month report
May 2019
Data as of Jun 11, 2026, 06:05 UTCSnapshot v1 Sources CVEList V5+NVD+GHSA+CSAF+FSTEC BDU+CISA KEV+EPSS+Nuclei templates Methodology →
May 2019 closed with 1,366 published CVEs. 260 criticals, adobe led volume, mostly via acrobat dc. Top weakness class — CWE-79 (181 CVE). 10 vendors cracked the top-100 for the first time.
Total CVEs
1,366
— MoM— YoY
Severity mix
260 / 560
critical / high
KEV added
0
0 ransomware-linked
Nuclei coverage
3.4%
47 CVEs with templates
Time to exploit
How fast the community ships detection after a CVE drops.
Days → Nuclei (median)
2488.2
n=47
Within 7 days
0.0%
Within 30 days
0.0%
Days → KEV (median)
1045
n=14
Weakness × Vendor
What's spreading where in May 2019
Cells shaded by share of vendor's hottest weakness. Click any cell to open the CWE history.
79XSS125Out-of-bounds Read787Out-of-bounds Write416Use After Free20Improper Input Validation22Path Traversal200Information Exposure89SQL Injection78OS Command Injection119Memory Buffer Boundsadobe280366128adobe systems inc.248315626cisco5118632135cisco systems inc.5117622115microsoft721131microsoft corp7213сообщество свободного программного обеспечения37776233ооо «русбитех-астра»25545321schneider electric22311novell inc.55433qualcomm26136schneider-electric22211
Most discussed CVEs — May 2019
No CVE mentions in the news this month yet.
First time in top-100
Vendors never in top-100 in the prior 24 periods.
- #6schneider electric42 CVE
- #8qualcomm41 CVE
- #9schneider-electric41 CVE
- #19fedora project26 CVE
- #20fedoraproject26 CVE
- #21gitlab26 CVE
- #22npm26 CVE
- #24cybozu20 CVE
- #25cybozu, inc.20 CVE
- #27open-xchange20 CVE
Top vendors
Ranked by distinct CVE count this period.
- 207 CVE78 critCVSS 8.6PoC 1acrobat dc (175) · adobe acrobat and reader (175) · acrobat reader dc (175)
- 98 CVE2 critCVSS 7.2Nuclei 1PoC 98nx-os (41) · cisco nx-os software (32) · firepower threat defense (16)
- 80 CVE3 critCVSS 7.5KEV 3PoC 3windows server (31) · windows server 2016 (30) · windows (30)
- 65 CVE10 critCVSS 7.2Nuclei 2PoC 21debian gnu/linux (58) · linux (17) · freeimages (2)
- 48 CVE7 critCVSS 7.6Nuclei 1PoC 14astra linux special edition (44) · astra linux special edition для «эльбрус» (10) · astra linux common edition (8)
- 42 CVE8 critCVSS 7.8NEWKEV 1Nuclei 1PoC 12modicon quantum (18) · modicon quantum safety controller (18) · plc simulator (18)
- 41 CVE4 critCVSS 7.7PoC 8opensuse leap (39) · suse linux enterprise module for open buildservice development tools (6) · suse openstack cloud (3)
- 41 CVE12 critCVSS 8.2NEWmdm9206 firmware (38) · mdm9607 firmware (38) · mdm9650 firmware (37)
- 41 CVE8 critCVSS 7.8NEWKEV 1Nuclei 1PoC 11modicon quantum firmware (23) · modicon premium firmware (21) · modicon m580 firmware (20)
- 38 CVE4 critCVSS 7.6Nuclei 1PoC 3leap (38) · backports (16) · backports sle (5)
- 35 CVE3 critCVSS 6.4KEV 1PoC 4intel celeron j series (7) · intel celeron n series (7) · intel converged security and manageability engine (7)
- 34 CVE2 critCVSS 6.5Nuclei 3PoC 6org.jenkins-ci.plugins:artifactory (4) · org.apache.jspwiki:jspwiki-main (3) · org.apache.jspwiki:jspwiki-war (3)
- 31 CVE12 critCVSS 8.3snapdragon auto, snapdragon compute, snapdragon consumer iot, snapdragon industrial iot, snapdragon mobile (5) · snapdragon auto, snapdragon compute, snapdragon connectivity, snapdragon consumer iot, snapdragon industrial iot, snapdragon iot, snapdragon mobile, snapdragon wearables (3) · snapdragon auto, snapdragon compute, snapdragon consumer electronics connectivity, snapdragon consumer iot, snapdragon industrial iot, snapdragon mobile, snapdragon voice & music, snapdragon wearables (3)
- 30 CVE3 critCVSS 7.6PoC 1chrome (17) · google chrome (16) · android (12)
- 30 CVE1 critCVSS 5.8spectrum control (4) · spectrum control standard edition (4) · api connect (3)
- 29 CVE5 critCVSS 7.5Nuclei 1PoC 10ubuntu (20) · ubuntu linux (20)
- 28 CVE5 critCVSS 7.4PoC 10debian linux (28)
- 27 CVE5 critCVSS 6.5PoC 7red hat enterprise linux (15) · enterprise linux (8) · red hat virtualization (6)
- 26 CVE4 critCVSS 7.0NEWNuclei 1PoC 8fedora (26)
- 26 CVE4 critCVSS 7.3NEWPoC 8fedora (26)
- 26 CVE5 critCVSS 7.0NEWPoC 7gitlab (26)
- 26 CVECVSS 6.4NEWPoC 4remarkable (2) · harp (2) · webpack-bundle-analyzer (1)
- 23 CVE5 critCVSS 7.1KEV 1PoC 7simatic wincc \(tia portal\) (6) · simatic wincc runtime professional (6) · simatic wincc (tia portal) (6)
- 20 CVE1 critCVSS 5.7NEWgaroon (20)
- 20 CVE1 critCVSS 5.7NEWcybozu garoon (20)
- 20 CVE1 critCVSS 7.5microsoft.chakracore (14) · system.private.uri (2) · system.text.regularexpressions (1)
- 20 CVE5 critCVSS 7.3NEWopen-xchange appsuite (19) · ox cloud (1)
- 20 CVE2 critCVSS 6.7NEWPoC 12manageengine netflow analyzer (7) · manageengine applications manager (4) · manageengine firewall analyzer (3)
- 20 CVE3 critCVSS 7.5Nuclei 1PoC 9ос он «стрелец» (20)
- 19 CVE6 critCVSS 6.6PoC 5big-ip application security manager (10) · big-ip policy enforcement manager (10) · big-ip access policy manager (10)
- 16 CVECVSS 5.0NEWdr.web enterprise security suite (16)
- 16 CVE1 critCVSS 6.5PoC 3linux kernel (16)
- 15 CVE5 critCVSS 7.9Nuclei 1PoC 11symfony/symfony (6) · symfony/security (2) · drupal/core (2)
- 14 CVE2 critCVSS 6.8Nuclei 2PoC 4jspwiki (3) · commons imaging (2) · activemq (2)
- 14 CVE4 critCVSS 7.3Nuclei 3PoC 8timesten in-memory database (3) · mysql server (2) · enterprise manager base platform (2)
- 12 CVE1 critCVSS 6.0NEWjenkins artifactory plugin (4) · jenkins warnings ng plugin (2) · warnings next generation (2)
- 12 CVECVSS 7.9NEWKEV 1PoC 7airlink es450 firmware (11) · aleos (1)
- 11 CVE4 critCVSS 8.6NEWPoC 3roav dashcam a1 firmware (11)
- 11 CVE3 critCVSS 7.0KEV 1Nuclei 2PoC 4zimbra collaboration suite (10) · zimbra collaboration server (1)
- 10 CVE2 critCVSS 8.2NEWsmart home controller firmware (6) · smart home controller (6) · video recording manager (3)
- 10 CVE1 critCVSS 7.7NEWPoC 5computrols building automation software (9) · computrols building automation system (1)
- 10 CVE1 critCVSS 6.8NEWNuclei 2PoC 6nas os (10)
- 9 CVE1 critCVSS 7.0Nuclei 1PoC 3apache jspwiki (3) · apache roller (1) · apache zookeeper (1)
- 9 CVECVSS 7.5PoC 2snapprotect (3) · oncommand unified manager (2) · active iq unified manager (2)
- 9 CVECVSS 7.3NEWsnapdragon automobile, snapdragon mobile, snapdragon wear (5) · snapdragon mobile (2) · snapdragon mobile, snapdragon wear (1)
- 9 CVE1 critCVSS 7.1PoC 3осон основа оnyx (9)
- 7 CVECVSS 6.4Nuclei 5jira (7) · jira server (6)
- 7 CVE3 critCVSS 9.2NEWKEV 1PoC 45200w-t firmware (7)
- 7 CVE1 critCVSS 8.1NEWKEV 1facebook thrift (5) · thrift (5) · whatsapp for android (2)
- 7 CVECVSS 6.5KEV 1forticlient (4) · fortinet forticlient for windows (3) · fortios (2)
| # | Vendor | CVEs | Crit | KEV | Nuclei | Signals | Top products | Δ | |
|---|---|---|---|---|---|---|---|---|---|
| 1 | adobe | 207 | 78 | · | · | PoC 1 | acrobat dc (175) · adobe acrobat and reader (175) · acrobat reader dc (175) | — | |
| 2 | cisco | 98 | 2 | · | 1 | Nuclei 1PoC 98 | nx-os (41) · cisco nx-os software (32) · firepower threat defense (16) | — | |
| 3 | microsoft | 80 | 3 | 3 | · | KEV 3PoC 3 | windows server (31) · windows server 2016 (30) · windows (30) | — | |
| 4 | сообщество свободного программного обеспечения | 65 | 10 | · | 2 | Nuclei 2PoC 21 | debian gnu/linux (58) · linux (17) · freeimages (2) | — | |
| 5 | ооо «русбитех-астра» | 48 | 7 | · | 1 | Nuclei 1PoC 14 | astra linux special edition (44) · astra linux special edition для «эльбрус» (10) · astra linux common edition (8) | — | |
| 6 | schneider electric | 42 | 8 | 1 | 1 | NEWKEV 1Nuclei 1PoC 12 | modicon quantum (18) · modicon quantum safety controller (18) · plc simulator (18) | — | |
| 7 | novell inc. | 41 | 4 | · | · | PoC 8 | opensuse leap (39) · suse linux enterprise module for open buildservice development tools (6) · suse openstack cloud (3) | — | |
| 8 | qualcomm | 41 | 12 | · | · | NEW | mdm9206 firmware (38) · mdm9607 firmware (38) · mdm9650 firmware (37) | — | |
| 9 | schneider-electric | 41 | 8 | 1 | 1 | NEWKEV 1Nuclei 1PoC 11 | modicon quantum firmware (23) · modicon premium firmware (21) · modicon m580 firmware (20) | — | |
| 10 | opensuse | 38 | 4 | · | 1 | Nuclei 1PoC 3 | leap (38) · backports (16) · backports sle (5) | — | |
| 11 | intel | 35 | 3 | 1 | · | KEV 1PoC 4 | intel celeron j series (7) · intel celeron n series (7) · intel converged security and manageability engine (7) | — | |
| 12 | maven | 34 | 2 | · | 3 | Nuclei 3PoC 6 | org.jenkins-ci.plugins:artifactory (4) · org.apache.jspwiki:jspwiki-main (3) · org.apache.jspwiki:jspwiki-war (3) | — | |
| 13 | qualcomm, inc. | 31 | 12 | · | · | snapdragon auto, snapdragon compute, snapdragon consumer iot, snapdragon industrial iot, snapdragon mobile (5) · snapdragon auto, snapdragon compute, snapdragon connectivity, snapdragon consumer iot, snapdragon industrial iot, snapdragon iot, snapdragon mobile, snapdragon wearables (3) · snapdragon auto, snapdragon compute, snapdragon consumer electronics connectivity, snapdragon consumer iot, snapdragon industrial iot, snapdragon mobile, snapdragon voice & music, snapdragon wearables (3) | — | ||
| 14 | 30 | 3 | · | · | PoC 1 | chrome (17) · google chrome (16) · android (12) | — | ||
| 15 | ibm | 30 | 1 | · | · | spectrum control (4) · spectrum control standard edition (4) · api connect (3) | — | ||
| 16 | canonical | 29 | 5 | · | 1 | Nuclei 1PoC 10 | ubuntu (20) · ubuntu linux (20) | — | |
| 17 | debian | 28 | 5 | · | · | PoC 10 | debian linux (28) | — | |
| 18 | redhat | 27 | 5 | · | · | PoC 7 | red hat enterprise linux (15) · enterprise linux (8) · red hat virtualization (6) | — | |
| 19 | fedora project | 26 | 4 | · | 1 | NEWNuclei 1PoC 8 | fedora (26) | — | |
| 20 | fedoraproject | 26 | 4 | · | · | NEWPoC 8 | fedora (26) | — | |
| 21 | gitlab | 26 | 5 | · | · | NEWPoC 7 | gitlab (26) | — | |
| 22 | npm | 26 | · | · | · | NEWPoC 4 | remarkable (2) · harp (2) · webpack-bundle-analyzer (1) | — | |
| 23 | siemens | 23 | 5 | 1 | · | KEV 1PoC 7 | simatic wincc \(tia portal\) (6) · simatic wincc runtime professional (6) · simatic wincc (tia portal) (6) | — | |
| 24 | cybozu | 20 | 1 | · | · | NEW | garoon (20) | — | |
| 25 | cybozu, inc. | 20 | 1 | · | · | NEW | cybozu garoon (20) | — | |
| 26 | nuget | 20 | 1 | · | · | microsoft.chakracore (14) · system.private.uri (2) · system.text.regularexpressions (1) | — | ||
| 27 | open-xchange | 20 | 5 | · | · | NEW | open-xchange appsuite (19) · ox cloud (1) | — | |
| 28 | zohocorp | 20 | 2 | · | · | NEWPoC 12 | manageengine netflow analyzer (7) · manageengine applications manager (4) · manageengine firewall analyzer (3) | — | |
| 29 | ао «концерн вниинс» | 20 | 3 | · | 1 | Nuclei 1PoC 9 | ос он «стрелец» (20) | — | |
| 30 | f5 | 19 | 6 | · | · | PoC 5 | big-ip application security manager (10) · big-ip policy enforcement manager (10) · big-ip access policy manager (10) | — | |
| 31 | drweb | 16 | · | · | · | NEW | dr.web enterprise security suite (16) | — | |
| 32 | linux | 16 | 1 | · | · | PoC 3 | linux kernel (16) | — | |
| 33 | packagist | 15 | 5 | · | 1 | Nuclei 1PoC 11 | symfony/symfony (6) · symfony/security (2) · drupal/core (2) | — | |
| 34 | apache | 14 | 2 | · | 2 | Nuclei 2PoC 4 | jspwiki (3) · commons imaging (2) · activemq (2) | — | |
| 35 | oracle | 14 | 4 | · | 3 | Nuclei 3PoC 8 | timesten in-memory database (3) · mysql server (2) · enterprise manager base platform (2) | — | |
| 36 | jenkins | 12 | 1 | · | · | NEW | jenkins artifactory plugin (4) · jenkins warnings ng plugin (2) · warnings next generation (2) | — | |
| 37 | sierrawireless | 12 | · | 1 | · | NEWKEV 1PoC 7 | airlink es450 firmware (11) · aleos (1) | — | |
| 38 | anker-in | 11 | 4 | · | · | NEWPoC 3 | roav dashcam a1 firmware (11) | — | |
| 39 | synacor | 11 | 3 | 1 | 2 | KEV 1Nuclei 2PoC 4 | zimbra collaboration suite (10) · zimbra collaboration server (1) | — | |
| 40 | bosch | 10 | 2 | · | · | NEW | smart home controller firmware (6) · smart home controller (6) · video recording manager (3) | — | |
| 41 | computrols | 10 | 1 | · | · | NEWPoC 5 | computrols building automation software (9) · computrols building automation system (1) | — | |
| 42 | seagate | 10 | 1 | · | 2 | NEWNuclei 2PoC 6 | nas os (10) | — | |
| 43 | apache software foundation | 9 | 1 | · | 1 | Nuclei 1PoC 3 | apache jspwiki (3) · apache roller (1) · apache zookeeper (1) | — | |
| 44 | netapp | 9 | · | · | · | PoC 2 | snapprotect (3) · oncommand unified manager (2) · active iq unified manager (2) | — | |
| 45 | qualcomm technologies, inc. | 9 | · | · | · | NEW | snapdragon automobile, snapdragon mobile, snapdragon wear (5) · snapdragon mobile (2) · snapdragon mobile, snapdragon wear (1) | — | |
| 46 | ао "нппкт" | 9 | 1 | · | · | PoC 3 | осон основа оnyx (9) | — | |
| 47 | atlassian | 7 | · | · | 5 | Nuclei 5 | jira (7) · jira server (6) | — | |
| 48 | billion | 7 | 3 | 1 | · | NEWKEV 1PoC 4 | 5200w-t firmware (7) | — | |
| 49 | 7 | 1 | 1 | · | NEWKEV 1 | facebook thrift (5) · thrift (5) · whatsapp for android (2) | — | ||
| 50 | fortinet | 7 | · | 1 | · | KEV 1 | forticlient (4) · fortinet forticlient for windows (3) · fortios (2) | — |
Sectors
Solution categories ranked by distinct CVE count this period.
- Consumer Software236 CVE526 crit1 KEV26 vendorsCVSS 8.8acrobat dc (175) · acrobat reader dc (175) · adobe acrobat and reader (175)
- Operating Systems225 CVE121 crit88 KEV32 vendorsCVSS 8.9debian gnu/linux (58) · fedora (52) · astra linux special edition (44)
- Enterprise Software178 CVE122 crit65 KEV49 vendorsCVSS 7.9jira (7) · manageengine netflow analyzer (7) · jira server (6)
- OSS Libraries177 CVE38 crit6 KEV49 vendorsCVSS 7.9simple directmedia layer (7) · sdl2 image (6) · freeimage (4)
- Networking Infrastructure157 CVE48 crit7 KEV31 vendorsCVSS 9.3nx-os (75) · cisco nx-os software (32) · firepower threat defense (31)
- Hardware Firmware131 CVE485 crit46 KEV26 vendorsCVSS 9.0intel celeron j series (7) · intel celeron n series (7) · intel converged security and manageability engine (7)
- ICS / OT / IoT115 CVE169 crit2 KEV32 vendorsCVSS 8.3modicon quantum firmware (23) · modicon premium firmware (21) · modicon m340 firmware (20)
- Web & CMS Plugins93 CVE37 crit5 KEV62 vendorsCVSS 9.3drupal (5) · exponent cms (4) · typesetter (4)
- Security Products83 CVE25 crit4 KEV39 vendorsCVSS 8.5dr.web enterprise security suite (16) · scan engines (3) · antivirus engine (2)
- DevTools & CI57 CVE11 crit18 vendorsCVSS 7.6gitlab (26) · gitea (1)
- Communications55 CVE24 crit10 KEV19 vendorsCVSS 9.3open-xchange appsuite (19) · zimbra collaboration suite (11) · dovecot (4)
- Mobile Apps35 CVE47 crit41 KEV6 vendorsCVSS 8.6chrome (17) · google chrome (16) · android (13)
- Cloud & SaaS29 CVE7 crit3 KEV19 vendorsCVSS 8.7qemu (2) · sharefile (2) · cockpit-ovirt (1)
- Databases21 CVE7 crit10 vendorsCVSS 7.8enterprise manager base platform (4) · enterprise manager ops center (4) · sqlite (4)
- Unclassified59 CVE34 crit36 vendorsCVSS 8.1contour diabetes (5) · dir-822 firmware (4) · bilboplanet (3)
| Sector | CVEs | Crit | KEV | Vendors | Products | Avg CVSS | Top products |
|---|---|---|---|---|---|---|---|
| Consumer Software▸ 5 | 236 | 526 | 1 | 26 | 69 | 8.8 | acrobat dc (175) · acrobat reader dc (175) · adobe acrobat and reader (175) |
| Operating Systems▸ 5 | 225 | 121 | 88 | 32 | 265 | 8.9 | debian gnu/linux (58) · fedora (52) · astra linux special edition (44) |
| Enterprise Software▸ 7 | 178 | 122 | 65 | 49 | 265 | 7.9 | jira (7) · manageengine netflow analyzer (7) · jira server (6) |
| OSS Libraries▸ 8 | 177 | 38 | 6 | 49 | 141 | 7.9 | simple directmedia layer (7) · sdl2 image (6) · freeimage (4) |
| Networking Infrastructure▸ 6 | 157 | 48 | 7 | 31 | 418 | 9.3 | nx-os (75) · cisco nx-os software (32) · firepower threat defense (31) |
| Hardware Firmware▸ 5 | 131 | 485 | 46 | 26 | 353 | 9.0 | intel celeron j series (7) · intel celeron n series (7) · intel converged security and manageability engine (7) |
| ICS / OT / IoT▸ 6 | 115 | 169 | 2 | 32 | 368 | 8.3 | modicon quantum firmware (23) · modicon premium firmware (21) · modicon m340 firmware (20) |
| Web & CMS Plugins▸ 5 | 93 | 37 | 5 | 62 | 93 | 9.3 | drupal (5) · exponent cms (4) · typesetter (4) |
| Security Products▸ 6 | 83 | 25 | 4 | 39 | 101 | 8.5 | dr.web enterprise security suite (16) · scan engines (3) · antivirus engine (2) |
| DevTools & CI▸ 4 | 57 | 11 | · | 18 | 32 | 7.6 | gitlab (26) · gitea (1) |
| Communications▸ 4 | 55 | 24 | 10 | 19 | 33 | 9.3 | open-xchange appsuite (19) · zimbra collaboration suite (11) · dovecot (4) |
| Mobile Apps▸ 1 | 35 | 47 | 41 | 6 | 52 | 8.6 | chrome (17) · google chrome (16) · android (13) |
| Cloud & SaaS▸ 5 | 29 | 7 | 3 | 19 | 27 | 8.7 | qemu (2) · sharefile (2) · cockpit-ovirt (1) |
| Databases▸ 3 | 21 | 7 | · | 10 | 84 | 7.8 | enterprise manager base platform (4) · enterprise manager ops center (4) · sqlite (4) |
| Unclassified | 59 | 34 | · | 36 | 56 | 8.1 | contour diabetes (5) · dir-822 firmware (4) · bilboplanet (3) |
Weakness × Sector
Which weaknesses hit which solution categories in May 2019
Cells shaded by share of the sector's hottest weakness. Click a row to open the sector history.
79XSS125Out-of-bounds Read787Out-of-bounds Write416Use After Free20Improper Input Validation22Path Traversal200Information Exposure89SQL Injection78OS Command Injection119Memory Buffer BoundsConsumer Software68559647518Operating Systems91037121324211Networking Infrastructure1646218993256OSS Libraries23173124133311Enterprise Software5925123122ICS / OT / IoT103911211433Hardware Firmware943910281612Web & CMS Plugins38238313Security Products1543113311DevTools & CI72131311