CVE Tools
Sign in
month report

May 2021

Data as of Jun 11, 2026, 06:05 UTCSnapshot v1 Sources CVEList V5+NVD+GHSA+CSAF+FSTEC BDU+CISA KEV+EPSS+Nuclei templates Methodology →

May 2021 closed with 1,580 published CVEs. 196 criticals, сообщество свободного программного обеспечения led volume, mostly via debian gnu/linux. Top weakness class — CWE-79 (203 CVE). 10 vendors cracked the top-100 for the first time.

Print view
Total CVEs
1,580
— MoM— YoY
Severity mix
196 / 563
critical / high
KEV added
0
0 ransomware-linked
Nuclei coverage
10.5%
166 CVEs with templates

Time to exploit

How fast the community ships detection after a CVE drops.

Days → Nuclei (median)
1760.0
n=166
Within 7 days
0.0%
Within 30 days
0.0%
Days → KEV (median)
180
n=19
Detection gap

KEV pressure, no Nuclei coverage

May 2021 · vendors with active exploitation listed by CISA but no public detection template.

Weakness × Vendor

What's spreading where in May 2021

Cells shaded by share of vendor's hottest weakness. Click any cell to open the CWE history.

79XSS787Out-of-bounds Write125Out-of-bounds Read20Improper Input Validation416Use After Free369CWE-369476NULL Pointer Dereference89SQL Injection352CSRF119Memory Buffer Boundsсообщество свободного программного обеспечения83413171869110pypi92214132155ао «нппкт»12713812354ооо «русбитех-астра»12814910576google2213132155tensorflow2213132155debian2210711466fedoraproject19891346redhat481184313ао «концерн вниинс»151452411ibm13311cisco systems inc.31124

Most discussed CVEs — May 2021

No CVE mentions in the news this month yet.

First time in top-100

Vendors never in top-100 in the prior 24 periods.

Top vendors

Ranked by distinct CVE count this period.

  • 1сообщество свободного программного обеспечения—
    239 CVE26 critCVSS 7.0
    NEWNuclei 21PoC 46
    debian gnu/linux (205) · linux (36) · drupal (4)
  • 2pypi—
    138 CVE4 critCVSS 3.2
    NEWNuclei 2PoC 40
    tensorflow-gpu (108) · tensorflow (108) · tensorflow-cpu (108)
  • 3ао "нппкт"—
    127 CVE19 critCVSS 7.3
    NEWNuclei 9PoC 26
    осон основа оnyx (127)
  • 4ооо «русбитех-астра»—
    126 CVE21 critCVSS 7.5
    NEWNuclei 9PoC 25
    astra linux special edition (121) · astra linux special edition для «эльбрус» (71) · astra linux common edition (26)
  • 5google—
    120 CVE10 critCVSS 3.5
    NEWPoC 36
    tensorflow (108) · libwebp (11) · cloud iot device sdk for embedded c (1)
  • 6tensorflow—
    108 CVECVSS 2.9
    NEWPoC 36
    tensorflow (108)
  • 7redhat—
    105 CVE16 critCVSS 6.4
    NEWNuclei 1PoC 10
    enterprise linux (38) · red hat enterprise linux (30) · ansible tower (8)
  • 8debian—
    100 CVE7 critCVSS 7.2
    NEWNuclei 2PoC 24
    debian linux (100)
  • 9fedoraproject—
    92 CVE7 critCVSS 6.7
    NEWNuclei 2PoC 14
    fedora (92)
  • 10ао «концерн вниинс»—
    76 CVE17 critCVSS 7.7
    NEWNuclei 9PoC 11
    ос он «стрелец» (76)
  • 11ibm—
    71 CVE7 critCVSS 6.6
    NEWPoC 1
    qradar siem (12) · cognos analytics (10) · qradar security information and event manager (8)
  • 12cisco—
    70 CVE7 critCVSS 5.2
    NEWKEV 2Nuclei 3PoC 61
    cisco sd-wan (13) · sd-wan vmanage (12) · small business wap351 (11)
  • 13maven—
    65 CVE8 critCVSS 6.5
    NEWNuclei 1PoC 12
    com.liferay.portal:release.dxp.bom (11) · com.liferay.portal:release.portal.bom (11) · org.opennms:opennms (5)
  • 14microsoft—
    56 CVE2 critCVSS 7.2
    NEWKEV 2Nuclei 1PoC 10
    windows 10 (25) · windows 10 2004 (24) · windows 10 20h2 (23)
  • 15ооо «ред софт»—
    55 CVE18 critCVSS 7.8
    NEWNuclei 8PoC 5
    ред ос (55)
  • 16netapp—
    49 CVE6 critCVSS 7.6
    NEWNuclei 1PoC 8
    cloud backup (18) · h300s firmware (16) · h410s firmware (16)
  • 17canonical—
    44 CVE7 critCVSS 7.5
    NEWNuclei 8PoC 3
    ubuntu (44)
  • 18ао «ивк»—
    41 CVE2 critCVSS 6.5
    NEWPoC 11
    альт 8 сп (39) · альт сп 10 (5) · альт 8 сп рабочая станция (1)
  • 19npm—
    39 CVE8 critCVSS 7.5
    NEWNuclei 2PoC 7
    mixme (2) · tinymce (2) · matrix-react-sdk (2)
  • 20foxitsoftware—
    34 CVECVSS 6.3
    NEWPoC 1
    reader (33) · phantompdf (22) · foxit reader (16)
  • 21linux—
    34 CVECVSS 6.2
    NEWPoC 6
    linux kernel (34) · mac80211 (3) · kernel (1)
  • 22siemens—
    29 CVE2 critCVSS 7.5
    NEWPoC 2
    simatic hmi comfort outdoor panels 15\" firmware (7) · simatic wincc runtime advanced v15 (7) · simatic wincc runtime advanced (7)
  • 23jetbrains—
    28 CVE4 critCVSS 7.1
    NEWNuclei 10
    teamcity (14) · youtrack (4) · intellij idea (3)
  • 24unknown—
    28 CVE1 critCVSS 5.8
    NEWNuclei 28PoC 12
    404 seo redirection (2) · sina extension for elementor (1) · the plus addons for elementor page builder lite (1)
  • 25ао «нтц ит роса»—
    28 CVE12 critCVSS 8.5
    NEWPoC 6
    rosa virtualization (18) · rosa virtualization 3.0 (13) · роса кобальт (6)
  • 26ffmpeg—
    27 CVECVSS 7.7
    NEWPoC 10
    ffmpeg (27)
  • 27gnu—
    27 CVE1 critCVSS 8.0
    NEWPoC 10
    libredwg (23) · binutils (1) · cflow (1)
  • 28ffmpeg team—
    26 CVECVSS 7.7
    NEWPoC 10
    ffmpeg (26)
  • 29go—
    25 CVE3 critCVSS 7.5
    NEWPoC 3
    github.com/nats-io/nats-server/v2 (4) · github.com/dutchcoders/transfer.sh (2) · golang.org/x/net (2)
  • 30gnu general public license—
    22 CVE6 critCVSS 8.2
    NEWNuclei 8
    exim (21) · gnu binutils (1)
  • 31exim—
    21 CVE6 critCVSS 8.2
    NEWNuclei 8
    exim (21)
  • 32packagist—
    21 CVE2 critCVSS 6.5
    NEWNuclei 2PoC 7
    drupal/core (5) · drupal/drupal (5) · shopware/shopware (2)
  • 33qualcomm—
    20 CVECVSS 7.4
    NEWKEV 2
    qbt2000 firmware (18) · pm6150l firmware (18) · qtm525 firmware (18)
  • 34qualcomm, inc.—
    20 CVECVSS 7.3
    NEWKEV 2
    snapdragon auto, snapdragon compute, snapdragon connectivity, snapdragon consumer iot, snapdragon industrial iot, snapdragon mobile, snapdragon voice & music, snapdragon wearables (3) · snapdragon auto, snapdragon compute, snapdragon connectivity, snapdragon mobile (2) · snapdragon auto, snapdragon compute, snapdragon connectivity, snapdragon consumer iot, snapdragon industrial iot, snapdragon iot, snapdragon mobile, snapdragon voice & music, snapdragon wearables (2)
  • 35ibm corp.—
    19 CVE2 critCVSS 7.0
    NEW
    cognos analytics (10) · security guardium (6) · ibm security verify access docker (3)
  • 36schneider-electric—
    19 CVE3 critCVSS 7.4
    NEW
    spacelynk firmware (9) · homelynk firmware (9) · tcm 4351b firmware (6)
  • 37fedora project—
    18 CVECVSS 6.7
    NEWPoC 1
    fedora (17) · 389 directory server (1)
  • 38wago—
    18 CVE8 critCVSS 8.1
    NEW
    750-829 firmware (12) · 750-831 firmware (12) · 750-832 firmware (12)
  • 39mikrotik—
    16 CVECVSS 6.5
    NEWPoC 13
    routeros (16)
  • 40codesys—
    15 CVE6 critCVSS 7.7
    NEWPoC 1
    v2 web server (6) · development system (3) · runtime toolkit (3)
  • 41moxa inc.—
    14 CVE8 critCVSS 7.7
    NEW
    nport iaw5250a-6i/o (10) · nport ia5450a (4) · nport ia5250a (4)
  • 42hp—
    13 CVE2 critCVSS 7.1
    NEWNuclei 1
    integrated lights-out 5 (10) · integrated lights-out 4 (10) · laserjet mfp m436 w7u01a (1)
  • 43jenkins—
    13 CVE1 critCVSS 6.3
    NEWPoC 4
    xray - test management for jira (2) · jenkins p4 plugin (2) · jenkins s3 publisher plugin (2)
  • 44liferay—
    12 CVECVSS 6.2
    NEW
    liferay portal (11) · dxp (10) · digital experience platform (5)
  • 45nagios—
    12 CVE7 critCVSS 9.0
    NEWNuclei 1PoC 12
    fusion (11) · nagios xi (3)
  • 46novell inc.—
    12 CVECVSS 7.5
    NEW
    opensuse leap (11) · suse linux enterprise server (2) · suse linux enterprise server for sap applications (1)
  • 47oracle—
    12 CVE2 critCVSS 7.7
    NEWNuclei 1PoC 4
    zfs storage appliance kit (3) · communications cloud native core policy (3) · enterprise manager base platform (3)
  • 48schneider electric—
    12 CVE1 critCVSS 5.1
    NEW
    unified communication module 4610x (6) · tricon communication module 4351b (6) · tricon communication module 4352b (6)
  • 49zephyrproject—
    12 CVE1 critCVSS 5.6
    NEW
    zephyr (12)
  • 50zephyrproject-rtos—
    12 CVE1 critCVSS 5.6
    NEW
    zephyr (12)

Top weaknesses

CWE classes by distinct CVE count.

1CWE-79203—
2CWE-787134—
3CWE-12565—
4CWE-2049—
5CWE-41644—
6CWE-36941—
7CWE-47641—
8CWE-8937—
9CWE-35235—
10CWE-11933—
11CWE-7832—
12CWE-2231—
13CWE-20028—
14CWE-40027—
15CWE-12025—
16CWE-28725—
17CWE-43425—
18CWE-7725—
19CWE-86325—
20CWE-19024—

Sectors

Solution categories ranked by distinct CVE count this period.

  • OSS Libraries498 CVE
    61 crit9 KEV92 vendorsCVSS 8.3
    ffmpeg (53) · libredwg (23) · exim (21)
  • Operating Systems425 CVE
    262 crit21 KEV49 vendorsCVSS 7.5
    debian gnu/linux (205) · осон основа оnyx (127) · astra linux special edition (121)
  • Enterprise Software252 CVE
    132 crit1 KEV42 vendorsCVSS 8.2
    cloud backup (18) · h300e firmware (16) · h300s firmware (16)
  • Web & CMS Plugins209 CVE
    50 crit2 KEV125 vendorsCVSS 9.8
    liferay portal (11) · dxp (10) · plone (9)
  • Mobile Apps143 CVE
    18 crit7 vendorsCVSS 8.9
    tensorflow (108) · libwebp (11) · paxstore (5)
  • Networking Infrastructure141 CVE
    39 crit12 KEV37 vendorsCVSS 8.0
    routeros (16) · anyconnect secure mobility client (14) · cisco sd-wan (13)
  • AI / ML110 CVE
    1 crit2 vendorsCVSS 3.0
    tensorflow (108) · dex (1) · runc (1)
  • ICS / OT / IoT98 CVE
    316 crit29 vendorsCVSS 7.7
    750-8202 firmware (12) · 750-8203 firmware (12) · 750-8204 firmware (12)
  • Consumer Software74 CVE
    2 crit29 vendorsCVSS 8.3
    reader (40) · phantompdf (22) · foxit reader (16)
  • Cloud & SaaS72 CVE
    14 crit4 KEV36 vendorsCVSS 7.5
    qemu (9) · horizon client (3) · omnissa horizon client (3)
  • Hardware Firmware66 CVE
    27 crit812 KEV22 vendorsCVSS 9.8
    pm3003a firmware (18) · pm6150a firmware (18) · pm6150l firmware (18)
  • DevTools & CI64 CVE
    11 crit22 vendorsCVSS 9.8
    teamcity (14) · youtrack (4) · intellij idea (3)
  • Security Products64 CVE
    6 crit5 KEV35 vendorsCVSS 7.8
    home network security (5) · trend micro home network security (5) · true image 2020 (3)
  • Communications54 CVE
    15 crit28 vendorsCVSS 7.8
    exim (21) · hyperkitty (2) · mutt (2)
  • Databases50 CVE
    13 crit17 vendorsCVSS 7.6
    cognos analytics (10) · security guardium (6) · communications cloud native core binding support function (3)
  • Unclassified74 CVE
    12 crit55 vendorsCVSS 7.2
    оик диспетчер нт (6) · mesh profile (4) · bluetooth core specification (3)
Weakness × Sector

Which weaknesses hit which solution categories in May 2021

Cells shaded by share of the sector's hottest weakness. Click a row to open the sector history.

79XSS787Out-of-bounds Write125Out-of-bounds Read20Improper Input Validation416Use After Free369CWE-369476NULL Pointer Dereference89SQL Injection352CSRF119Memory Buffer BoundsOSS Libraries445522814714267Operating Systems9432425266121111Web & CMS Plugins951519Enterprise Software3133341184Networking Infrastructure9181522327Hardware Firmware1411641236ICS / OT / IoT29611238AI / ML2213132155Consumer Software89192152Security Products761211