month report
September 2009
Data as of Jun 11, 2026, 06:04 UTCSnapshot v1 Sources CVEList V5+NVD+GHSA+CSAF+FSTEC BDU+CISA KEV+EPSS+Nuclei templates Methodology →
September 2009 closed with 576 published CVEs. 102 criticals, apple led volume, mostly via mac os x server. Top weakness class — CWE-89 (93 CVE). 10 vendors cracked the top-100 for the first time.
Total CVEs
576
— MoM— YoY
Severity mix
102 / 181
critical / high
KEV added
0
0 ransomware-linked
Nuclei coverage
0.7%
4 CVEs with templates
Time to exploit
How fast the community ships detection after a CVE drops.
Days → Nuclei (median)
6021.8
n=4
Within 7 days
0.0%
Within 30 days
0.0%
Days → KEV (median)
—
n=0
Weakness × Vendor
What's spreading where in September 2009
Cells shaded by share of vendor's hottest weakness. Click any cell to open the CWE history.
89SQL Injection79XSS119Memory Buffer Bounds264CWE-26494Code Injection22Path Traversal20Improper Input Validation399CWE-399310CWE-310287Improper Authenticationapple1922133ibm52211mozilla2211cisco11microsoft1151opera2122linux322sun21hp1symantec1111сообщество свободного программного обеспечения111oracle
Most discussed CVEs — September 2009
No CVE mentions in the news this month yet.
First time in top-100
Vendors never in top-100 in the prior 24 periods.
- #13vtiger7 CVE
- #14almondsoft5 CVE
- #15anantasoft5 CVE
- #16bpowerhouse5 CVE
- #20jce-tech5 CVE
- #23zenas5 CVE
- #25brilaps4 CVE
- #27horde4 CVE
- #28mambo-foundation4 CVE
- #31pidgin4 CVE
Top vendors
Ranked by distinct CVE count this period.
- 29 CVE5 critCVSS 6.5PoC 2mac os x server (11) · mac os x (11) · iphone os (9)
- 23 CVE3 critCVSS 6.3PoC 1websphere application server (4) · websphere mq (3) · db2 (3)
- 16 CVE10 critCVSS 8.3firefox (13) · bugzilla (3)
- 14 CVECVSS 7.2PoC 1ios (11) · nexus 7000 (1) · ace web application firewall (1)
- 13 CVE6 critCVSS 8.6PoC 2windows vista (7) · windows server 2008 (7) · windows 2000 (6)
- 10 CVECVSS 5.0opera browser (10)
- 9 CVECVSS 5.7PoC 2linux kernel (9)
- 9 CVE1 critCVSS 5.8opensolaris (6) · solaris (5) · openoffice.org (1)
- 9 CVE2 critCVSS 6.7PoC 1debian gnu/linux (9)
- 8 CVE3 critCVSS 8.4performance insight (2) · operations manager (1) · storageworks msl8096 tape library (1)
- 8 CVE3 critCVSS 7.2altiris deployment solution (6) · antivirus (1) · brightmail appliance (1)
- 7 CVE1 critCVSS 5.9PoC 2application server (5) · e-business suite (2) · e-business suite 11i (2)
- 7 CVE2 critCVSS 6.3NEWPoC 5vtiger crm (7)
- 5 CVECVSS 5.7NEWPoC 3almond classifieds (3) · com aclassf (2) · affiliate network classifieds (2)
- 5 CVECVSS 5.6NEWPoC 5gazelle cms (5)
- 5 CVECVSS 7.5NEWPoC 2bpgames (1) · bpholidaylettings (1) · bplawyercasedocuments (1)
- 5 CVE1 critCVSS 6.7PoC 1ubuntu linux (5)
- 5 CVECVSS 5.6fedora (5)
- 5 CVECVSS 5.2PoC 1chrome (5)
- 5 CVECVSS 4.3NEWPoC 2affiliate master datafeed parser (1) · auction rss content script (1) · php calendars script (1)
- 5 CVE2 critCVSS 6.7red hat enterprise linux (5)
- 5 CVECVSS 6.4PoC 2linux enterprise server (4) · linux enterprise desktop (3) · linux enterprise (1)
- 5 CVE1 critCVSS 6.4NEWPoC 4paolink (2) · pao-bacheca guestbook (1) · paobacheca guestbook (1)
- 4 CVE2 critCVSS 7.3PoC 1acrobat (1) · acrobat reader (1) · photoshop elements (1)
- 4 CVECVSS 5.5NEWPoC 1mostlyce (4)
- 4 CVECVSS 5.7PoC 1debian linux (4)
- 4 CVE2 critCVSS 8.3NEWgroupware (4) · groupware webmail edition (2) · kronolith h3 (2)
- 4 CVECVSS 5.5NEWPoC 1mambo (4)
- 4 CVECVSS 6.3PoC 2opensuse (4)
- 4 CVECVSS 6.9PoC 1php (4)
- 4 CVECVSS 5.0NEWlibpurple (4) · pidgin (4)
- 4 CVECVSS 5.3NEWi-load (4)
- 4 CVECVSS 6.9NEWsilc toolkit (4) · silc client (2)
- 4 CVECVSS 6.7NEWPoC 2dvd zone (2) · agent zone (1) · mmorpg zone (1)
- 3 CVECVSS 5.3NEWPoC 2ossim (3)
- 3 CVE3 critCVSS 10.0NEWasus wl-500w (2) · asus wl-330ge (1)
- 3 CVECVSS 6.2NEWPoC 3maxcms (3)
- 3 CVECVSS 7.0NEWinfinity script (2) · dawaween (1)
- 3 CVE1 critCVSS 5.5drupal (3)
- 3 CVECVSS 5.6NEWPoC 1eye-fi manager (3)
- 3 CVECVSS 6.3PoC 1gdm (1) · glib (1) · rhythmbox (1)
- 3 CVE1 critCVSS 8.3NEWshibboleth-sp (3) · xmltooling (2) · opensaml (2)
- 3 CVECVSS 3.8NEWjunos (3)
- 3 CVECVSS 5.4NEWlivestreet (3)
- 3 CVECVSS 5.6NEWPoC 2an image gallery (2) · image voting (1)
- 3 CVECVSS 5.8NEWpostgresql (3)
- 3 CVECVSS 5.4NEWPoC 3ts-639 pro turbo nas (2) · ts-239 pro turbo nas (2) · ts-639 pro firmware (1)
- 3 CVECVSS 5.2PoC 3actionpack (2) · activesupport (2) · thin (1)
- 3 CVE2 critCVSS 8.3NEWcrystal reports server (3)
- 3 CVE2 critCVSS 8.8player (2) · movie decoder (2) · ace (2)
| # | Vendor | CVEs | Crit | KEV | Nuclei | Signals | Top products | Δ | |
|---|---|---|---|---|---|---|---|---|---|
| 1 | apple | 29 | 5 | · | · | PoC 2 | mac os x server (11) · mac os x (11) · iphone os (9) | — | |
| 2 | ibm | 23 | 3 | · | · | PoC 1 | websphere application server (4) · websphere mq (3) · db2 (3) | — | |
| 3 | mozilla | 16 | 10 | · | · | firefox (13) · bugzilla (3) | — | ||
| 4 | cisco | 14 | · | · | · | PoC 1 | ios (11) · nexus 7000 (1) · ace web application firewall (1) | — | |
| 5 | microsoft | 13 | 6 | · | · | PoC 2 | windows vista (7) · windows server 2008 (7) · windows 2000 (6) | — | |
| 6 | opera | 10 | · | · | · | opera browser (10) | — | ||
| 7 | linux | 9 | · | · | · | PoC 2 | linux kernel (9) | — | |
| 8 | sun | 9 | 1 | · | · | opensolaris (6) · solaris (5) · openoffice.org (1) | — | ||
| 9 | сообщество свободного программного обеспечения | 9 | 2 | · | · | PoC 1 | debian gnu/linux (9) | — | |
| 10 | hp | 8 | 3 | · | · | performance insight (2) · operations manager (1) · storageworks msl8096 tape library (1) | — | ||
| 11 | symantec | 8 | 3 | · | · | altiris deployment solution (6) · antivirus (1) · brightmail appliance (1) | — | ||
| 12 | oracle | 7 | 1 | · | · | PoC 2 | application server (5) · e-business suite (2) · e-business suite 11i (2) | — | |
| 13 | vtiger | 7 | 2 | · | · | NEWPoC 5 | vtiger crm (7) | — | |
| 14 | almondsoft | 5 | · | · | · | NEWPoC 3 | almond classifieds (3) · com aclassf (2) · affiliate network classifieds (2) | — | |
| 15 | anantasoft | 5 | · | · | · | NEWPoC 5 | gazelle cms (5) | — | |
| 16 | bpowerhouse | 5 | · | · | · | NEWPoC 2 | bpgames (1) · bpholidaylettings (1) · bplawyercasedocuments (1) | — | |
| 17 | canonical | 5 | 1 | · | · | PoC 1 | ubuntu linux (5) | — | |
| 18 | fedoraproject | 5 | · | · | · | fedora (5) | — | ||
| 19 | 5 | · | · | · | PoC 1 | chrome (5) | — | ||
| 20 | jce-tech | 5 | · | · | · | NEWPoC 2 | affiliate master datafeed parser (1) · auction rss content script (1) · php calendars script (1) | — | |
| 21 | redhat | 5 | 2 | · | · | red hat enterprise linux (5) | — | ||
| 22 | suse | 5 | · | · | · | PoC 2 | linux enterprise server (4) · linux enterprise desktop (3) · linux enterprise (1) | — | |
| 23 | zenas | 5 | 1 | · | · | NEWPoC 4 | paolink (2) · pao-bacheca guestbook (1) · paobacheca guestbook (1) | — | |
| 24 | adobe | 4 | 2 | · | · | PoC 1 | acrobat (1) · acrobat reader (1) · photoshop elements (1) | — | |
| 25 | brilaps | 4 | · | · | · | NEWPoC 1 | mostlyce (4) | — | |
| 26 | debian | 4 | · | · | · | PoC 1 | debian linux (4) | — | |
| 27 | horde | 4 | 2 | · | · | NEW | groupware (4) · groupware webmail edition (2) · kronolith h3 (2) | — | |
| 28 | mambo-foundation | 4 | · | · | · | NEWPoC 1 | mambo (4) | — | |
| 29 | opensuse | 4 | · | · | · | PoC 2 | opensuse (4) | — | |
| 30 | php | 4 | · | · | · | PoC 1 | php (4) | — | |
| 31 | pidgin | 4 | · | · | · | NEW | libpurple (4) · pidgin (4) | — | |
| 32 | radactive | 4 | · | · | · | NEW | i-load (4) | — | |
| 33 | silcnet | 4 | · | · | · | NEW | silc toolkit (4) · silc client (2) | — | |
| 34 | vastal | 4 | · | · | · | NEWPoC 2 | dvd zone (2) · agent zone (1) · mmorpg zone (1) | — | |
| 35 | alienvault | 3 | · | · | · | NEWPoC 2 | ossim (3) | — | |
| 36 | asus | 3 | 3 | · | · | NEW | asus wl-500w (2) · asus wl-330ge (1) | — | |
| 37 | databay | 3 | · | · | · | NEWPoC 3 | maxcms (3) | — | |
| 38 | dimofinf | 3 | · | · | · | NEW | infinity script (2) · dawaween (1) | — | |
| 39 | drupal | 3 | 1 | · | · | drupal (3) | — | ||
| 40 | eye.fi | 3 | · | · | · | NEWPoC 1 | eye-fi manager (3) | — | |
| 41 | gnome | 3 | · | · | · | PoC 1 | gdm (1) · glib (1) · rhythmbox (1) | — | |
| 42 | internet2 | 3 | 1 | · | · | NEW | shibboleth-sp (3) · xmltooling (2) · opensaml (2) | — | |
| 43 | juniper | 3 | · | · | · | NEW | junos (3) | — | |
| 44 | livestreet | 3 | · | · | · | NEW | livestreet (3) | — | |
| 45 | plohni | 3 | · | · | · | NEWPoC 2 | an image gallery (2) · image voting (1) | — | |
| 46 | postgresql | 3 | · | · | · | NEW | postgresql (3) | — | |
| 47 | qnap | 3 | · | · | · | NEWPoC 3 | ts-639 pro turbo nas (2) · ts-239 pro turbo nas (2) · ts-639 pro firmware (1) | — | |
| 48 | rubygems | 3 | · | · | · | PoC 3 | actionpack (2) · activesupport (2) · thin (1) | — | |
| 49 | sap | 3 | 2 | · | · | NEW | crystal reports server (3) | — | |
| 50 | vmware | 3 | 2 | · | · | player (2) · movie decoder (2) · ace (2) | — |
Sectors
Solution categories ranked by distinct CVE count this period.
- Web & CMS Plugins124 CVE9 crit81 vendorsCVSS 6.5gazelle cms (5) · mambo (4) · drupal (3)
- Enterprise Software62 CVE13 crit20 vendorsCVSS 8.3websphere application server (4) · db2 (3) · tivoli directory server (3)
- Operating Systems56 CVE46 crit21 vendorsCVSS 8.6linux kernel (10) · debian gnu/linux (9) · opensuse (6)
- Consumer Software56 CVE22 crit22 vendorsCVSS 7.9firefox (13) · opera browser (10) · bugzilla (3)
- Mobile Apps34 CVE5 crit2 vendorsCVSS 6.5mac os x (11) · mac os x server (11) · iphone os (9)
- Security Products26 CVE13 crit13 vendorsCVSS 7.9altiris deployment solution (6) · antivirus (2) · brightmail appliance (1)
- 2 crit8 vendorsCVSS 7.8ios (11) · junos (3) · ace web application firewall (1)
- OSS Libraries22 CVE4 crit15 vendorsCVSS 7.2php (4) · extended module player (2) · aiocp (1)
- Communications22 CVE13 crit13 vendorsCVSS 7.8libpurple (4) · pidgin (4) · silc toolkit (4)
- Databases11 CVE2 crit3 vendorsCVSS 7.5application server (5) · postgresql (3) · e-business suite (2)
- ICS / OT / IoT9 CVE5 vendorsCVSS 5.9i-load (4) · fl il 24 bk-pac (1) · otmanager cms (1)
- Hardware Firmware9 CVE3 crit4 vendorsCVSS 10.0asus wl-500w (2) · asus wl-330ge (1)
- Cloud & SaaS5 CVE9 crit3 vendorsCVSS 8.9ace (2) · movie decoder (2) · player (2)
- DevTools & CI2 CVE1 crit2 vendorsCVSS 9.3rivettracker (1)
- Unclassified97 CVE18 crit75 vendorsCVSS 6.9mostlyce (4) · livestreet (3) · maxcms (3)
| Sector | CVEs | Crit | KEV | Vendors | Products | Avg CVSS | Top products |
|---|---|---|---|---|---|---|---|
| Web & CMS Plugins▸ 5 | 124 | 9 | · | 81 | 101 | 6.5 | gazelle cms (5) · mambo (4) · drupal (3) |
| Enterprise Software▸ 6 | 62 | 13 | · | 20 | 44 | 8.3 | websphere application server (4) · db2 (3) · tivoli directory server (3) |
| Operating Systems▸ 3 | 56 | 46 | · | 21 | 45 | 8.6 | linux kernel (10) · debian gnu/linux (9) · opensuse (6) |
| Consumer Software▸ 5 | 56 | 22 | · | 22 | 32 | 7.9 | firefox (13) · opera browser (10) · bugzilla (3) |
| Mobile Apps▸ 2 | 34 | 5 | · | 2 | 12 | 6.5 | mac os x (11) · mac os x server (11) · iphone os (9) |
| Security Products▸ 5 | 26 | 13 | · | 13 | 25 | 7.9 | altiris deployment solution (6) · antivirus (2) · brightmail appliance (1) |
| Networking Infrastructure▸ 5 | 24 | 2 | · | 8 | 15 | 7.8 | ios (11) · junos (3) · ace web application firewall (1) |
| OSS Libraries▸ 5 | 22 | 4 | · | 15 | 18 | 7.2 | php (4) · extended module player (2) · aiocp (1) |
| Communications▸ 3 | 22 | 13 | · | 13 | 26 | 7.8 | libpurple (4) · pidgin (4) · silc toolkit (4) |
| Databases▸ 2 | 11 | 2 | · | 3 | 5 | 7.5 | application server (5) · postgresql (3) · e-business suite (2) |
| ICS / OT / IoT▸ 3 | 9 | · | · | 5 | 5 | 5.9 | i-load (4) · fl il 24 bk-pac (1) · otmanager cms (1) |
| Hardware Firmware▸ 3 | 9 | 3 | · | 4 | 8 | 10.0 | asus wl-500w (2) · asus wl-330ge (1) |
| Cloud & SaaS▸ 2 | 5 | 9 | · | 3 | 7 | 8.9 | ace (2) · movie decoder (2) · player (2) |
| DevTools & CI▸ 2 | 2 | 1 | · | 2 | 2 | 9.3 | rivettracker (1) |
| Unclassified | 97 | 18 | · | 75 | 81 | 6.9 | mostlyce (4) · livestreet (3) · maxcms (3) |
Weakness × Sector
Which weaknesses hit which solution categories in September 2009
Cells shaded by share of the sector's hottest weakness. Click a row to open the sector history.
89SQL Injection79XSS119Memory Buffer Bounds264CWE-26494Code Injection22Path Traversal20Improper Input Validation399CWE-399310CWE-310287Improper AuthenticationWeb & CMS Plugins4750111121436Consumer Software13717534751Operating Systems118672642Enterprise Software1012241321Networking Infrastructure452121OSS Libraries35514141Security Products2333122Communications2613Databases1311ICS / OT / IoT12111