CVE Tools
Sign in
month report

September 2019

Data as of Jun 11, 2026, 06:05 UTCSnapshot v1 Sources CVEList V5+NVD+GHSA+CSAF+FSTEC BDU+CISA KEV+EPSS+Nuclei templates Methodology →

September 2019 closed with 1,568 published CVEs. 188 criticals, google led volume, mostly via android. Top weakness class — CWE-79 (226 CVE). 10 vendors cracked the top-100 for the first time.

Print view
Total CVEs
1,568
— MoM— YoY
Severity mix
188 / 585
critical / high
KEV added
0
0 ransomware-linked
Nuclei coverage
18.0%
282 CVEs with templates

Time to exploit

How fast the community ships detection after a CVE drops.

Days → Nuclei (median)
2362.7
n=282
Within 7 days
0.0%
Within 30 days
0.0%
Days → KEV (median)
790
n=11
Detection gap

KEV pressure, no Nuclei coverage

September 2019 · vendors with active exploitation listed by CISA but no public detection template.

Weakness × Vendor

What's spreading where in September 2019

Cells shaded by share of vendor's hottest weakness. Click any cell to open the CWE history.

79XSS787Out-of-bounds Write125Out-of-bounds Read352CSRF20Improper Input Validation89SQL Injection200Information Exposure22Path Traversal416Use After Free476NULL Pointer Dereferencegoogle881092241154сообщество свободного программного обеспечения11157351388microsoft49271111microsoft corp49271111debian11108121311ао «концерн вниинс»41133341novell inc.38531183ооо «русбитех-астра»49311253canonical4910336maven16111opensuse110221144gitlab7181

Most discussed CVEs — September 2019

No CVE mentions in the news this month yet.

First time in top-100

Vendors never in top-100 in the prior 24 periods.

Top vendors

Ranked by distinct CVE count this period.

  • 1google—
    309 CVE3 critCVSS 6.9
    NEWPoC 1
    android (308) · chrome (1) · google chrome (1)
  • 2сообщество свободного программного обеспечения—
    127 CVE20 critCVSS 6.9
    NEWKEV 1Nuclei 16PoC 30
    debian gnu/linux (107) · linux (26) · phpipam (5)
  • 3canonical—
    82 CVE9 critCVSS 6.9
    NEWKEV 1Nuclei 4PoC 20
    ubuntu linux (63) · ubuntu (49)
  • 4microsoft—
    82 CVE1 critCVSS 7.1
    NEWKEV 5PoC 3
    windows (49) · windows 10 (48) · windows 10 1803 (47)
  • 5debian—
    78 CVE12 critCVSS 7.2
    NEWKEV 1Nuclei 10PoC 22
    debian linux (78)
  • 6ао «концерн вниинс»—
    70 CVE10 critCVSS 7.1
    NEWNuclei 3PoC 17
    ос он «стрелец» (70)
  • 7novell inc.—
    68 CVE5 critCVSS 5.9
    NEWNuclei 4PoC 17
    opensuse leap (65) · suse linux enterprise server for sap applications (18) · suse linux enterprise server (18)
  • 8ооо «русбитех-астра»—
    67 CVE9 critCVSS 7.1
    NEWNuclei 2PoC 13
    astra linux special edition (61) · astra linux special edition для «эльбрус» (28) · astra linux common edition (14)
  • 9maven—
    59 CVE6 critCVSS 6.4
    NEWNuclei 2PoC 2
    org.jenkins-ci.main:jenkins-core (6) · org.apache.jspwiki:jspwiki-war (5) · org.jenkins-ci.plugins:script-security (4)
  • 10opensuse—
    57 CVE6 critCVSS 6.8
    NEWNuclei 1PoC 18
    leap (56) · backports sle (3) · backports (1)
  • 11redhat—
    55 CVE3 critCVSS 7.2
    NEWNuclei 2PoC 18
    red hat enterprise linux (44) · enterprise linux (17) · openshift container platform (10)
  • 12gitlab—
    50 CVE2 critCVSS 6.0
    NEWNuclei 25PoC 9
    gitlab (49) · omnibus (1)
  • 13fedoraproject—
    45 CVE9 critCVSS 7.5
    NEWKEV 1Nuclei 3PoC 13
    fedora (45)
  • 14cisco—
    40 CVE1 critCVSS 7.0
    NEWPoC 38
    cisco ios xe (23) · ios xe (18) · ios (12)
  • 15jenkins—
    39 CVE2 critCVSS 5.8
    NEWNuclei 1
    jenkins (6) · script security (4) · jenkins script security plugin (4)
  • 16packagist—
    38 CVE4 critCVSS 6.6
    NEWNuclei 3PoC 23
    silverstripe/framework (8) · librenms/librenms (7) · dolibarr/dolibarr (5)
  • 17fedora project—
    35 CVE7 critCVSS 7.3
    NEWKEV 1Nuclei 2PoC 11
    fedora (35)
  • 18linux—
    34 CVE2 critCVSS 6.3
    NEWPoC 14
    linux kernel (34) · kernel (3)
  • 19ibm—
    31 CVECVSS 5.8
    NEW
    websphere application server (8) · websphere extreme scale (4) · security key lifecycle manager (3)
  • 20ао «ивк»—
    28 CVE1 critCVSS 7.1
    NEWPoC 9
    альт 8 сп (25) · альт 8 сп рабочая станция (3) · альт 8 сп сервер (3)
  • 21dell—
    22 CVE2 critCVSS 6.7
    NEWPoC 1
    bsafe micro-edition-suite (5) · rsa bsafe mes (5) · rsa via lifecycle and governance (4)
  • 22mozilla—
    22 CVE2 critCVSS 7.0
    NEWPoC 1
    firefox (20) · firefox esr (16) · thunderbird (8)
  • 23apache—
    20 CVE7 critCVSS 8.0
    NEWNuclei 4PoC 2
    jspwiki (5) · http server (4) · ofbiz (4)
  • 24netapp—
    20 CVE6 critCVSS 7.9
    NEWNuclei 1PoC 7
    steelstore cloud integrated storage (9) · solidfire (6) · hci management node (6)
  • 25oracle—
    19 CVE5 critCVSS 7.1
    NEWNuclei 3PoC 5
    enterprise manager ops center (8) · retail xstore point of service (7) · peoplesoft enterprise peopletools (5)
  • 26qualcomm—
    19 CVE6 critCVSS 8.5
    NEW
    sd 855 firmware (17) · sd 675 firmware (17) · sd 850 firmware (16)
  • 27qualcomm, inc.—
    19 CVE6 critCVSS 8.4
    NEW
    snapdragon auto, snapdragon compute, snapdragon consumer iot, snapdragon industrial iot, snapdragon mobile, snapdragon voice & music, snapdragon wearables (3) · snapdragon auto, snapdragon compute, snapdragon consumer iot, snapdragon industrial iot, snapdragon iot, snapdragon mobile, snapdragon voice & music, snapdragon wearables (3) · snapdragon auto, snapdragon compute, snapdragon connectivity, snapdragon consumer iot, snapdragon industrial iot, snapdragon mobile, snapdragon voice & music, snapdragon wearables (2)
  • 28schneider-electric—
    18 CVE3 critCVSS 7.7
    NEW
    meg6260-0410 firmware (6) · meg6260-0415 firmware (6) · meg6501-0001 firmware (6)
  • 29npm—
    17 CVE3 critCVSS 7.7
    NEWPoC 7
    total4 (3) · generator-jhipster (2) · seneca (1)
  • 30limesurvey—
    16 CVE1 critCVSS 6.0
    NEWNuclei 1PoC 2
    limesurvey (16)
  • 31f5—
    15 CVE3 critCVSS 7.0
    NEW
    big-ip access policy manager (10) · big-ip application security manager (10) · big-ip advanced firewall manager (9)
  • 32schneider electric se—
    13 CVE2 critCVSS 7.7
    NEW
    modicon m580 (4) · modicon m340 (3) · modicon quantum (2)
  • 33crates.io—
    12 CVE7 critCVSS 8.6
    NEWPoC 2
    blake2 (1) · cargo (1) · chttp (1)
  • 34apache software foundation—
    11 CVE5 critCVSS 8.1
    NEWNuclei 3PoC 2
    http server (4) · subversion (2) · drill (1)
  • 35prise—
    11 CVE2 critCVSS 7.2
    NEWPoC 2
    adas (11)
  • 36atlassian—
    10 CVE1 critCVSS 6.6
    NEWNuclei 5PoC 6
    jira server (7) · jira (7) · jira service desk server (1)
  • 37control-webpanel—
    10 CVECVSS 5.0
    NEWNuclei 1PoC 10
    webpanel (10)
  • 38librenms—
    10 CVE2 critCVSS 7.9
    NEWPoC 6
    librenms (10)
  • 39microfocus—
    10 CVECVSS 7.3
    NEWPoC 1
    service manager (9) · data protector (1) · service manager chat server (1)
  • 40ао "нппкт"—
    10 CVE1 critCVSS 7.3
    NEWKEV 1Nuclei 1PoC 1
    осон основа оnyx (10)
  • 41ао «нтц ит роса»—
    10 CVE4 critCVSS 6.8
    NEWNuclei 2PoC 3
    rosa virtualization 3.0 (7) · rosa virtualization (6) · роса хром (3)
  • 42nuget—
    9 CVECVSS 7.5
    NEWNuclei 1PoC 1
    microsoft.chakracore (5) · microsoft.aspnetcore.spaservices (1) · dotnetnuke.core (1)
  • 43pypi—
    9 CVE3 critCVSS 7.1
    NEWPoC 5
    lmdb (5) · opencv-python (3) · opencv-python-headless (3)
  • 44sap—
    9 CVECVSS 6.6
    NEW
    hana extended application services (2) · sap hana extended application services (2) · sap kernel (1)
  • 45sap se—
    9 CVECVSS 6.6
    NEW
    sap hana extended application services (2) · sap business one client (1) · sap gui for java (bc-fes-jav) (1)
  • 46schneider electric—
    9 CVECVSS 7.2
    NEW
    modicon quantum safety controller (4) · plc simulator (4) · modicon m340 controller (4)
  • 47advantech—
    8 CVE3 critCVSS 8.8
    NEWNuclei 1
    webaccess (5) · webaccess\/hmi designer (3) · webaccess/scada (1)
  • 48micro focus—
    8 CVECVSS 7.1
    NEW
    service manager (8)
  • 49silverstripe—
    8 CVE1 critCVSS 5.8
    NEWPoC 8
    silverstripe (8)
  • 50adobe—
    7 CVE4 critCVSS 8.9
    NEW
    cold fusion (3) · coldfusion (3) · flash player (3)

Top weaknesses

CWE classes by distinct CVE count.

1CWE-79226—
2CWE-787143—
3CWE-125139—
4CWE-35271—
5CWE-2062—
6CWE-8952—
7CWE-20042—
8CWE-2242—
9CWE-41641—
10CWE-47635—
11CWE-19030—
12CWE-90830—
13CWE-26923—
14CWE-52223—
15CWE-43422—
16CWE-12021—
17CWE-7820—
18CWE-86220—
19CWE-86319—
20CWE-30616—

Sectors

Solution categories ranked by distinct CVE count this period.

  • Mobile Apps312 CVE
    4 crit5 vendorsCVSS 6.9
    android (309) · chrome (1) · google chrome (1)
  • Operating Systems300 CVE
    166 crit143 KEV37 vendorsCVSS 8.0
    debian gnu/linux (107) · fedora (80) · debian linux (78)
  • Web & CMS Plugins258 CVE
    39 crit1 KEV147 vendorsCVSS 8.2
    wordpress (14) · http server (8) · silverstripe (8)
  • OSS Libraries247 CVE
    51 crit1 KEV71 vendorsCVSS 8.4
    ghostscript (6) · imagemagick (6) · openssl (6)
  • Enterprise Software194 CVE
    48 crit1 KEV58 vendorsCVSS 8.3
    librenms (10) · webpanel (10) · steelstore cloud integrated storage (9)
  • DevTools & CI105 CVE
    8 crit15 vendorsCVSS 7.2
    gitlab (49) · gitlabhook (1) · omnibus (1)
  • Networking Infrastructure88 CVE
    43 crit16 KEV32 vendorsCVSS 9.8
    cisco ios xe (23) · ios xe (18) · ios (12)
  • ICS / OT / IoT83 CVE
    62 crit1 KEV34 vendorsCVSS 9.1
    meg6260-0410 firmware (6) · meg6260-0415 firmware (6) · meg6501-0001 firmware (6)
  • Security Products62 CVE
    38 crit34 vendorsCVSS 7.8
    service manager (9) · archer (2) · rsa bsafe crypto-c (2)
  • Consumer Software59 CVE
    21 crit24 vendorsCVSS 8.5
    firefox (39) · firefox esr (31) · thunderbird (16)
  • Hardware Firmware59 CVE
    850 crit25 vendorsCVSS 9.9
    sd 675 firmware (17) · sd 855 firmware (17) · qcs605 firmware (16)
  • Databases30 CVE
    59 crit8 vendorsCVSS 7.2
    enterprise manager ops center (12) · retail xstore point of service (8) · communications operations monitor (5)
  • Cloud & SaaS29 CVE
    11 crit22 vendorsCVSS 8.3
    efront lms (2) · ibps online exam (2) · mautic (2)
  • Communications20 CVE
    7 crit1 KEV16 vendorsCVSS 8.6
    chat (2) · hhvm (2) · apng-drawable (1)
  • AI / ML3 CVE
    2 vendorsCVSS 6.6
    harbor (1) · open source computer vision library (opencv) (1) · runc (1)
  • Unclassified82 CVE
    19 crit55 vendorsCVSS 7.5
    adas (11) · трастмед:лекарственное обеспечение (4) · joyplus (3)
Weakness × Sector

Which weaknesses hit which solution categories in September 2019

Cells shaded by share of the sector's hottest weakness. Click a row to open the sector history.

79XSS787Out-of-bounds Write125Out-of-bounds Read352CSRF20Improper Input Validation89SQL Injection200Information Exposure22Path Traversal416Use After Free476NULL Pointer DereferenceOperating Systems191121224281552419Web & CMS Plugins10924842821611OSS Libraries4624144535999Enterprise Software416288113641DevTools & CI19322921Networking Infrastructure11531364315ICS / OT / IoT481412142Hardware Firmware782142144Consumer Software3175231341Security Products53411121