121 v3; ch121l v3; ch121l v5 ; ch121 v5 ; ch140 v3; ch140l v3; ch220 v3; ch222 v3; ch242 v3; ch242 v5 ; rh1288 v3; rh2288 v3; rh2288h v3; xh310 v3; xh321 v3; xh321 v5; xh620 v3 (4) · espace desktop (1) · hg255s-10 (1)
- 9 CVE3 critCVSS 8.0NEWPoC 4solutions business manager 11.4 (5) · secure messaging gateway (2) · ucmdb browser (1)
- 9 CVE3 critCVSS 8.0PoC 4solutions business manager (5) · secure messaging gateway (2) · universal cmbd server (1)
- 9 CVE4 critCVSS 8.5NEWPoC 1осон основа оnyx (9)
- 8 CVECVSS 7.0NEWPoC 5fedora (7) · 389 directory server (1)
| # | Vendor | CVEs | Crit | KEV | Nuclei | Signals | Top products | Δ | |
|---|---|---|---|---|---|---|---|---|---|
| 1 | npm | 351 | 12 | · | 2 | Nuclei 2PoC 136 | serve (3) · sanitize-html (2) · express-cart (2) | — | |
| 2 | hackerone | 340 | 11 | · | 2 | NEWNuclei 2PoC 133 | coffeescript node module (3) · sanitize-html node module (2) · serve node module (2) | — | |
| 3 | mozilla | 318 | 110 | 1 | 1 | KEV 1Nuclei 1PoC 66 | firefox (309) · firefox esr (153) · thunderbird (152) | — | |
| 4 | canonical | 226 | 76 | · | 1 | Nuclei 1PoC 40 | ubuntu (191) · ubuntu linux (135) | — | |
| 5 | debian | 202 | 91 | 1 | 5 | KEV 1Nuclei 5PoC 49 | debian linux (202) | — | |
| 6 | ооо «русбитех-астра» | 187 | 68 | · | 1 | Nuclei 1PoC 41 | astra linux special edition (181) · astra linux common edition (12) · astra linux special edition для «эльбрус» (11) | — | |
| 7 | redhat | 180 | 88 | 1 | 2 | KEV 1Nuclei 2PoC 46 | enterprise linux workstation (145) · enterprise linux server (144) · enterprise linux desktop (144) | — | |
| 8 | novell inc. | 154 | 61 | · | 1 | Nuclei 1PoC 29 | opensuse leap (154) · suse linux enterprise server (85) · suse linux enterprise desktop (84) | — | |
| 9 | сообщество свободного программного обеспечения | 141 | 65 | 1 | 3 | KEV 1Nuclei 3PoC 37 | debian gnu/linux (131) · liblouis (4) · linux (3) | — | |
| 10 | ао «ивк» | 97 | 49 | · | 1 | NEWNuclei 1PoC 19 | альт линукс спт (97) · альт 8 сп сервер (6) · альт 8 сп рабочая станция (6) | — | |
| 11 | maven | 71 | 7 | · | 5 | Nuclei 5PoC 8 | org.bouncycastle:bcprov-jdk14 (11) · org.bouncycastle:bcprov-jdk15 (11) · org.bouncycastle:bcprov-jdk15on (11) | — | |
| 12 | cisco | 63 | 12 | 1 | 1 | KEV 1Nuclei 1PoC 1 | nx-os (19) · prime collaboration (8) · prime collaboration provisioning (7) | — | |
| 13 | microsoft | 59 | · | 1 | · | KEV 1PoC 5 | windows 10 (29) · windows server 2016 (29) · windows 10 servers (27) | — | |
| 14 | apple | 55 | 1 | · | · | PoC 13 | iphone os (37) · mac os x (33) · watchos (20) | — | |
| 15 | quest | 52 | 1 | · | · | NEWPoC 52 | disk backup (52) | — | |
| 16 | 40 | · | · | · | PoC 1 | android (37) · boringssl (1) · chromecast firmware (1) | — | ||
| 17 | qualcomm, inc. | 32 | · | · | · | NEW | android for msm, firefox os for msm, qrd android (32) | — | |
| 18 | jenkins | 29 | · | · | 2 | NEWNuclei 2PoC 1 | jenkins (4) · github (3) · black duck hub (3) | — | |
| 19 | ibm | 25 | 1 | · | · | websphere mq (3) · infosphere information server (3) · security access manager (3) | — | ||
| 20 | packagist | 22 | 3 | · | 1 | Nuclei 1PoC 9 | baserproject/basercms (7) · symfony/symfony (6) · symfony/security (4) | — | |
| 21 | [unknown] | 20 | 2 | · | · | NEWPoC 5 | 389-ds-base (2) · python (2) · ovirt-engine (2) | — | |
| 22 | ао «нтц ит роса» | 19 | 7 | · | 1 | Nuclei 1PoC 3 | роса кобальт (17) · rosa virtualization (2) · rosa virtualization 3.0 (2) | — | |
| 23 | oracle | 17 | 4 | · | 4 | Nuclei 4PoC 4 | retail xstore point of service (7) · enterprise manager base platform (5) · communications cloud native core automated test suite (4) | — | |
| 24 | linux | 15 | 1 | · | · | PoC 2 | linux kernel (15) | — | |
| 25 | opensuse | 14 | · | · | · | open build service (7) · leap (5) · obs-service-set_version (1) | — | ||
| 26 | siemens | 13 | 1 | · | · | PoC 2 | scalance m875 firmware (6) · scalance m875 (6) · scalance x-200 irt (3) | — | |
| 27 | netapp | 12 | 4 | · | 1 | Nuclei 1PoC 2 | snap creator framework (4) · oncommand system manager (3) · e-series santricity os controller (3) | — | |
| 28 | bouncycastle | 11 | · | · | · | NEWPoC 1 | bc-java (10) · bouncy castle (1) · bouncy castle fips java api (bc-fja) (1) | — | |
| 29 | pypi | 11 | 1 | · | · | PoC 3 | matrix-synapse (2) · ansible (1) · galaxy-app (1) | — | |
| 30 | rubygems | 11 | 2 | · | 1 | Nuclei 1PoC 10 | passenger (5) · ffi (1) · json-jwt (1) | — | |
| 31 | apache software foundation | 10 | 2 | · | 1 | Nuclei 1PoC 1 | apache storm (2) · http server (1) · apache cassandra (1) | — | |
| 32 | ca technologies | 10 | 4 | · | · | NEWPoC 3 | ca privileged access manager (10) | — | |
| 33 | cybozu | 10 | · | · | · | office (7) · mailwise (3) | — | ||
| 34 | ecos | 10 | 2 | · | · | NEW | secure boot stick firmware (7) · system management appliance (3) | — | |
| 35 | f5 | 10 | · | · | · | big-ip application security manager (9) · big-ip access policy manager (9) · big-ip application acceleration manager (8) | — | ||
| 36 | f5 networks, inc. | 10 | · | · | · | NEW | big-ip (ltm, aam, afm, analytics, apm, asm, dns, edge gateway, fps, gtm, link controller, pem, webaccelerator) (4) · big-ip (ltm, aam, afm, analytics, apm, asm, dns, edge gateway, gtm, link controller, pem, webaccelerator, websafe) (3) · big-ip (ltm, aam, afm, analytics, apm, asm, edge gateway, fps, link controller, pem, webaccelerator) (1) | — | |
| 37 | ics-cert | 10 | 4 | · | · | NEWPoC 2 | intellivue patient monitors, avalon fetal/maternal monitors (3) · beckhoff twincat (2) · abb ip gateway (2) | — | |
| 38 | mcafee | 10 | 1 | · | · | PoC 1 | network security management (nsm) (3) · network security manager (3) · epolicy orchestrator (3) | — | |
| 39 | synology | 10 | · | · | · | NEW | diskstation manager (dsm) (2) · diskstation manager (2) · drive (2) | — | |
| 40 | talos | 10 | · | · | · | NEWPoC 3 | natus (3) · pixar renderman (2) · hopper (1) | — | |
| 41 | apache | 9 | 1 | · | · | PoC 1 | storm (2) · http server (1) · mxnet (1) | — | |
| 42 | broadcom | 9 | 4 | · | · | PoC 3 | privileged access manager (9) | — | |
| 43 | cybozu, inc. | 9 | · | · | · | NEW | cybozu office (6) · cybozu mailwise (3) | — | |
| 44 | fedoraproject | 9 | 1 | · | · | PoC 2 | fedora (6) · 389 directory server (2) · sssd (1) | — | |
| 45 | huawei | 9 | · | · | · | PoC 1 | rh2288h v3 firmware (4) · rh2288 v3 firmware (4) · xh310 v3 firmware (4) | — | |
| 46 | huawei technologies co., ltd. | 9 | · | · | · | NEWPoC 1 | 1288h v5; 2288h v5; 2488 v5 ; ch121 v3; ch121l v3; ch121l v5 ; ch121 v5 ; ch140 v3; ch140l v3; ch220 v3; ch222 v3; ch242 v3; ch242 v5 ; rh1288 v3; rh2288 v3; rh2288h v3; xh310 v3; xh321 v3; xh321 v5; xh620 v3 (4) · espace desktop (1) · hg255s-10 (1) | — | |
| 47 | micro focus | 9 | 3 | · | · | NEWPoC 4 | solutions business manager 11.4 (5) · secure messaging gateway (2) · ucmdb browser (1) | — | |
| 48 | microfocus | 9 | 3 | · | · | PoC 4 | solutions business manager (5) · secure messaging gateway (2) · universal cmbd server (1) | — | |
| 49 | ао "нппкт" | 9 | 4 | · | · | NEWPoC 1 | осон основа оnyx (9) | — | |
| 50 | fedora project | 8 | · | · | · | NEWPoC 5 | fedora (7) · 389 directory server (1) | — |
Sectors
Solution categories ranked by distinct CVE count this period.
- OSS Libraries1,007 CVE73 crit145 vendorsCVSS 8.1symfony (12) · passenger (5) · coffeescript node module (3)
- Operating Systems497 CVE1,280 crit10 KEV38 vendorsCVSS 8.3debian linux (202) · ubuntu (191) · astra linux special edition (181)
- Consumer Software354 CVE465 crit6 KEV24 vendorsCVSS 8.1firefox (481) · firefox esr (248) · thunderbird (241)
- Enterprise Software200 CVE83 crit52 vendorsCVSS 8.7schools alert management script (5) · solutions business manager 11.4 (5) · monitoring and debugging dashboard (4)
- Web & CMS Plugins131 CVE21 crit91 vendorsCVSS 7.6basercms (14) · pixelpost (6) · cantata (4)
- Networking Infrastructure108 CVE55 crit4 KEV26 vendorsCVSS 9.4nx-os (29) · prime collaboration (8) · firepower extensible operating system (7)
- Mobile Apps107 CVE2 crit7 vendorsCVSS 8.1iphone os (37) · mac os x (33) · watchos (23)
- Security Products93 CVE13 crit1 KEV38 vendorsCVSS 7.8ca privileged access manager (10) · solutions business manager (5) · rsa authentication manager (3)
- ICS / OT / IoT64 CVE1,197 crit24 vendorsCVSS 9.8a1001 firmware (7) · a8004-v firmware (7) · a8105-e firmware (7)
- DevTools & CI58 CVE2 crit21 vendorsCVSS 7.5jenkins (4) · black duck hub (3) · github (3)
- Cloud & SaaS52 CVE8 crit1 KEV24 vendorsCVSS 7.9privileged access manager (9) · ovirt (2) · qemu (2)
- Hardware Firmware39 CVE36 crit18 vendorsCVSS 9.8secure boot stick firmware (7) · system management appliance (3) · hpux-ntp (1)
- Databases33 CVE23 crit13 vendorsCVSS 8.8retail xstore point of service (10) · enterprise manager base platform (5) · weblogic server (5)
- Communications24 CVE2 crit17 vendorsCVSS 7.5open-xchange appsuite (7) · sympa (2) · dovecot (1)
- AI / ML1 CVE1 vendorsCVSS 7.5polyai (1)
- Unclassified172 CVE18 crit130 vendorsCVSS 7.4slims akasia (5) · trovebox (4) · dalekjs (3)
| Sector | CVEs | Crit | KEV | Vendors | Products | Avg CVSS | Top products |
|---|---|---|---|---|---|---|---|
| OSS Libraries▸ 9 | 1,007 | 73 | · | 145 | 884 | 8.1 | symfony (12) · passenger (5) · coffeescript node module (3) |
| Operating Systems▸ 4 | 497 | 1,280 | 10 | 38 | 197 | 8.3 | debian linux (202) · ubuntu (191) · astra linux special edition (181) |
| Consumer Software▸ 4 | 354 | 465 | 6 | 24 | 29 | 8.1 | firefox (481) · firefox esr (248) · thunderbird (241) |
| Enterprise Software▸ 7 | 200 | 83 | · | 52 | 200 | 8.7 | schools alert management script (5) · solutions business manager 11.4 (5) · monitoring and debugging dashboard (4) |
| Web & CMS Plugins▸ 5 | 131 | 21 | · | 91 | 103 | 7.6 | basercms (14) · pixelpost (6) · cantata (4) |
| Networking Infrastructure▸ 6 | 108 | 55 | 4 | 26 | 132 | 9.4 | nx-os (29) · prime collaboration (8) · firepower extensible operating system (7) |
| Mobile Apps▸ 2 | 107 | 2 | · | 7 | 45 | 8.1 | iphone os (37) · mac os x (33) · watchos (23) |
| Security Products▸ 6 | 93 | 13 | 1 | 38 | 79 | 7.8 | ca privileged access manager (10) · solutions business manager (5) · rsa authentication manager (3) |
| ICS / OT / IoT▸ 6 | 64 | 1,197 | · | 24 | 458 | 9.8 | a1001 firmware (7) · a8004-v firmware (7) · a8105-e firmware (7) |
| DevTools & CI▸ 3 | 58 | 2 | · | 21 | 43 | 7.5 | jenkins (4) · black duck hub (3) · github (3) |
| Cloud & SaaS▸ 4 | 52 | 8 | 1 | 24 | 35 | 7.9 | privileged access manager (9) · ovirt (2) · qemu (2) |
| Hardware Firmware▸ 5 | 39 | 36 | · | 18 | 52 | 9.8 | secure boot stick firmware (7) · system management appliance (3) · hpux-ntp (1) |
| Databases▸ 5 | 33 | 23 | · | 13 | 100 | 8.8 | retail xstore point of service (10) · enterprise manager base platform (5) · weblogic server (5) |
| Communications▸ 4 | 24 | 2 | · | 17 | 16 | 7.5 | open-xchange appsuite (7) · sympa (2) · dovecot (1) |
| AI / ML▸ 1 | 1 | · | · | 1 | 1 | 7.5 | polyai (1) |
| Unclassified | 172 | 18 | · | 130 | 146 | 7.4 | slims akasia (5) · trovebox (4) · dalekjs (3) |
Weakness × Sector
Which weaknesses hit which solution categories in June 2018
Cells shaded by share of the sector's hottest weakness. Click a row to open the sector history.
200Information Exposure20Improper Input Validation22Path Traversal79XSS119Memory Buffer Bounds310CWE-310311Missing Encryption416Use After Free78OS Command Injection125Out-of-bounds ReadOSS Libraries78301374061051042528Operating Systems5364717743266117Consumer Software4358722676865110Communications15205103813477Web & CMS Plugins81235425621Enterprise Software16752531471Networking Infrastructure72961012193Hardware Firmware66516926Security Products861113136ICS / OT / IoT116758144