CVE Tools
Sign in
month report

August 2018

Data as of Jun 11, 2026, 06:05 UTCSnapshot v1 Sources CVEList V5+NVD+GHSA+CSAF+FSTEC BDU+CISA KEV+EPSS+Nuclei templates Methodology →

August 2018 closed with 1,057 published CVEs. 164 criticals, debian led volume, mostly via debian linux. Top weakness class — CWE-79 (144 CVE). 10 vendors cracked the top-100 for the first time.

Print view
Total CVEs
1,057
— MoM— YoY
Severity mix
164 / 417
critical / high
KEV added
0
0 ransomware-linked
Nuclei coverage
2.6%
27 CVEs with templates

Time to exploit

How fast the community ships detection after a CVE drops.

Days → Nuclei (median)
2757.9
n=27
Within 7 days
0.0%
Within 30 days
0.0%
Days → KEV (median)
1320
n=8
Detection gap

KEV pressure, no Nuclei coverage

August 2018 · vendors with active exploitation listed by CISA but no public detection template.

Weakness × Vendor

What's spreading where in August 2018

Cells shaded by share of vendor's hottest weakness. Click any cell to open the CWE history.

79XSS200Information Exposure119Memory Buffer Bounds20Improper Input Validation787Out-of-bounds Write352CSRF22Path Traversal89SQL Injection287Improper Authentication125Out-of-bounds Readdebian361394215redhat441211213127canonical345315microsoft84161сообщество свободного программного обеспечения537335microsoft corp172141hp93411122ооо «русбитех-астра»5383215hewlett packard enterprise934222maven28213ibm592221google2941

Most discussed CVEs — August 2018

No CVE mentions in the news this month yet.

First time in top-100

Vendors never in top-100 in the prior 24 periods.

Top vendors

Ranked by distinct CVE count this period.

  • 1debian—
    87 CVE6 critCVSS 7.1
    Nuclei 4PoC 14
    debian linux (86) · advanced package tool (1)
  • 2redhat—
    84 CVE9 critCVSS 7.1
    Nuclei 2PoC 8
    enterprise linux desktop (57) · enterprise linux workstation (57) · enterprise linux server (56)
  • 3canonical—
    65 CVE6 critCVSS 6.8
    Nuclei 3PoC 6
    ubuntu linux (59) · ubuntu (23) · cloud-init (1)
  • 4microsoft—
    62 CVE2 critCVSS 7.0
    KEV 4PoC 5
    windows 10 (23) · windows 10 servers (22) · windows server 1709 (server core installation) (21)
  • 5сообщество свободного программного обеспечения—
    54 CVE8 critCVSS 7.0
    Nuclei 2PoC 9
    debian gnu/linux (47) · linux (9) · yum (1)
  • 6hp—
    51 CVE15 critCVSS 8.7
    Nuclei 1PoC 4
    centralview fraud risk management (5) · 3par service provider (5) · aruba clearpass policy manager (5)
  • 7ооо «русбитех-астра»—
    48 CVE5 critCVSS 6.9
    Nuclei 2PoC 7
    astra linux special edition (40) · astra linux common edition (14) · astra linux special edition для «эльбрус» (8)
  • 8hewlett packard enterprise—
    47 CVE14 critCVSS 7.7
    NEWNuclei 1PoC 3
    hpe 3par service processors (6) · hpe centralview fraud risk management (5) · aruba clearpass (4)
  • 9maven—
    42 CVE2 critCVSS 6.5
    KEV 1Nuclei 2PoC 3
    org.jenkins-ci.main:jenkins-core (6) · org.apache.tomcat.embed:tomcat-embed-core (3) · de.tracetronic.jenkins.plugins:ecutest (2)
  • 10ibm—
    34 CVE1 critCVSS 5.7
    security identity governance and intelligence (7) · maximo asset management (5) · urbancode deploy (3)
  • 11google—
    32 CVE4 critCVSS 7.2
    PoC 2
    chrome (25) · android (4) · android studio (2)
  • 12samsung—
    28 CVE14 critCVSS 9.0
    NEWPoC 9
    sth-eth-250 firmware (26) · samsung (11) · smartthings hub sth-eth-250 (10)
  • 13insteon—
    24 CVE14 critCVSS 9.2
    NEWPoC 8
    hub firmware (17) · insteon (17) · hub 2245-222 firmware (5)
  • 14packagist—
    23 CVE3 critCVSS 7.6
    KEV 1Nuclei 1PoC 14
    symfony/symfony (5) · pimcore/pimcore (3) · mantisbt/mantisbt (2)
  • 15jenkins—
    22 CVECVSS 6.1
    NEWPoC 1
    jenkins (6) · tracetronic ecu-test (2) · meliora testlab (1)
  • 16cisco—
    21 CVECVSS 6.1
    cisco web security appliance (3) · web security appliance (3) · sg300-28mp firmware (2)
  • 17open-emr—
    20 CVE3 critCVSS 8.3
    NEWNuclei 1PoC 9
    openemr (20)
  • 18apache software foundation—
    19 CVE1 critCVSS 6.8
    KEV 1Nuclei 3PoC 1
    apache traffic server (5) · apache tomcat (3) · tomcat (2)
  • 19oracle—
    19 CVE1 critCVSS 6.5
    KEV 1Nuclei 3PoC 4
    database server (6) · application testing suite (5) · core rdbms (4)
  • 20apache—
    18 CVE1 critCVSS 6.8
    KEV 1Nuclei 3PoC 1
    traffic server (5) · tomcat (3) · cayenne (1)
  • 21rubygems—
    18 CVE2 critCVSS 8.2
    PoC 2
    safemode (2) · activerecord (2) · web-console (1)
  • 22[unknown]—
    18 CVECVSS 6.3
    NEWPoC 2
    gnutls (3) · kernel (2) · ttembed (2)
  • 23kaspersky lab—
    14 CVE4 critCVSS 8.1
    NEW
    kraftway (6) · eltex esp-200 (5) · zipato zipabox smart home controller (3)
  • 24novell inc.—
    14 CVE3 critCVSS 7.0
    PoC 2
    opensuse leap (12) · suse linux enterprise server for sap applications (5) · suse linux enterprise server (5)
  • 25adobe—
    13 CVE6 critCVSS 8.6
    PoC 1
    flash player (5) · creative cloud (2) · acrobat dc (2)
  • 26intel—
    13 CVECVSS 6.8
    core i7 (3) · core i3 (3) · core i5 (3)
  • 27netapp—
    13 CVE1 critCVSS 6.5
    KEV 1Nuclei 2PoC 5
    storage automation store (6) · data ontap edge (2) · oncommand workflow automation (2)
  • 28pypi—
    13 CVE3 critCVSS 7.4
    Nuclei 2PoC 1
    cobbler (4) · cloudtoken (1) · apache-airflow (1)
  • 29ics-cert—
    12 CVE3 critCVSS 8.4
    NEW
    netcomm wireless g lte light industrial m2m router (nwl-25) with firmware 2.0.29.11 and prior. (4) · cncsoft with screeneditor (2) · deltav (2)
  • 30cisco systems, inc.—
    11 CVECVSS 6.9
    NEW
    small business 100 series wireless access points (2) · small business 300 series wireless access points (2) · digital network architecture (dna) center (1)
  • 31linux—
    11 CVECVSS 6.7
    PoC 3
    linux kernel (11)
  • 32nuget—
    11 CVECVSS 7.7
    PoC 2
    microsoft.chakracore (10) · auth0-aspnet (1) · auth0-aspnet-owin (1)
  • 33sap—
    11 CVE1 critCVSS 7.4
    businessobjects business intelligence (4) · sap businessobjects business intelligence (3) · supplier relationship management mdm catalog (2)
  • 34ca technologies—
    10 CVE4 critCVSS 8.2
    NEWPoC 1
    ppm (5) · unified infrastructure management (3) · ca api developer portal (1)
  • 35npm—
    10 CVE6 critCVSS 8.6
    PoC 1
    aedes (1) · cryo (1) · dojox (1)
  • 36q-cms—
    10 CVECVSS 5.3
    NEWPoC 5
    qcms (10)
  • 37xkbcommon—
    9 CVECVSS 5.8
    NEW
    xkbcommon (9) · libxkbcommon (8)
  • 38asustor—
    8 CVE2 critCVSS 7.1
    NEWNuclei 1PoC 6
    data master (6) · asustor data master (2)
  • 39dell—
    8 CVECVSS 7.6
    bsafe (4) · wyse management suite (1) · 2335dn engine firmware (1)
  • 40siemens—
    8 CVECVSS 6.3
    Nuclei 1PoC 1
    sinumerik tcu 30.3 (3) · simatic s7-1500 cpu s7-1518f-4 pn/dp mfp (3) · simatic s7-1500 software controller (3)
  • 41talos—
    8 CVE4 critCVSS 8.6
    NEWPoC 3
    samsung (4) · insteon (2) · sony (2)
  • 42tenable—
    8 CVECVSS 6.6
    NEWPoC 4
    asustor data master (6) · securitycenter (2)
  • 43broadcom—
    7 CVE3 critCVSS 8.0
    NEWPoC 1
    project portfolio management (5) · ca api developer portal (1) · release automation (1)
  • 44ca—
    7 CVE3 critCVSS 8.2
    NEW
    project portfolio management (4) · unified infrastructure management (3)
  • 45haxx—
    7 CVECVSS 5.3
    curl (7)
  • 46trendmicro—
    7 CVE2 critCVSS 7.9
    NEW
    premium security (3) · trend micro control manager (3) · trend micro security (consumer) (3)
  • 47atlassian—
    6 CVECVSS 6.0
    NEW
    jira (2) · jira server (2) · questions for confluence (2)
  • 48dlink—
    6 CVE2 critCVSS 8.1
    NEWNuclei 1PoC 2
    dir-615 firmware (3) · eyeon baby monitor firmware (2) · dir-601 (1)
  • 49fedoraproject—
    6 CVE1 critCVSS 7.1
    fedora (6)
  • 50hackerone—
    6 CVE2 critCVSS 7.8
    NEW
    nextcloud server (2) · simplehttpserver (1) · url-parse (1)

Top weaknesses

CWE classes by distinct CVE count.

1CWE-79144—
2CWE-20069—
3CWE-11962—
4CWE-2062—
5CWE-78750—
6CWE-35248—
7CWE-2235—
8CWE-8934—
9CWE-28728—
10CWE-12521—
11CWE-79821—
12CWE-40020—
13CWE-61119—
14CWE-7819—
15CWE-47618—
16CWE-73217—
17CWE-12016—
18CWE-50216—
19CWE-9415—
20CWE-19014—

Sectors

Solution categories ranked by distinct CVE count this period.

  • Operating Systems248 CVE
    75 crit63 KEV40 vendorsCVSS 7.2
    debian linux (86) · ubuntu linux (59) · enterprise linux desktop (57)
  • OSS Libraries215 CVE
    43 crit3 KEV66 vendorsCVSS 8.7
    curl (13) · php (11) · xkbcommon (11)
  • Enterprise Software213 CVE
    456 crit4 KEV41 vendorsCVSS 9.8
    security identity governance and intelligence (7) · storage automation store (6) · 3par service provider (5)
  • Web & CMS Plugins134 CVE
    21 crit3 KEV71 vendorsCVSS 8.4
    qcms (10) · apache traffic server (5) · tomcat (5)
  • Networking Infrastructure119 CVE
    25 crit1 KEV39 vendorsCVSS 9.2
    hpe 3par service processors (6) · hpe centralview fraud risk management (5) · appweb (4)
  • ICS / OT / IoT84 CVE
    57 crit1 KEV28 vendorsCVSS 8.8
    hub firmware (17) · insteon (17) · hub 2245-222 firmware (5)
  • Security Products73 CVE
    17 crit29 vendorsCVSS 10.0
    kraftway (6) · eltex esp-200 (5) · antivirus \+ security (3)
  • Mobile Apps65 CVE
    30 crit8 vendorsCVSS 8.1
    sth-eth-250 firmware (26) · chrome (25) · samsung (11)
  • Hardware Firmware61 CVE
    15 crit24 vendorsCVSS 7.9
    esp-200 firmware (5) · pc2 firmware (3) · pc2r firmware (3)
  • Consumer Software50 CVE
    44 crit23 vendorsCVSS 9.0
    flash player (5) · foxit reader (4) · computerinsel photoline (3)
  • Cloud & SaaS46 CVE
    9 crit25 vendorsCVSS 8.5
    project portfolio management (5) · libvirt (2) · xenserver (2)
  • DevTools & CI45 CVE
    5 crit17 vendorsCVSS 7.9
    jenkins (6) · tracetronic ecu-test (2) · accurev (1)
  • Databases32 CVE
    7 crit3 KEV11 vendorsCVSS 8.8
    enterprise manager ops center (8) · security service (8) · database server (6)
  • Communications19 CVE
    9 vendorsCVSS 7.5
    squirrelmail (6) · coremail xt (1) · dropbear ssh (1)
  • Unclassified77 CVE
    7 crit44 vendorsCVSS 7.0
    asustor data master (6) · banco (6) · ttembed (4)
Weakness × Sector

Which weaknesses hit which solution categories in August 2018

Cells shaded by share of the sector's hottest weakness. Click a row to open the sector history.

79XSS200Information Exposure119Memory Buffer Bounds20Improper Input Validation787Out-of-bounds Write352CSRF22Path Traversal89SQL Injection287Improper Authentication125Out-of-bounds ReadOSS Libraries1413111615543610Operating Systems520142216161213Enterprise Software3212651991962Web & CMS Plugins51347293912Networking Infrastructure2351111344141ICS / OT / IoT61113310161101Hardware Firmware510931324214Consumer Software3318818314Security Products6933111222DevTools & CI67141341