CVE Tools
Sign in
month report

May 2024

Data as of Jun 11, 2026, 06:05 UTCSnapshot v1 Sources CVEList V5+NVD+GHSA+CSAF+FSTEC BDU+CISA KEV+EPSS+Nuclei templates Methodology →

May 2024 closed with 5,418 published CVEs. 378 criticals, 14 added to CISA KEV (4 ransomware-linked). сообщество свободного программного обеспечения led volume, mostly via linux. Top weakness class — CWE-79 (669 CVE). 10 vendors cracked the top-100 for the first time.

Print view
Total CVEs
5,418
— MoM— YoY
Severity mix
378 / 1,867
critical / high
KEV added
14
4 ransomware-linked
Nuclei coverage
16.4%
889 CVEs with templates

Time to exploit

How fast the community ships detection after a CVE drops.

Days → Nuclei (median)
664.7
n=889
Within 7 days
0.0%
Within 30 days
0.0%
Days → KEV (median)
5
n=13
Detection gap

KEV pressure, no Nuclei coverage

May 2024 · vendors with active exploitation listed by CISA but no public detection template.

Weakness × Vendor

What's spreading where in May 2024

Cells shaded by share of vendor's hottest weakness. Click any cell to open the CWE history.

79XSS787Out-of-bounds Write89SQL Injection416Use After Free121CWE-121476NULL Pointer Dereference125Out-of-bounds Read78OS Command Injection401CWE-40122Path Traversalсообщество свободного программного обеспечения358214982105831266linux4713820945123ооо «ред софт»340475511934622ао «нппкт»12816348719432canonical ltd.2636911463ооо «русбитех-астра»2225137223302red hat inc.119351581152packagist731222dlink210811415615d-link corp.210811415615d-link1081135515debian8211246161

Most discussed CVEs — May 2024

No CVE mentions in the news this month yet.

First time in top-100

Vendors never in top-100 in the prior 24 periods.

Top vendors

Ranked by distinct CVE count this period.

  • 1сообщество свободного программного обеспечения—
    1,244 CVE34 critCVSS 6.2
    NEWKEV 1Nuclei 4PoC 23
    linux (1099) · debian gnu/linux (673) · bluez (7)
  • 2linux—
    1,074 CVE13 critCVSS 6.1
    NEWPoC 1
    linux kernel (1074) · linux (1072) · kernel (1)
  • 3ооо «ред софт»—
    743 CVE28 critCVSS 6.4
    NEWKEV 4Nuclei 2PoC 16
    ред ос (743)
  • 4ао "нппкт"—
    531 CVE18 critCVSS 6.3
    NEWKEV 4Nuclei 2PoC 14
    осон основа оnyx (531)
  • 5canonical—
    498 CVE3 critCVSS 6.0
    NEWNuclei 1PoC 4
    ubuntu (497) · snapd (1)
  • 6ооо «русбитех-астра»—
    467 CVE20 critCVSS 6.4
    NEWKEV 4Nuclei 2PoC 19
    astra linux special edition (453) · astra linux common edition (61) · astra linux special edition для «эльбрус» (26)
  • 7redhat—
    431 CVE9 critCVSS 6.2
    NEWNuclei 1PoC 6
    red hat enterprise linux (414) · red hat enterprise linux 8 (6) · red hat enterprise linux 9 (6)
  • 8packagist—
    323 CVE8 critCVSS 6.6
    NEWNuclei 2PoC 11
    silverstripe/framework (50) · typo3/cms-core (33) · moodle/moodle (14)
  • 9dlink—
    219 CVE6 critCVSS 8.2
    NEWNuclei 1PoC 10
    dap-2622 firmware (54) · dap-2622 (54) · dap-1325 (36)
  • 10d-link—
    209 CVE5 critCVSS 8.3
    NEWPoC 4
    dap-2622 (54) · dap-1325 (36) · dir-x3260 (23)
  • 11debian—
    189 CVE3 critCVSS 6.2
    NEWNuclei 1PoC 3
    debian linux (189)
  • 12ао «нтц ит роса»—
    144 CVE5 critCVSS 6.2
    NEWPoC 2
    rosa virtualization 3.0 (142) · роса кобальт (3) · rosa virtualization (2)
  • 13campcodes—
    136 CVE16 critCVSS 5.1
    NEWPoC 115
    complete web-based school management system (104) · legal case management system (15) · online laundry management system (9)
  • 14pdf-xchange—
    101 CVECVSS 7.0
    NEW
    pdf-xchange editor (101) · pdf-tools (99)
  • 15fedoraproject—
    86 CVE9 critCVSS 7.0
    NEWKEV 4PoC 16
    fedora (86)
  • 16microsoft—
    81 CVE1 critCVSS 7.3
    NEWKEV 3PoC 5
    windows server 2022 (server core installation) (45) · windows server 2022 (45) · windows server 2019 (44)
  • 17foxitsoftware—
    76 CVECVSS 6.5
    NEWPoC 1
    pdf editor (76) · pdf reader (76) · foxit reader (1)
  • 18unknown—
    75 CVE2 critCVSS 6.0
    NEWNuclei 74PoC 74
    business card (4) · newsletter popup (4) · hl twitter (3)
  • 19kofax—
    74 CVECVSS 7.0
    NEW
    power pdf (74)
  • 20tungstenautomation—
    74 CVECVSS 7.0
    NEW
    power pdf (74)
  • 21ао «ивк»—
    69 CVE1 critCVSS 6.7
    NEWNuclei 2PoC 1
    альт сп 10 (50) · альт 8 сп (31)
  • 22pypi—
    65 CVE6 critCVSS 6.6
    NEWNuclei 2PoC 8
    ryu (6) · ait-core (5) · scrapy (4)
  • 23fedora project—
    64 CVE1 critCVSS 6.3
    NEWPoC 6
    fedora (62) · 389 directory server (2)
  • 24sourcecodester—
    63 CVECVSS 6.0
    NEWPoC 62
    simple online bidding system (9) · event registration system (7) · best house rental management system (6)
  • 25google—
    57 CVE4 critCVSS 7.7
    NEWKEV 4PoC 11
    android (26) · chrome (25) · google chrome (25)
  • 26siemens—
    55 CVE6 critCVSS 7.3
    NEW
    simcenter femap (12) · simatic rtls locating manager (11) · ps\/iges parasolid translator (11)
  • 27ibm—
    53 CVE1 critCVSS 5.9
    NEWPoC 1
    cognos controller (10) · app connect enterprise (6) · security guardium (5)
  • 28intel—
    52 CVE1 critCVSS 6.6
    NEWNuclei 1
    power gadget (11) · ethernet adapter complete driver (9) · ethernet controller i225-it firmware (9)
  • 29foxit software inc.—
    51 CVECVSS 7.5
    NEW
    pdf reader (50) · pdf editor (48)
  • 30ооо «открытая мобильная платформа»—
    49 CVE2 critCVSS 7.9
    NEW
    ос аврора (49)
  • 31novell inc.—
    47 CVE2 critCVSS 6.6
    NEWNuclei 1PoC 4
    suse linux enterprise server for sap applications (41) · suse linux enterprise server (40) · suse linux enterprise desktop (38)
  • 32oretnom23—
    47 CVE2 critCVSS 6.0
    NEWPoC 43
    simple online bidding system (9) · event registration system (7) · human resource management system (6)
  • 33adobe—
    45 CVECVSS 7.3
    NEW
    acrobat reader (20) · acrobat (20) · acrobat dc (20)
  • 34go—
    45 CVE2 critCVSS 6.5
    NEWNuclei 1PoC 5
    github.com/stacklok/minder (4) · github.com/layer5io/meshery (2) · github.com/snapcore/snapd (2)
  • 35totolink—
    42 CVE10 critCVSS 7.9
    NEWNuclei 1PoC 18
    cp450 firmware (17) · cp450 (15) · x5000r firmware (8)
  • 36npm—
    40 CVE4 critCVSS 7.2
    NEWNuclei 4PoC 11
    nocodb (3) · directus (2) · libxmljs2 (2)
  • 37ashlar—
    38 CVECVSS 8.0
    NEW
    cobalt (32) · graphite (3) · argon (1)
  • 38ashlar-vellum—
    38 CVECVSS 8.0
    NEW
    cobalt (32) · graphite (3) · xenon (1)
  • 39netgear—
    38 CVE2 critCVSS 8.1
    NEW
    rax30 (16) · rax30 firmware (16) · prosafe network management system (nms300) (15)
  • 40tracker software products ltd.—
    37 CVECVSS 7.6
    NEW
    pdf-xchange editor (23) · pdf-xchange (14) · pdf-tools (10)
  • 41hdfgroup—
    34 CVE8 critCVSS 7.9
    NEW
    hdf5 (34)
  • 42the hdf group—
    33 CVE8 critCVSS 8.0
    NEW
    hdf5 (33)
  • 43apple—
    30 CVE1 critCVSS 5.9
    NEWPoC 2
    macos (24) · iphone os (15) · ipados (15)
  • 44maven—
    29 CVE5 critCVSS 7.0
    NEWNuclei 2PoC 1
    org.bouncycastle:bcprov-jdk18on (4) · org.bouncycastle:bcprov-jdk15to18 (4) · org.bouncycastle:bcprov-jdk14 (4)
  • 45hpe—
    28 CVE12 critCVSS 7.6
    NEWPoC 1
    aos-8 instant and aos-10 ap (18) · aruba mobility conductor (formerly mobility master); aruba mobility controllers; wlan gateways and sd-wan gateways managed by aruba central (10)
  • 46lg—
    27 CVE13 critCVSS 8.3
    NEWNuclei 1
    simple editor (25) · supersign media editor (2)
  • 47ruvar—
    26 CVE21 critCVSS 9.2
    NEWPoC 14
    ruvaroa (26)
  • 48arubanetworks—
    24 CVE8 critCVSS 7.2
    NEW
    arubaos (24)
  • 49hp—
    23 CVE8 critCVSS 7.5
    NEW
    instantos (18) · cz172a firmware (1) · cz173a firmware (1)
  • 50idccms—
    23 CVECVSS 6.7
    NEWPoC 11
    idccms (23)

Top weaknesses

CWE classes by distinct CVE count.

1CWE-79669—
2CWE-787368—
3CWE-89331—
4CWE-416285—
5CWE-121227—
6CWE-476226—
7CWE-125214—
8CWE-78132—
9CWE-401129—
10CWE-22128—
11CWE-352123—
12CWE-862110—
13CWE-2094—
14CWE-26984—
15CWE-12283—
16CWE-20080—
17CWE-43478—
18CWE-12064—
19CWE-9463—
20CWE-66762—

Sectors

Solution categories ranked by distinct CVE count this period.

  • Operating Systems1,516 CVE
    195 crit93 KEV38 vendorsCVSS 7.3
    linux (2171) · linux kernel (1074) · ред ос (743)
  • Web & CMS Plugins1,156 CVE
    120 crit4 KEV542 vendorsCVSS 6.9
    happy addons for elementor (18) · exclusive addons for elementor (13) · ht mega (11)
  • OSS Libraries719 CVE
    61 crit93 vendorsCVSS 7.5
    silverstripe/framework (50) · typo3/cms-core (33) · moodle/moodle (14)
  • Enterprise Software609 CVE
    90 crit1 KEV118 vendorsCVSS 7.7
    cacti (22) · instantos (18) · viewpower (18)
  • Networking Infrastructure511 CVE
    71 crit5 KEV61 vendorsCVSS 7.8
    dap-2622 (54) · dap-2622 firmware (54) · dap-1325 (36)
  • Consumer Software349 CVE
    23 crit39 vendorsCVSS 8.2
    pdf reader (126) · pdf editor (124) · pdf-xchange editor (124)
  • ICS / OT / IoT219 CVE
    127 crit63 vendorsCVSS 8.2
    ignition (36) · p3-550e (15) · p3-550e firmware (15)
  • Security Products176 CVE
    10 crit10 KEV61 vendorsCVSS 7.8
    endpoint manager (11) · epm (11) · ivanti endpoint manager (10)
  • Hardware Firmware174 CVE
    26 crit30 vendorsCVSS 7.5
    power gadget (11) · ethernet adapter complete driver (9) · ethernet controller i225-it firmware (9)
  • Mobile Apps151 CVE
    12 crit8 KEV13 vendorsCVSS 7.3
    android (39) · chrome (25) · google chrome (25)
  • Cloud & SaaS96 CVE
    23 crit58 vendorsCVSS 7.6
    simple inventory system (5) · nocodb (3) · emias os (2)
  • DevTools & CI73 CVE
    8 crit1 KEV30 vendorsCVSS 8.8
    teamcity (21) · flexlogger (1) · instrumentstudio (1)
  • Databases65 CVE
    9 crit18 vendorsCVSS 7.8
    hdf5 (34) · pgadmin 4 (4) · vitess (1)
  • AI / ML51 CVE
    19 crit28 vendorsCVSS 8.2
    lollms web ui (9) · mintplex-labs/anything-llm (4) · anythingllm (3)
  • Communications51 CVE
    32 crit27 vendorsCVSS 7.8
    mattermost (9) · mattermost server (9) · libpag (2)
  • Unclassified430 CVE
    28 crit1 KEV121 vendorsCVSS 7.5
    dap-2622 (54) · dap-1325 (36) · dir-x3260 (23)
Weakness × Sector

Which weaknesses hit which solution categories in May 2024

Cells shaded by share of the sector's hottest weakness. Click a row to open the sector history.

79XSS787Out-of-bounds Write89SQL Injection416Use After Free121CWE-121476NULL Pointer Dereference125Out-of-bounds Read78OS Command Injection401CWE-40122Path TraversalOperating Systems97261681321565131267Web & CMS Plugins406171243OSS Libraries10229379153274114Networking Infrastructure19133941732410328Consumer Software8961106141105321Enterprise Software9113103115256ICS / OT / IoT5371878416712Hardware Firmware4114525261512Security Products102171215211Cloud & SaaS1158311413