month report
September 2018
Data as of Jun 4, 2026, 13:25 UTCSnapshot v1 Sources NVD+CISA KEV+EPSS+Nuclei templates Methodology →
September 2018 closed with 1,209 published CVEs. 166 criticals, debian led volume, mostly via debian linux. Biggest breakout: opensuse at ×8.5 their 12-month median. Top weakness class — CWE-79 (169 CVE). 10 vendors cracked the top-100 for the first time.
Total CVEs
1,209
— MoM— YoY
Severity mix
166 / 493
critical / high
KEV added
0
0 ransomware-linked
Nuclei coverage
2.7%
33 CVEs with templates
Time to exploit
How fast the community ships detection after a CVE drops.
Days → Nuclei (median)
2728.2
n=33
Within 7 days
0.0%
Within 30 days
0.0%
Days → KEV (median)
1292
n=3
Detection gap
KEV pressure, no Nuclei coverage
September 2018 · vendors with active exploitation listed by CISA but no public detection template.
- KEV 1microsoft65 CVE
- KEV 1microsoft corp62 CVE
- KEV 1canonical61 CVE
- KEV 1linux11 CVE
Weakness × Vendor
What's spreading where in September 2018
Cells shaded by share of vendor's hottest weakness. Click any cell to open the CWE history.
79XSS20Improper Input Validation200Information Exposure119Memory Buffer Bounds787Out-of-bounds Write89SQL Injection125Out-of-bounds Read352CSRF22Path Traversal78OS Command Injectiondebian22411410531google11761769redhat323131542microsoft4915111qualcomm, inc.511378сообщество свободного программного обеспечения151661011microsoft corp4815111canonical435651ооо «русбитех-астра»131448ibm72412canonical ltd.213372red hat17622
Breakout vendors
CVE count ≥3× their own 12-period median.
- 8.5×opensuse17 CVE
- 7.0×canonical ltd.35 CVE
- 5.0×red hat inc.20 CVE
- 5.0×lenovo10 CVE
- 4.5×npm9 CVE
- 4.3×ао "нппкт"13 CVE
- 4.0×dell8 CVE
- 3.5×zohocorp7 CVE
- 3.3×redhat82 CVE
- 3.0×huawei12 CVE
First time in top-100
Vendors never in top-100 in the prior 24 periods.
- #12red hat28 CVE
- #16intel corporation20 CVE
- #23qualcomm16 CVE
- #31opensc project13 CVE
- #34gluster12 CVE
- #35hdfgroup12 CVE
- #42btiteam10 CVE
- #44monstra10 CVE
- #45ricoh10 CVE
- #46[unknown]10 CVE
Top vendors
Ranked by distinct CVE count this period.
- 102 CVE6 critCVSS 7.0Nuclei 2PoC 11debian linux (102)
- 82 CVECVSS 7.0android (56) · chrome (25) · gvisor (1)
- 82 CVE1 critCVSS 6.9×3.3KEV 1Nuclei 1PoC 7enterprise linux server (56) · enterprise linux workstation (45) · enterprise linux desktop (44)
- 65 CVE1 critCVSS 6.7KEV 1PoC 12windows 10 (31) · windows 10 servers (29) · windows server 2016 (29)
- 65 CVE2 critCVSS 7.6android for msm, firefox os for msm, qrd android (50) · snapdragon automobile, snapdragon mobile, snapdragon wear (12) · snapdragon mobile, snapdragon wear (1)
- 65 CVE6 critCVSS 7.1Nuclei 2PoC 12debian gnu/linux (59) · linux (7) · open vswitch (2)
- 62 CVE1 critCVSS 6.8KEV 1PoC 10windows 10 1803 (27) · windows server 2016 (24) · windows 10 (23)
- 61 CVE6 critCVSS 7.2KEV 1PoC 9ubuntu linux (61)
- 52 CVE5 critCVSS 7.0Nuclei 1PoC 14astra linux special edition (41) · astra linux common edition (16) · astra linux special edition для «эльбрус» (11)
- 40 CVE1 critCVSS 6.5PoC 2rational engineering lifecycle manager (5) · websphere portal (4) · websphere application server (4)
- 35 CVE4 critCVSS 7.3×7.0Nuclei 1PoC 5ubuntu (35)
- 28 CVECVSS 6.8NEWPoC 1glusterfs (11) · undertow (2) · cfme (2)
- 23 CVE4 critCVSS 8.4PoC 6sth-eth-250 firmware (14) · smartthings hub sth-eth-250 (13) · galaxy apps (3)
- 21 CVE2 critCVSS 7.0converged security management engine firmware (6) · active management technology firmware (3) · manageability engine firmware (3)
- 21 CVE1 critCVSS 7.0Nuclei 1PoC 1org.apache.tika:tika-core (3) · org.elasticsearch:elasticsearch (2) · org.apache.karaf:apache-karaf (2)
- 20 CVE2 critCVSS 7.0NEWintel(r) active management technology (3) · intel(r) extreme tuning utility (3) · intel-sa-00086 detection tool (1)
- 20 CVECVSS 7.1×5.0PoC 2red hat enterprise linux (19) · jboss core services (1) · spice-gtk (1)
- 19 CVE1 critCVSS 7.7PoC 3opensuse leap (17) · suse linux enterprise module for basesystem (3) · suse linux enterprise server (3)
- 18 CVE6 critCVSS 8.0KEV 1Nuclei 1PoC 1coldfusion (9) · acrobat reader dc (7) · acrobat dc (7)
- 18 CVE5 critCVSS 7.9PoC 5elefant/cms (3) · smarty/smarty (2) · gleez/cms (2)
- 17 CVE2 critCVSS 7.9×8.5PoC 2leap (17)
- 17 CVE3 critCVSS 7.3PoC 8ос он «стрелец» (17)
- 16 CVE2 critCVSS 7.8NEWsd450 firmware (16) · sd430 firmware (16) · sd425 firmware (15)
- 16 CVE1 critCVSS 8.7PoC 2actionpack (6) · rails-html-sanitizer (3) · activemodel (1)
- 16 CVE1 critCVSS 6.9PoC 3tl-wr886n firmware (15) · eap controller (1)
- 14 CVE1 critCVSS 7.0spamassassin (3) · tika (3) · karaf (2)
- 14 CVECVSS 7.1PoC 3ghostscript (12) · gpl ghostscript (3) · mupdf (2)
- 14 CVE1 critCVSS 7.3PoC 3microsoft.chakracore (10) · microsoft.aspnetcore.all (2) · microsoft.data.odata (1)
- 13 CVE1 critCVSS 7.1apache tika (3) · apache spamassassin (3) · apache karaf (2)
- 13 CVE2 critCVSS 7.4PoC 2imagemagick (13)
- 13 CVECVSS 6.3NEWPoC 4opensc (13)
- 13 CVE1 critCVSS 6.6×4.3PoC 5осон основа оnyx (13)
- 12 CVE2 critCVSS 7.8PoC 5c1 firmware (12) · foscam c1 indoor hd camera (7) · foscam indoor ip camera c1 series (5)
- 12 CVECVSS 7.7NEWglusterfs (12)
- 12 CVECVSS 6.7NEWPoC 10hdf5 (12)
- 12 CVECVSS 5.6×3.0PoC 1mate 10 pro firmware (2) · alp-l09 firmware (2) · lelandp-l22d firmware (1)
- 12 CVECVSS 5.8PoC 1alp-l09 (2) · g9 lite, honor 5a, honor 6x, honor 8 (1) · hirouter-cd20, ws5200-10 (1)
- 12 CVE2 critCVSS 7.9webcenter interaction (8) · enterprise manager ops center (2) · enterprise repository (1)
- 12 CVECVSS 7.6Nuclei 1business one (2) · enterprise financial services (2) · sap enterprise financial services (2)
- 11 CVE2 critCVSS 7.5PoC 4arcsight management center (5) · intelligent management center wireless services manager software (2) · integrated lights-out 4 firmware (2)
- 11 CVECVSS 6.8KEV 1PoC 3linux kernel (11) · kernel (2)
- 10 CVE2 critCVSS 7.0NEWPoC 4xbtit (10)
- 10 CVE1 critCVSS 7.6×5.0storcenter px12-450r firmware (5) · ez media \& backup center firmware (5) · ix2 firmware (5)
- 10 CVECVSS 6.2NEWNuclei 1PoC 4monstra (10)
- 10 CVECVSS 6.1NEWPoC 10mp c1803 jpn firmware (1) · mp c307 firmware (1) · mp c406zspf firmware (1)
- 10 CVE1 critCVSS 7.4NEWPoC 3moodle (2) · curl (1) · haproxy (1)
- 9 CVECVSS 7.8NEWPoC 1ghostscript (9)
- 9 CVE1 critCVSS 6.4NEWdell emc unityvsa (3) · rsa bsafe ssl-j (3) · dell emc unity (3)
- 9 CVECVSS 6.5Nuclei 1elastic cloud enterprise (3) · elasticsearch (3) · elasticsearch x-pack machine learning (2)
- 9 CVECVSS 6.8PoC 3freebsd (9)
| # | Vendor | CVEs | Crit | KEV | Nuclei | Signals | Top products | Δ | |
|---|---|---|---|---|---|---|---|---|---|
| 1 | debian | 102 | 6 | · | 2 | Nuclei 2PoC 11 | debian linux (102) | — | |
| 2 | 82 | · | · | · | android (56) · chrome (25) · gvisor (1) | — | |||
| 3 | redhat | 82 | 1 | 1 | 1 | ×3.3KEV 1Nuclei 1PoC 7 | enterprise linux server (56) · enterprise linux workstation (45) · enterprise linux desktop (44) | — | |
| 4 | microsoft | 65 | 1 | 1 | · | KEV 1PoC 12 | windows 10 (31) · windows 10 servers (29) · windows server 2016 (29) | — | |
| 5 | qualcomm, inc. | 65 | 2 | · | · | android for msm, firefox os for msm, qrd android (50) · snapdragon automobile, snapdragon mobile, snapdragon wear (12) · snapdragon mobile, snapdragon wear (1) | — | ||
| 6 | сообщество свободного программного обеспечения | 65 | 6 | · | 2 | Nuclei 2PoC 12 | debian gnu/linux (59) · linux (7) · open vswitch (2) | — | |
| 7 | microsoft corp | 62 | 1 | 1 | · | KEV 1PoC 10 | windows 10 1803 (27) · windows server 2016 (24) · windows 10 (23) | — | |
| 8 | canonical | 61 | 6 | 1 | · | KEV 1PoC 9 | ubuntu linux (61) | — | |
| 9 | ооо «русбитех-астра» | 52 | 5 | · | 1 | Nuclei 1PoC 14 | astra linux special edition (41) · astra linux common edition (16) · astra linux special edition для «эльбрус» (11) | — | |
| 10 | ibm | 40 | 1 | · | · | PoC 2 | rational engineering lifecycle manager (5) · websphere portal (4) · websphere application server (4) | — | |
| 11 | canonical ltd. | 35 | 4 | · | 1 | ×7.0Nuclei 1PoC 5 | ubuntu (35) | — | |
| 12 | red hat | 28 | · | · | · | NEWPoC 1 | glusterfs (11) · undertow (2) · cfme (2) | — | |
| 13 | samsung | 23 | 4 | · | · | PoC 6 | sth-eth-250 firmware (14) · smartthings hub sth-eth-250 (13) · galaxy apps (3) | — | |
| 14 | intel | 21 | 2 | · | · | converged security management engine firmware (6) · active management technology firmware (3) · manageability engine firmware (3) | — | ||
| 15 | maven | 21 | 1 | · | 1 | Nuclei 1PoC 1 | org.apache.tika:tika-core (3) · org.elasticsearch:elasticsearch (2) · org.apache.karaf:apache-karaf (2) | — | |
| 16 | intel corporation | 20 | 2 | · | · | NEW | intel(r) active management technology (3) · intel(r) extreme tuning utility (3) · intel-sa-00086 detection tool (1) | — | |
| 17 | red hat inc. | 20 | · | · | · | ×5.0PoC 2 | red hat enterprise linux (19) · jboss core services (1) · spice-gtk (1) | — | |
| 18 | novell inc. | 19 | 1 | · | · | PoC 3 | opensuse leap (17) · suse linux enterprise module for basesystem (3) · suse linux enterprise server (3) | — | |
| 19 | adobe | 18 | 6 | 1 | 1 | KEV 1Nuclei 1PoC 1 | coldfusion (9) · acrobat reader dc (7) · acrobat dc (7) | — | |
| 20 | packagist | 18 | 5 | · | · | PoC 5 | elefant/cms (3) · smarty/smarty (2) · gleez/cms (2) | — | |
| 21 | opensuse | 17 | 2 | · | · | ×8.5PoC 2 | leap (17) | — | |
| 22 | ао «концерн вниинс» | 17 | 3 | · | · | PoC 8 | ос он «стрелец» (17) | — | |
| 23 | qualcomm | 16 | 2 | · | · | NEW | sd450 firmware (16) · sd430 firmware (16) · sd425 firmware (15) | — | |
| 24 | rubygems | 16 | 1 | · | · | PoC 2 | actionpack (6) · rails-html-sanitizer (3) · activemodel (1) | — | |
| 25 | tp-link | 16 | 1 | · | · | PoC 3 | tl-wr886n firmware (15) · eap controller (1) | — | |
| 26 | apache | 14 | 1 | · | · | spamassassin (3) · tika (3) · karaf (2) | — | ||
| 27 | artifex | 14 | · | · | · | PoC 3 | ghostscript (12) · gpl ghostscript (3) · mupdf (2) | — | |
| 28 | nuget | 14 | 1 | · | · | PoC 3 | microsoft.chakracore (10) · microsoft.aspnetcore.all (2) · microsoft.data.odata (1) | — | |
| 29 | apache software foundation | 13 | 1 | · | · | apache tika (3) · apache spamassassin (3) · apache karaf (2) | — | ||
| 30 | imagemagick | 13 | 2 | · | · | PoC 2 | imagemagick (13) | — | |
| 31 | opensc project | 13 | · | · | · | NEWPoC 4 | opensc (13) | — | |
| 32 | ао "нппкт" | 13 | 1 | · | · | ×4.3PoC 5 | осон основа оnyx (13) | — | |
| 33 | foscam | 12 | 2 | · | · | PoC 5 | c1 firmware (12) · foscam c1 indoor hd camera (7) · foscam indoor ip camera c1 series (5) | — | |
| 34 | gluster | 12 | · | · | · | NEW | glusterfs (12) | — | |
| 35 | hdfgroup | 12 | · | · | · | NEWPoC 10 | hdf5 (12) | — | |
| 36 | huawei | 12 | · | · | · | ×3.0PoC 1 | mate 10 pro firmware (2) · alp-l09 firmware (2) · lelandp-l22d firmware (1) | — | |
| 37 | huawei technologies co., ltd. | 12 | · | · | · | PoC 1 | alp-l09 (2) · g9 lite, honor 5a, honor 6x, honor 8 (1) · hirouter-cd20, ws5200-10 (1) | — | |
| 38 | oracle | 12 | 2 | · | · | webcenter interaction (8) · enterprise manager ops center (2) · enterprise repository (1) | — | ||
| 39 | sap | 12 | · | · | 1 | Nuclei 1 | business one (2) · enterprise financial services (2) · sap enterprise financial services (2) | — | |
| 40 | hp | 11 | 2 | · | · | PoC 4 | arcsight management center (5) · intelligent management center wireless services manager software (2) · integrated lights-out 4 firmware (2) | — | |
| 41 | linux | 11 | · | 1 | · | KEV 1PoC 3 | linux kernel (11) · kernel (2) | — | |
| 42 | btiteam | 10 | 2 | · | · | NEWPoC 4 | xbtit (10) | — | |
| 43 | lenovo | 10 | 1 | · | · | ×5.0 | storcenter px12-450r firmware (5) · ez media \& backup center firmware (5) · ix2 firmware (5) | — | |
| 44 | monstra | 10 | · | · | 1 | NEWNuclei 1PoC 4 | monstra (10) | — | |
| 45 | ricoh | 10 | · | · | · | NEWPoC 10 | mp c1803 jpn firmware (1) · mp c307 firmware (1) · mp c406zspf firmware (1) | — | |
| 46 | [unknown] | 10 | 1 | · | · | NEWPoC 3 | moodle (2) · curl (1) · haproxy (1) | — | |
| 47 | artifex software inc. | 9 | · | · | · | NEWPoC 1 | ghostscript (9) | — | |
| 48 | dell emc | 9 | 1 | · | · | NEW | dell emc unityvsa (3) · rsa bsafe ssl-j (3) · dell emc unity (3) | — | |
| 49 | elastic | 9 | · | · | 1 | Nuclei 1 | elastic cloud enterprise (3) · elasticsearch (3) · elasticsearch x-pack machine learning (2) | — | |
| 50 | freebsd | 9 | · | · | · | PoC 3 | freebsd (9) | — |