CVE Tools
Sign in
month report

May 2022

Data as of Jun 11, 2026, 06:05 UTCSnapshot v1 Sources CVEList V5+NVD+GHSA+CSAF+FSTEC BDU+CISA KEV+EPSS+Nuclei templates Methodology →

May 2022 closed with 2,205 published CVEs. 405 criticals, 83 added to CISA KEV (18 ransomware-linked). сообщество свободного программного обеспечения led volume, mostly via debian gnu/linux. Top weakness class — CWE-79 (298 CVE). 10 vendors cracked the top-100 for the first time.

Print view
Total CVEs
2,205
— MoM— YoY
Severity mix
405 / 864
critical / high
KEV added
83
18 ransomware-linked
Nuclei coverage
11.1%
244 CVEs with templates

Time to exploit

How fast the community ships detection after a CVE drops.

Days → Nuclei (median)
1390.3
n=244
Within 7 days
0.0%
Within 30 days
0.0%
Days → KEV (median)
72
n=6
Detection gap

KEV pressure, no Nuclei coverage

May 2022 · vendors with active exploitation listed by CISA but no public detection template.

Weakness × Vendor

What's spreading where in May 2022

Cells shaded by share of vendor's hottest weakness. Click any cell to open the CWE history.

79XSS89SQL Injection787Out-of-bounds Write78OS Command Injection20Improper Input Validation125Out-of-bounds Read416Use After Free434Unrestricted File Upload22Path Traversal190Integer Overflowсообщество свободного программного обеспечения119141512134adobe13012832apple281242google10206324maven152151microsoftmicrosoft corpdebian2114148732ооо «русбитех-астра»11514131032fedoraproject211315941ооо «ред софт»1214147521ао «нппкт»1111144731

Most discussed CVEs — May 2022

No CVE mentions in the news this month yet.

First time in top-100

Vendors never in top-100 in the prior 24 periods.

Top vendors

Ranked by distinct CVE count this period.

  • 1сообщество свободного программного обеспечения—
    115 CVE10 critCVSS 7.2
    NEWKEV 1Nuclei 3PoC 33
    debian gnu/linux (94) · vim (20) · linux (16)
  • 2unknown—
    105 CVE16 critCVSS 6.3
    NEWNuclei 105PoC 52
    vikbooking hotel booking engine & pms (4) · wpqa builder plugin (3) · adrotate – ad manager & adsense ads (2)
  • 3adobe—
    97 CVECVSS 6.9
    NEW
    acrobat reader dc (64) · acrobat (64) · acrobat dc (64)
  • 4apple—
    92 CVE7 critCVSS 7.1
    NEWKEV 2PoC 12
    macos (83) · mac os x (30) · iphone os (26)
  • 5google—
    88 CVE2 critCVSS 6.2
    NEWPoC 9
    android (58) · tensorflow (24) · fuchsia (2)
  • 6maven—
    77 CVE8 critCVSS 6.9
    NEWNuclei 8PoC 10
    org.jenkins-ci.plugins:autocomplete-parameter (3) · org.jenkins-ci.plugins:ssh (3) · org.jenkins-ci.plugins:mercurial (3)
  • 7microsoft—
    76 CVE3 critCVSS 7.4
    NEWKEV 2PoC 1
    windows server version 20h2 (59) · windows server 20h2 (server core installation) (59) · windows server 2019 (57)
  • 8debian—
    73 CVE8 critCVSS 7.6
    NEWKEV 1Nuclei 1PoC 29
    debian linux (73) · dpkg (1)
  • 9ооо «русбитех-астра»—
    73 CVE5 critCVSS 7.2
    NEWKEV 1PoC 24
    astra linux special edition (72) · astra linux special edition для «эльбрус» (37) · astra linux common edition (1)
  • 10fedoraproject—
    71 CVE11 critCVSS 7.5
    NEWNuclei 2PoC 22
    fedora (71)
  • 11ооо «ред софт»—
    68 CVE9 critCVSS 7.4
    NEWKEV 1Nuclei 2PoC 19
    ред ос (64) · ред база данных (4)
  • 12ао "нппкт"—
    54 CVE6 critCVSS 7.4
    NEWKEV 1Nuclei 1PoC 17
    осон основа оnyx (54)
  • 13ао «ивк»—
    50 CVE5 critCVSS 7.3
    NEWNuclei 2PoC 17
    альт 8 сп (43) · альт сп 10 (12)
  • 14redhat—
    49 CVE7 critCVSS 7.0
    NEWNuclei 3PoC 12
    red hat enterprise linux (29) · enterprise linux (13) · jboss enterprise application platform (5)
  • 15cisco—
    48 CVE3 critCVSS 6.5
    NEWKEV 1PoC 48
    firepower threat defense (12) · cisco common services platform collector (9) · common services platform collector (9)
  • 16f5—
    45 CVE2 critCVSS 6.3
    NEWKEV 1Nuclei 1PoC 1
    big-ip access policy manager (36) · big-ip application security manager (30) · big-ip advanced firewall manager (28)
  • 17pypi—
    45 CVE6 critCVSS 6.1
    NEWPoC 9
    tensorflow-gpu (25) · tensorflow (25) · tensorflow-cpu (25)
  • 18go—
    44 CVE6 critCVSS 7.7
    NEWNuclei 1PoC 2
    github.com/hashicorp/go-getter/gcs/v2 (4) · github.com/hashicorp/go-getter (4) · github.com/rancher/rancher (4)
  • 19npm—
    44 CVE5 critCVSS 7.3
    NEWNuclei 1PoC 10
    strapi (3) · @strapi/strapi (3) · convict (2)
  • 20totolink—
    40 CVE31 critCVSS 9.1
    NEWNuclei 1PoC 22
    n600r firmware (19) · a3100r firmware (9) · a7100ru firmware (9)
  • 21intel—
    38 CVECVSS 6.4
    NEW
    optane memory h20 with solid state storage (8) · optane memory h20 with solid state storage firmware (8) · optane ssd 900p firmware (8)
  • 22ibm—
    37 CVE3 critCVSS 6.6
    NEW
    robotic process automation (5) · guardium data encryption (4) · robotic process automation as a service (3)
  • 23netapp—
    37 CVE5 critCVSS 7.1
    NEWPoC 10
    h700s firmware (20) · h300s firmware (20) · h410s firmware (20)
  • 24packagist—
    34 CVE5 critCVSS 7.3
    NEWNuclei 8PoC 13
    moodle/moodle (5) · facturascripts/facturascripts (3) · microweber/microweber (3)
  • 25siemens—
    33 CVE3 critCVSS 7.0
    NEW
    7kg8500-0aa10-2aa0 firmware (11) · 7kg8500-0aa30-0aa0 firmware (11) · 7kg8500-0aa10-0aa0 firmware (11)
  • 26amd—
    32 CVECVSS 6.0
    NEW
    epyc 7713 firmware (19) · epyc 7713p firmware (19) · epyc 7763 firmware (19)
  • 27fedora project—
    31 CVE4 critCVSS 7.5
    NEWNuclei 1PoC 12
    fedora (31)
  • 28фссп россии—
    30 CVE3 critCVSS 7.4
    NEWNuclei 1PoC 10
    ос тд аис фссп россии (30)
  • 29jenkins—
    28 CVECVSS 6.5
    NEW
    autocomplete parameter (3) · ssh (3) · blue ocean (3)
  • 30mediatek, inc.—
    28 CVECVSS 6.3
    NEW
    mt6580, mt6739, mt6761, mt6762, mt6765, mt6768, mt6769, mt6771, mt6779, mt6781, mt6785, mt6789, mt6833, mt6853, mt6853t, mt6873, mt6875, mt6877, mt6879, mt6883, mt6885, mt6889, mt6891, mt6893, mt6895, mt6983, mt8163, mt8167, mt8168, mt8173, mt8185, mt8321, mt8362a, mt8365, mt8735, mt8735b, mt8765, mt8766, mt8768, mt8786, mt8788, mt8789, mt8791, mt8797 (8) · mt6580, mt6735, mt6737, mt6739, mt6750, mt6750s, mt6753, mt6757, mt6757c, mt6757cd, mt6757ch, mt6761, mt6762, mt6763, mt6765, mt6768, mt6769, mt6771, mt6779, mt6781, mt6785, mt6797, mt6833, mt6853, mt6853t, mt6873, mt6875, mt6877, mt6883, mt6885, mt6889, mt6893, mt8167, mt8168, mt8173, mt8185, mt8321, mt8362a, mt8365, mt8385, mt8666, mt8675, mt8695, mt8696, mt8765, mt8766, mt8768, mt8786, mt8788, mt8789, mt8791, mt8797 (4) · mt9011, mt9215, mt9216, mt9220, mt9221, mt9255, mt9256, mt9266, mt9269, mt9285, mt9286, mt9288, mt9600, mt9602, mt9610, mt9611, mt9612, mt9613, mt9615, mt9617, mt9629, mt9630, mt9631, mt9632, mt9636, mt9638, mt9639, mt9650, mt9652, mt9666, mt9669, mt9670, mt9675, mt9685, mt9686, mt9688 (4)
  • 31ао «нтц ит роса»—
    27 CVE3 critCVSS 7.5
    NEWNuclei 2PoC 8
    rosa virtualization (14) · роса хром (13) · rosa virtualization 3.0 (7)
  • 32novell inc.—
    25 CVE2 critCVSS 7.2
    NEWNuclei 1PoC 11
    suse linux enterprise server (20) · suse linux enterprise desktop (18) · suse linux enterprise server for sap applications (18)
  • 33tenda—
    24 CVE10 critCVSS 8.5
    NEWPoC 12
    ax1806 firmware (6) · ac18 firmware (6) · tx9 pro firmware (3)
  • 34tensorflow—
    24 CVECVSS 5.7
    NEWPoC 8
    tensorflow (24)
  • 35hcl software—
    23 CVE1 critCVSS 6.1
    NEWPoC 3
    bigfix platform (5) · sametime (5) · hcl bigfix mobile / modern client management (3)
  • 36chshcms—
    22 CVE1 critCVSS 7.7
    NEWPoC 10
    cscms music portal system (21) · cscms (1)
  • 37hcltech—
    22 CVE1 critCVSS 6.2
    NEWPoC 3
    sametime (5) · bigfix platform (5) · bigfix mobile (3)
  • 38arubanetworks—
    21 CVE10 critCVSS 8.5
    NEW
    clearpass policy manager (19) · 2540 firmware (2) · 2615 firmware (2)
  • 39dlink—
    21 CVE18 critCVSS 9.4
    NEWNuclei 2PoC 8
    dir-816 firmware (8) · dir-882 firmware (4) · dir-816l (3)
  • 40vim—
    20 CVECVSS 7.4
    NEWPoC 9
    vim (20) · vim/vim (20)
  • 41wedding management system project—
    20 CVE1 critCVSS 7.7
    NEWPoC 10
    wedding management system (20)
  • 42inhand networks—
    19 CVECVSS 8.0
    NEWPoC 8
    inrouter302 (19)
  • 43inhandnetworks—
    19 CVECVSS 8.0
    NEWPoC 8
    ir302 firmware (16) · inrouter302 firmware (3)
  • 44ао «концерн вниинс»—
    19 CVE2 critCVSS 7.7
    NEWPoC 5
    ос он «стрелец» (19)
  • 45linux—
    18 CVECVSS 7.1
    NEWPoC 5
    linux kernel (18) · kernel (2)
  • 46canonical—
    17 CVE1 critCVSS 7.5
    NEWPoC 7
    ubuntu (16) · ubuntu linux (1)
  • 47merchandise online store project—
    17 CVE9 critCVSS 8.5
    NEWPoC 7
    merchandise online store (17)
  • 48huawei—
    16 CVE3 critCVSS 7.8
    NEW
    emui (16) · harmonyos (14) · magic ui (6)
  • 49online sports complex booking system project—
    15 CVE13 critCVSS 9.5
    NEWPoC 10
    online sports complex booking system (15)
  • 50rubygems—
    15 CVE3 critCVSS 7.2
    NEWPoC 12
    publify_core (5) · rubygems.org (2) · nokogiri (2)

Top weaknesses

CWE classes by distinct CVE count.

1CWE-79298—
2CWE-89256—
3CWE-787161—
4CWE-7881—
5CWE-2077—
6CWE-12568—
7CWE-41665—
8CWE-43449—
9CWE-2245—
10CWE-19039—
11CWE-12036—
12CWE-35236—
13CWE-28733—
14CWE-47632—
15CWE-86230—
16CWE-91828—
17CWE-86326—
18CWE-40025—
19CWE-7725—
20CWE-20023—

Sectors

Solution categories ranked by distinct CVE count this period.

  • OSS Libraries412 CVE
    74 crit122 vendorsCVSS 7.7
    swftools (10) · openssl (8) · gpac (4)
  • Enterprise Software351 CVE
    162 crit85 vendorsCVSS 9.0
    h300s firmware (20) · h410s firmware (20) · h500s firmware (20)
  • Web & CMS Plugins342 CVE
    81 crit194 vendorsCVSS 7.7
    cscms music portal system (21) · moodle (10) · elite cms (8)
  • Operating Systems293 CVE
    233 crit114 KEV37 vendorsCVSS 7.5
    fedora (102) · debian gnu/linux (94) · debian linux (73)
  • Networking Infrastructure249 CVE
    198 crit43 KEV48 vendorsCVSS 8.5
    firepower threat defense (24) · inrouter302 (19) · n600r firmware (19)
  • Mobile Apps202 CVE
    24 crit14 KEV7 vendorsCVSS 7.1
    android (60) · tensorflow (24) · emui (16)
  • Hardware Firmware176 CVE
    69 crit35 vendorsCVSS 9.3
    epyc 7313p firmware (19) · epyc 7343 firmware (19) · epyc 7413 firmware (19)
  • Consumer Software161 CVE
    4 crit1 KEV25 vendorsCVSS 9.8
    acrobat (64) · acrobat dc (64) · acrobat reader (64)
  • Security Products145 CVE
    16 crit12 KEV47 vendorsCVSS 8.2
    big-ip access policy manager (36) · big-ip application security manager (30) · big-ip advanced firewall manager (28)
  • DevTools & CI102 CVE
    12 crit36 vendorsCVSS 8.1
    gocd (6) · autocomplete parameter (3) · blue ocean (3)
  • ICS / OT / IoT96 CVE
    138 crit2 KEV66 vendorsCVSS 8.3
    oas platform (16) · melsec iq-fx5u-32mr\/ds firmware (4) · melsec iq-fx5u-32mr\/dss firmware (4)
  • Cloud & SaaS73 CVE
    31 crit35 vendorsCVSS 8.3
    covid 19 travel pass management system (9) · security-advisories (6) · chatbot app with suggestion (2)
  • Communications33 CVE
    18 crit28 vendorsCVSS 7.9
    sofia-sip (9) · ers3500 (3) · ers3600 (3)
  • Databases32 CVE
    3 crit11 vendorsCVSS 7.8
    mariadb (8) · financial services crime and compliance management studio (6) · ibm robotic process automation (3)
  • AI / ML26 CVE
    2 crit4 vendorsCVSS 5.9
    tensorflow (24) · flyte console (1) · flyteconsole (1)
  • Unclassified209 CVE
    72 crit117 vendorsCVSS 7.6
    ос тд аис фссп россии (30) · online sports complex booking system (15) · diaenergie (11)
Weakness × Sector

Which weaknesses hit which solution categories in May 2022

Cells shaded by share of the sector's hottest weakness. Click a row to open the sector history.

79XSS89SQL Injection787Out-of-bounds Write78OS Command Injection20Improper Input Validation125Out-of-bounds Read416Use After Free434Unrestricted File Upload22Path Traversal190Integer OverflowOperating Systems5356182923512OSS Libraries52822441615111416Web & CMS Plugins1191121224151Networking Infrastructure3345458141241Enterprise Software5010311611476Hardware Firmware41176167856Consumer Software13341123637321ICS / OT / IoT121775511124DevTools & CI233323Security Products12317212