month report
January 2009
Data as of Jun 11, 2026, 06:04 UTCSnapshot v1 Sources CVEList V5+NVD+GHSA+CSAF+FSTEC BDU+CISA KEV+EPSS+Nuclei templates Methodology →
January 2009 closed with 469 published CVEs. 72 criticals, oracle led volume, mostly via secure backup. Top weakness class — CWE-89 (87 CVE). 10 vendors cracked the top-100 for the first time.
Total CVEs
469
— MoM— YoY
Severity mix
72 / 151
critical / high
KEV added
0
0 ransomware-linked
Nuclei coverage
0.2%
1 CVEs with templates
Time to exploit
How fast the community ships detection after a CVE drops.
Days → Nuclei (median)
6245.1
n=1
Within 7 days
0.0%
Within 30 days
0.0%
Days → KEV (median)
—
n=0
Weakness × Vendor
What's spreading where in January 2009
Cells shaded by share of vendor's hottest weakness. Click any cell to open the CWE history.
89SQL Injection264CWE-26479XSS119Memory Buffer Bounds22Path Traversal20Improper Input Validation287Improper Authentication94Code Injection200Information Exposure399CWE-399oracle32sun51121microsoft4113сообщество свободного программного обеспечения14422apple5112cisco13gentoo foundation inc.212linux1112codeavalanche6katywhitton222activewebsoftwares5debian11
Most discussed CVEs — January 2009
No CVE mentions in the news this month yet.
First time in top-100
Vendors never in top-100 in the prior 24 periods.
- #8codeavalanche6 CVE
- #10katywhitton6 CVE
- #11activewebsoftwares5 CVE
- #15modxcms5 CVE
- #16typo35 CVE
- #17asp-dev4 CVE
- #18icash4 CVE
- #20joomlahbs4 CVE
- #23tigris4 CVE
- #25constructr3 CVE
Top vendors
Ranked by distinct CVE count this period.
- 41 CVE5 critCVSS 5.2PoC 1secure backup (9) · database 10g (9) · peoplesoft enterprise (6)
- 22 CVE4 critCVSS 6.4PoC 1opensolaris (14) · solaris (9) · java system access manager (3)
- 16 CVE5 critCVSS 7.4PoC 7windows xp (5) · windows server 2003 (4) · windows 2000 (4)
- 16 CVE4 critCVSS 7.0PoC 1debian gnu/linux (15) · libaudiofile (1)
- 14 CVE8 critCVSS 7.8PoC 3quicktime (7) · safari (5) · cups (1)
- 10 CVECVSS 5.7PoC 1ironport postx (4) · ironport encryption appliance (4) · ons 15600 (1)
- 7 CVE1 critCVSS 6.2linux kernel (7)
- 6 CVECVSS 7.1NEWPoC 6articles (1) · directory (1) · freeforall (1)
- 6 CVECVSS 6.2gentoo linux (6)
- 6 CVECVSS 5.6NEWPoC 6blogit\! (4) · rankem (2)
- 5 CVECVSS 7.5NEWPoC 5active price comparison (2) · active web mail (1) · active business directory (1)
- 5 CVECVSS 5.9debian linux (5)
- 5 CVECVSS 6.9PoC 1eog (1) · epiphany (1) · gnumeric (1)
- 5 CVE1 critCVSS 7.0db2 universal database (2) · aix (1) · hardware management console (1)
- 5 CVECVSS 5.6NEWPoC 2modxcms (5)
- 5 CVE1 critCVSS 6.7NEWtypo3 (4) · freecap captcha extension (1)
- 4 CVECVSS 6.9NEWPoC 3xm events diary (3) · internal e-mail system (1)
- 4 CVECVSS 5.5NEWPoC 4click\&email (2) · click\&rank (2)
- 4 CVECVSS 6.9PoC 4com paxgallery (1) · com pccookbook (1) · com waticketsystem (1)
- 4 CVECVSS 7.5NEWPoC 4hotel booking reservation system (4) · com 5starhotels (1) · com allhotels (1)
- 4 CVECVSS 4.8PoC 2firefox (3) · libxul (1) · seamonkey (1)
- 4 CVE1 critCVSS 5.1certificate system (3) · dogtag certificate system (1) · red hat enterprise linux (1)
- 4 CVECVSS 5.5NEWPoC 3websvn (4)
- 3 CVECVSS 5.6ubuntu linux (3)
- 3 CVECVSS 4.3NEWPoC 3constructr-cms (3)
- 3 CVECVSS 7.0NEWPoC 3ednews (2) · edcontainer (1)
- 3 CVE2 critCVSS 8.3systemcastwizard lite (3)
- 3 CVECVSS 6.5NEWgit (3)
- 3 CVE1 critCVSS 7.1PoC 1hplip (1) · openview network node manager (1) · select access (1)
- 3 CVECVSS 4.8NEWenterpriseone (3)
- 3 CVECVSS 6.8NEWPoC 2ktp computer customer database (3)
- 3 CVECVSS 6.06131 nfc (3)
- 3 CVECVSS 5.6NEWPoC 3mailing list manager (3)
- 3 CVECVSS 6.4NEWPoC 3phpauctions (3)
- 3 CVECVSS 5.4NEWPoC 3phpclanwebsite (3)
- 3 CVECVSS 7.5NEWPoC 3phpicalendar (3) · phpicalendar2.0 (1)
- 3 CVECVSS 6.0NEWPoC 2phosheezy (3)
- 3 CVECVSS 6.7NEWPoC 3sg real estate portal (3)
- 3 CVECVSS 4.2NEWmovable type (3)
- 3 CVE1 critCVSS 6.5internet security 2007 (3) · internet security 2008 (3) · officescan (3)
- 3 CVE2 critCVSS 9.1NEWPoC 2vuplayer (3)
- 3 CVECVSS 7.5NEWPoC 1xrdp (3)
- 2 CVECVSS 5.9PoC 2aj auction (2)
- 2 CVE2 critCVSS 9.3NEWamarok (2)
- 2 CVECVSS 6.3NEWPoC 2template creature (2)
- 2 CVE2 critCVSS 10.0arcserve backup (1) · etrust intrusion detection (1) · internet security suite 2007 (1)
- 2 CVECVSS 4.7connectra ngx (1) · vpn-1 (1)
- 2 CVECVSS 5.9NEWPoC 2cms isweb (2)
- 2 CVECVSS 5.9NEWPoC 1blog manager (2)
- 2 CVECVSS 4.8ajax checklist (2)
| # | Vendor | CVEs | Crit | KEV | Nuclei | Signals | Top products | Δ | |
|---|---|---|---|---|---|---|---|---|---|
| 1 | oracle | 41 | 5 | · | · | PoC 1 | secure backup (9) · database 10g (9) · peoplesoft enterprise (6) | — | |
| 2 | sun | 22 | 4 | · | · | PoC 1 | opensolaris (14) · solaris (9) · java system access manager (3) | — | |
| 3 | microsoft | 16 | 5 | · | · | PoC 7 | windows xp (5) · windows server 2003 (4) · windows 2000 (4) | — | |
| 4 | сообщество свободного программного обеспечения | 16 | 4 | · | · | PoC 1 | debian gnu/linux (15) · libaudiofile (1) | — | |
| 5 | apple | 14 | 8 | · | · | PoC 3 | quicktime (7) · safari (5) · cups (1) | — | |
| 6 | cisco | 10 | · | · | · | PoC 1 | ironport postx (4) · ironport encryption appliance (4) · ons 15600 (1) | — | |
| 7 | linux | 7 | 1 | · | · | linux kernel (7) | — | ||
| 8 | codeavalanche | 6 | · | · | · | NEWPoC 6 | articles (1) · directory (1) · freeforall (1) | — | |
| 9 | gentoo foundation inc. | 6 | · | · | · | gentoo linux (6) | — | ||
| 10 | katywhitton | 6 | · | · | · | NEWPoC 6 | blogit\! (4) · rankem (2) | — | |
| 11 | activewebsoftwares | 5 | · | · | · | NEWPoC 5 | active price comparison (2) · active web mail (1) · active business directory (1) | — | |
| 12 | debian | 5 | · | · | · | debian linux (5) | — | ||
| 13 | gnome | 5 | · | · | · | PoC 1 | eog (1) · epiphany (1) · gnumeric (1) | — | |
| 14 | ibm | 5 | 1 | · | · | db2 universal database (2) · aix (1) · hardware management console (1) | — | ||
| 15 | modxcms | 5 | · | · | · | NEWPoC 2 | modxcms (5) | — | |
| 16 | typo3 | 5 | 1 | · | · | NEW | typo3 (4) · freecap captcha extension (1) | — | |
| 17 | asp-dev | 4 | · | · | · | NEWPoC 3 | xm events diary (3) · internal e-mail system (1) | — | |
| 18 | icash | 4 | · | · | · | NEWPoC 4 | click\&email (2) · click\&rank (2) | — | |
| 19 | joomla | 4 | · | · | · | PoC 4 | com paxgallery (1) · com pccookbook (1) · com waticketsystem (1) | — | |
| 20 | joomlahbs | 4 | · | · | · | NEWPoC 4 | hotel booking reservation system (4) · com 5starhotels (1) · com allhotels (1) | — | |
| 21 | mozilla | 4 | · | · | · | PoC 2 | firefox (3) · libxul (1) · seamonkey (1) | — | |
| 22 | redhat | 4 | 1 | · | · | certificate system (3) · dogtag certificate system (1) · red hat enterprise linux (1) | — | ||
| 23 | tigris | 4 | · | · | · | NEWPoC 3 | websvn (4) | — | |
| 24 | canonical | 3 | · | · | · | ubuntu linux (3) | — | ||
| 25 | constructr | 3 | · | · | · | NEWPoC 3 | constructr-cms (3) | — | |
| 26 | edreamers | 3 | · | · | · | NEWPoC 3 | ednews (2) · edcontainer (1) | — | |
| 27 | fujitsu | 3 | 2 | · | · | systemcastwizard lite (3) | — | ||
| 28 | git | 3 | · | · | · | NEW | git (3) | — | |
| 29 | hp | 3 | 1 | · | · | PoC 1 | hplip (1) · openview network node manager (1) · select access (1) | — | |
| 30 | jdedwards | 3 | · | · | · | NEW | enterpriseone (3) | — | |
| 31 | ktp computer customer database | 3 | · | · | · | NEWPoC 2 | ktp computer customer database (3) | — | |
| 32 | nokia | 3 | · | · | · | 6131 nfc (3) | — | ||
| 33 | ocean12 technologies | 3 | · | · | · | NEWPoC 3 | mailing list manager (3) | — | |
| 34 | phpauctions | 3 | · | · | · | NEWPoC 3 | phpauctions (3) | — | |
| 35 | phpclanwebsite | 3 | · | · | · | NEWPoC 3 | phpclanwebsite (3) | — | |
| 36 | phpicalendar | 3 | · | · | · | NEWPoC 3 | phpicalendar (3) · phpicalendar2.0 (1) | — | |
| 37 | ryneezy | 3 | · | · | · | NEWPoC 2 | phosheezy (3) | — | |
| 38 | sg real estate portal | 3 | · | · | · | NEWPoC 3 | sg real estate portal (3) | — | |
| 39 | sixapart | 3 | · | · | · | NEW | movable type (3) | — | |
| 40 | trendmicro | 3 | 1 | · | · | internet security 2007 (3) · internet security 2008 (3) · officescan (3) | — | ||
| 41 | vuplayer | 3 | 2 | · | · | NEWPoC 2 | vuplayer (3) | — | |
| 42 | xrdp | 3 | · | · | · | NEWPoC 1 | xrdp (3) | — | |
| 43 | aj square | 2 | · | · | · | PoC 2 | aj auction (2) | — | |
| 44 | amarok | 2 | 2 | · | · | NEW | amarok (2) | — | |
| 45 | aspapps | 2 | · | · | · | NEWPoC 2 | template creature (2) | — | |
| 46 | ca | 2 | 2 | · | · | arcserve backup (1) · etrust intrusion detection (1) · internet security suite 2007 (1) | — | ||
| 47 | checkpoint | 2 | · | · | · | connectra ngx (1) · vpn-1 (1) | — | ||
| 48 | cmsisweb | 2 | · | · | · | NEWPoC 2 | cms isweb (2) | — | |
| 49 | dmxready | 2 | · | · | · | NEWPoC 1 | blog manager (2) | — | |
| 50 | drupal | 2 | · | · | · | ajax checklist (2) | — |
Sectors
Solution categories ranked by distinct CVE count this period.
- Web & CMS Plugins127 CVE6 crit69 vendorsCVSS 7.3modxcms (5) · movable type (4) · typo3 (4)
- Operating Systems71 CVE25 crit16 vendorsCVSS 7.4debian gnu/linux (15) · linux kernel (7) · gentoo linux (6)
- Databases42 CVE7 crit2 vendorsCVSS 5.3database 10g (9) · secure backup (9) · peoplesoft enterprise (6)
- Enterprise Software30 CVE15 crit13 vendorsCVSS 8.6db2 universal database (2) · aix (1) · arcserve backup (1)
- Consumer Software25 CVE11 crit14 vendorsCVSS 9.6xterm (2) · dia (1) · eog (1)
- OSS Libraries24 CVE5 crit17 vendorsCVSS 8.8vuplayer (3) · libmikmod (2) · mini-pub (2)
- 2 crit9 vendorsCVSS 7.1ironport encryption appliance (4) · ironport postx (4) · tsunami mp.11 2411 (2)
- Mobile Apps16 CVE9 crit3 vendorsCVSS 7.8quicktime (8) · safari (5) · cups (1)
- Communications13 CVE8 crit11 vendorsCVSS 7.8blackberry enterprise server (2) · blackberry professional software (2) · blackberry unite (2)
- Security Products11 CVE7 crit8 vendorsCVSS 10.0internet security 2007 (3) · internet security 2008 (3) · officescan (3)
- DevTools & CI10 CVE6 vendorsCVSS 6.3git (4) · websvn (4) · gforge (1)
- Cloud & SaaS5 CVE12 crit4 vendorsCVSS 8.4ace (1) · anti-spyware (1) · anti-spyware for the enterprise (1)
- Hardware Firmware4 CVE2 crit2 vendorsCVSS 8.3systemcastwizard lite (3)
- ICS / OT / IoT2 CVE15 crit2 vendorsCVSS 10.0axis camera control (1)
- Unclassified72 CVE6 crit55 vendorsCVSS 6.6constructr-cms (3) · ktp computer customer database (3) · xm events diary (3)
| Sector | CVEs | Crit | KEV | Vendors | Products | Avg CVSS | Top products |
|---|---|---|---|---|---|---|---|
| Web & CMS Plugins▸ 5 | 127 | 6 | · | 69 | 88 | 7.3 | modxcms (5) · movable type (4) · typo3 (4) |
| Operating Systems▸ 3 | 71 | 25 | · | 16 | 37 | 7.4 | debian gnu/linux (15) · linux kernel (7) · gentoo linux (6) |
| Databases▸ 1 | 42 | 7 | · | 2 | 18 | 5.3 | database 10g (9) · secure backup (9) · peoplesoft enterprise (6) |
| Enterprise Software▸ 5 | 30 | 15 | · | 13 | 29 | 8.6 | db2 universal database (2) · aix (1) · arcserve backup (1) |
| Consumer Software▸ 5 | 25 | 11 | · | 14 | 21 | 9.6 | xterm (2) · dia (1) · eog (1) |
| OSS Libraries▸ 4 | 24 | 5 | · | 17 | 17 | 8.8 | vuplayer (3) · libmikmod (2) · mini-pub (2) |
| Networking Infrastructure▸ 4 | 23 | 2 | · | 9 | 21 | 7.1 | ironport encryption appliance (4) · ironport postx (4) · tsunami mp.11 2411 (2) |
| Mobile Apps▸ 2 | 16 | 9 | · | 3 | 5 | 7.8 | quicktime (8) · safari (5) · cups (1) |
| Communications▸ 3 | 13 | 8 | · | 11 | 15 | 7.8 | blackberry enterprise server (2) · blackberry professional software (2) · blackberry unite (2) |
| Security Products▸ 4 | 11 | 7 | · | 8 | 13 | 10.0 | internet security 2007 (3) · internet security 2008 (3) · officescan (3) |
| DevTools & CI▸ 2 | 10 | · | · | 6 | 5 | 6.3 | git (4) · websvn (4) · gforge (1) |
| Cloud & SaaS▸ 2 | 5 | 12 | · | 4 | 20 | 8.4 | ace (1) · anti-spyware (1) · anti-spyware for the enterprise (1) |
| Hardware Firmware▸ 1 | 4 | 2 | · | 2 | 2 | 8.3 | systemcastwizard lite (3) |
| ICS / OT / IoT▸ 2 | 2 | 15 | · | 2 | 15 | 10.0 | axis camera control (1) |
| Unclassified | 72 | 6 | · | 55 | 56 | 6.6 | constructr-cms (3) · ktp computer customer database (3) · xm events diary (3) |
Weakness × Sector
Which weaknesses hit which solution categories in January 2009
Cells shaded by share of the sector's hottest weakness. Click a row to open the sector history.
89SQL Injection264CWE-26479XSS119Memory Buffer Bounds22Path Traversal20Improper Input Validation287Improper Authentication94Code Injection200Information Exposure399CWE-399Web & CMS Plugins612324420677Operating Systems7111175334Consumer Software41111121214OSS Libraries155823612Enterprise Software65532122Databases12Networking Infrastructure2116211Security Products235211Communications12421111DevTools & CI231112