CVE Tools
Sign in
month report

September 2018

Data as of Jun 11, 2026, 06:05 UTCSnapshot v1 Sources CVEList V5+NVD+GHSA+CSAF+FSTEC BDU+CISA KEV+EPSS+Nuclei templates Methodology →

September 2018 closed with 1,209 published CVEs. 166 criticals, debian led volume, mostly via debian linux. Top weakness class — CWE-79 (169 CVE). 10 vendors cracked the top-100 for the first time.

Print view
Total CVEs
1,209
— MoM— YoY
Severity mix
166 / 493
critical / high
KEV added
0
0 ransomware-linked
Nuclei coverage
2.7%
33 CVEs with templates

Time to exploit

How fast the community ships detection after a CVE drops.

Days → Nuclei (median)
2728.2
n=33
Within 7 days
0.0%
Within 30 days
0.0%
Days → KEV (median)
1292
n=3
Detection gap

KEV pressure, no Nuclei coverage

September 2018 · vendors with active exploitation listed by CISA but no public detection template.

Weakness × Vendor

What's spreading where in September 2018

Cells shaded by share of vendor's hottest weakness. Click any cell to open the CWE history.

79XSS20Improper Input Validation200Information Exposure119Memory Buffer Bounds787Out-of-bounds Write89SQL Injection125Out-of-bounds Read352CSRF22Path Traversal78OS Command Injectiondebian22411410531google11761769redhat323131542microsoft4915111qualcomm, inc.511378сообщество свободного программного обеспечения151661011microsoft corp4815111canonical435651ооо «русбитех-астра»131448ibm72412canonical ltd.213372red hat17622

Most discussed CVEs — September 2018

No CVE mentions in the news this month yet.

First time in top-100

Vendors never in top-100 in the prior 24 periods.

Top vendors

Ranked by distinct CVE count this period.

  • 1debian—
    102 CVE6 critCVSS 7.0
    Nuclei 2PoC 11
    debian linux (102)
  • 2redhat—
    92 CVE1 critCVSS 6.9
    KEV 1Nuclei 1PoC 8
    enterprise linux server (56) · enterprise linux workstation (45) · enterprise linux desktop (44)
  • 3google—
    84 CVECVSS 7.1
    Nuclei 1
    android (57) · chrome (25) · google chrome (3)
  • 4canonical—
    66 CVE6 critCVSS 7.2
    KEV 1Nuclei 1PoC 11
    ubuntu linux (61) · ubuntu (35)
  • 5microsoft—
    65 CVE1 critCVSS 6.7
    KEV 1PoC 12
    windows 10 (31) · windows server 2016 (29) · windows 10 servers (29)
  • 6qualcomm, inc.—
    65 CVE2 critCVSS 7.6
    NEW
    android for msm, firefox os for msm, qrd android (50) · snapdragon automobile, snapdragon mobile, snapdragon wear (12) · snapdragon automobile, snapdragon mobile (1)
  • 7сообщество свободного программного обеспечения—
    65 CVE6 critCVSS 7.1
    Nuclei 2PoC 12
    debian gnu/linux (59) · linux (7) · open vswitch (2)
  • 8ооо «русбитех-астра»—
    52 CVE5 critCVSS 7.0
    Nuclei 1PoC 14
    astra linux special edition (41) · astra linux common edition (16) · astra linux special edition для «эльбрус» (11)
  • 9ibm—
    40 CVE1 critCVSS 6.5
    PoC 2
    rational engineering lifecycle manager (5) · websphere portal (4) · websphere application server (4)
  • 10samsung—
    23 CVE4 critCVSS 8.4
    NEWPoC 6
    sth-eth-250 firmware (14) · smartthings hub sth-eth-250 (13) · galaxy apps (3)
  • 11intel—
    21 CVE2 critCVSS 7.2
    converged security management engine firmware (6) · intel converged security and manageability engine (4) · active management technology firmware (3)
  • 12maven—
    21 CVE1 critCVSS 7.0
    Nuclei 1PoC 1
    org.apache.tika:tika-core (3) · org.elasticsearch:elasticsearch (2) · org.apache.karaf:apache-karaf (2)
  • 13novell inc.—
    19 CVE1 critCVSS 7.7
    PoC 3
    opensuse leap (17) · suse linux enterprise module for basesystem (3) · suse linux enterprise server (3)
  • 14adobe—
    18 CVE6 critCVSS 8.0
    KEV 1Nuclei 1PoC 1
    coldfusion (9) · acrobat dc (7) · acrobat reader dc (7)
  • 15packagist—
    18 CVE5 critCVSS 7.9
    PoC 5
    elefant/cms (3) · smarty/smarty (2) · gleez/cms (2)
  • 16opensuse—
    17 CVE2 critCVSS 7.9
    PoC 2
    leap (17)
  • 17ао «концерн вниинс»—
    17 CVE3 critCVSS 7.3
    NEWPoC 8
    ос он «стрелец» (17)
  • 18qualcomm—
    16 CVE2 critCVSS 7.8
    NEW
    sd450 firmware (16) · sd430 firmware (16) · sd425 firmware (15)
  • 19rubygems—
    16 CVE1 critCVSS 8.7
    PoC 2
    actionpack (6) · rails-html-sanitizer (3) · smart_proxy_dynflow (1)
  • 20tp-link—
    16 CVE1 critCVSS 6.9
    NEWPoC 3
    tl-wr886n firmware (15) · eap controller (1)
  • 21apache—
    14 CVE1 critCVSS 7.0
    tika (3) · spamassassin (3) · mesos (2)
  • 22artifex—
    14 CVECVSS 7.1
    PoC 3
    ghostscript (12) · gpl ghostscript (3) · mupdf (2)
  • 23nuget—
    14 CVE1 critCVSS 7.3
    PoC 3
    microsoft.chakracore (10) · microsoft.aspnetcore.all (2) · microsoft.data.odata (1)
  • 24apache software foundation—
    13 CVE1 critCVSS 7.1
    apache tika (3) · apache spamassassin (3) · apache karaf (2)
  • 25imagemagick—
    13 CVE2 critCVSS 7.4
    NEWPoC 2
    imagemagick (13)
  • 26opensc project—
    13 CVECVSS 6.3
    NEWPoC 4
    opensc (13)
  • 27oracle—
    13 CVE3 critCVSS 8.0
    webcenter interaction (8) · enterprise manager ops center (2) · communications analytics (1)
  • 28ао "нппкт"—
    13 CVE1 critCVSS 6.6
    NEWPoC 5
    осон основа оnyx (13)
  • 29foscam—
    12 CVE2 critCVSS 7.8
    NEWPoC 5
    c1 firmware (12) · foscam c1 indoor hd camera (7) · foscam indoor ip camera c1 series (5)
  • 30gluster—
    12 CVECVSS 7.7
    NEW
    glusterfs (12)
  • 31hdfgroup—
    12 CVECVSS 6.7
    NEWPoC 10
    hdf5 (12)
  • 32hp—
    12 CVE2 critCVSS 7.7
    PoC 4
    arcsight management center (5) · hpe intelligent management center (2) · integrated lights-out 5 firmware (2)
  • 33huawei—
    12 CVECVSS 5.6
    PoC 1
    mate 10 pro firmware (2) · alp-l09 firmware (2) · lelandp-l22d firmware (1)
  • 34huawei technologies co., ltd.—
    12 CVECVSS 5.8
    NEWPoC 1
    alp-l09 (2) · g9 lite, honor 5a, honor 6x, honor 8 (1) · hirouter-cd20, ws5200-10 (1)
  • 35sap—
    12 CVECVSS 7.6
    Nuclei 1
    business one (2) · enterprise financial services (2) · sap enterprise financial services (2)
  • 36linux—
    11 CVECVSS 6.8
    KEV 1PoC 3
    linux kernel (11) · kernel (2)
  • 37btiteam—
    10 CVE2 critCVSS 7.0
    NEWPoC 4
    xbtit (10)
  • 38lenovo—
    10 CVE1 critCVSS 7.6
    px4-400d firmware (5) · ez media \& backup center firmware (5) · ix2 firmware (5)
  • 39monstra—
    10 CVECVSS 6.2
    NEWNuclei 1PoC 4
    monstra (10)
  • 40ricoh—
    10 CVECVSS 6.1
    NEWPoC 10
    aficio mp 301spf firmware (1) · mp 2001sp firmware (1) · mp 305\+ firmware (1)
  • 41[unknown]—
    10 CVE1 critCVSS 7.4
    NEWPoC 3
    moodle (2) · curl (1) · haproxy (1)
  • 42artifex software inc.—
    9 CVECVSS 7.8
    NEWPoC 1
    ghostscript (9)
  • 43dell emc—
    9 CVE1 critCVSS 6.4
    NEW
    dell emc unityvsa (3) · rsa bsafe ssl-j (3) · dell emc unity (3)
  • 44elastic—
    9 CVECVSS 6.5
    NEWNuclei 1
    elastic cloud enterprise (3) · elasticsearch (3) · elasticsearch x-pack machine learning (2)
  • 45freebsd—
    9 CVECVSS 6.8
    NEWPoC 3
    freebsd (9)
  • 46lenovo group ltd—
    9 CVE1 critCVSS 7.6
    NEW
    iomega storcenter (9) · ez media and backup center (9) · lenovoemc (9)
  • 47npm—
    9 CVE1 critCVSS 6.7
    PoC 4
    browserify-hmr (1) · editor.md (1) · exceljs (1)
  • 48philips—
    9 CVE2 critCVSS 8.0
    NEW
    e-alert firmware (9) · e-alert unit (non-medical device) (9)
  • 49pypi—
    9 CVECVSS 6.5
    PoC 1
    mayan-edms (3) · neutron (2) · matrix-synapse (1)
  • 50seacms—
    9 CVE3 critCVSS 7.3
    NEWPoC 5
    seacms (9)

Top weaknesses

CWE classes by distinct CVE count.

1CWE-79169—
2CWE-2084—
3CWE-20075—
4CWE-11971—
5CWE-78764—
6CWE-8951—
7CWE-12550—
8CWE-35244—
9CWE-2241—
10CWE-7827—
11CWE-73225—
12CWE-47623—
13CWE-9421—
14CWE-19020—
15CWE-28720—
16CWE-41620—
17CWE-40018—
18CWE-43416—
19CWE-12015—
20CWE-61113—

Sectors

Solution categories ranked by distinct CVE count this period.

  • Operating Systems345 CVE
    64 crit29 KEV40 vendorsCVSS 9.8
    debian linux (102) · ubuntu linux (61) · debian gnu/linux (59)
  • OSS Libraries216 CVE
    27 crit67 vendorsCVSS 8.7
    imagemagick (21) · opensc (13) · ghostscript (12)
  • Web & CMS Plugins174 CVE
    37 crit88 vendorsCVSS 9.5
    monstra (10) · seacms (9) · cscms (7)
  • Enterprise Software156 CVE
    19 crit1 KEV46 vendorsCVSS 8.0
    arcsight management center (10) · foreman (5) · opsview (5)
  • Mobile Apps121 CVE
    8 crit6 vendorsCVSS 7.2
    android (57) · chrome (25) · sth-eth-250 firmware (14)
  • Hardware Firmware107 CVE
    128 crit25 vendorsCVSS 9.8
    sd430 firmware (16) · sd450 firmware (16) · msm8996au firmware (15)
  • Networking Infrastructure77 CVE
    33 crit30 vendorsCVSS 8.4
    tl-wr886n firmware (15) · dir-816 a2 (6) · dir-816 a2 firmware (6)
  • ICS / OT / IoT71 CVE
    34 crit30 vendorsCVSS 8.7
    circarlife scada (4) · group controller firmware (4) · erpnext (3)
  • Consumer Software65 CVE
    29 crit2 KEV21 vendorsCVSS 8.2
    coldfusion (10) · acrobat dc (7) · acrobat reader dc (7)
  • Databases57 CVE
    19 crit11 vendorsCVSS 7.9
    webcenter interaction (8) · enterprise manager ops center (3) · ibm webshpere portal (3)
  • Security Products48 CVE
    10 crit19 KEV28 vendorsCVSS 9.8
    advanced systemcare (6) · messaging gateway (2) · symantec messaging gateway (2)
  • Cloud & SaaS36 CVE
    3 crit1 KEV21 vendorsCVSS 9.8
    kernel (3) · sharefile storagezones controller (2) · tcpreplay (2)
  • Communications30 CVE
    6 crit17 vendorsCVSS 9.8
    mgetty (5) · orchestration designer (2) · asterisk (1)
  • DevTools & CI14 CVE
    2 crit8 vendorsCVSS 9.8
    netwide assembler (4) · asset-pipeline (1) · proget (1)
  • AI / ML1 CVE
    1 vendorsCVSS 7.5
    polyai (1)
  • Unclassified84 CVE
    15 crit55 vendorsCVSS 7.3
    xbtit (10) · attachecase (8) · phpmywind (5)
Weakness × Sector

Which weaknesses hit which solution categories in September 2018

Cells shaded by share of the sector's hottest weakness. Click a row to open the sector history.

79XSS20Improper Input Validation200Information Exposure119Memory Buffer Bounds787Out-of-bounds Write89SQL Injection125Out-of-bounds Read352CSRF22Path Traversal78OS Command InjectionOperating Systems5453230292262OSS Libraries197102727219773Web & CMS Plugins68513012417Hardware Firmware15148211318225Enterprise Software475911111052Consumer Software121617213194ICS / OT / IoT3451092213Networking Infrastructure310512221312Databases4953481Security Products8532121112