month report
September 2013
Data as of Jun 11, 2026, 06:04 UTCSnapshot v1 Sources CVEList V5+NVD+GHSA+CSAF+FSTEC BDU+CISA KEV+EPSS+Nuclei templates Methodology →
September 2013 closed with 475 published CVEs. 91 criticals, cisco led volume, mostly via unified computing system. Biggest breakout: microsoft at ×5.3 their 12-month median. Top weakness class — CWE-119 (120 CVE). 10 vendors cracked the top-100 for the first time.
Total CVEs
475
— MoM— YoY
Severity mix
91 / 56
critical / high
KEV added
0
0 ransomware-linked
Nuclei coverage
3.2%
15 CVEs with templates
Time to exploit
How fast the community ships detection after a CVE drops.
Days → Nuclei (median)
4558.4
n=15
Within 7 days
0.0%
Within 30 days
0.0%
Days → KEV (median)
3731
n=2
Weakness × Vendor
What's spreading where in September 2013
Cells shaded by share of vendor's hottest weakness. Click any cell to open the CWE history.
119Memory Buffer Bounds20Improper Input Validation264CWE-26479XSS200Information Exposure399CWE-399310CWE-310255CWE-255287Improper Authentication94Code Injectioncisco9225732324apple2061543microsoft35412221ibm234412221redhat4242131mozilla1022113linux84121open-xchange11421312adobe121pypi1151112hp2112trivantis214
Most discussed CVEs — September 2013
No CVE mentions in the news this month yet.
Breakout vendors
CVE count ≥3× their own 12-period median.
First time in top-100
Vendors never in top-100 in the prior 24 periods.
- #8open-xchange17 CVE
- #12trivantis10 CVE
- #13citrix9 CVE
- #20dahuasecurity5 CVE
- #23eucalyptus4 CVE
- #29graphite project3 CVE
- #30libtiff3 CVE
- #32supermicro3 CVE
- #35click2sell2 CVE
- #43indianic2 CVE
Top vendors
Ranked by distinct CVE count this period.
- 62 CVE6 critCVSS 6.3PoC 1unified computing system (17) · ios (10) · ios xe (4)
- 54 CVE2 critCVSS 5.8iphone os (44) · mac os x (11) · itunes (8)
- 48 CVE30 critCVSS 8.0×5.3KEV 1PoC 2word (13) · word viewer (11) · internet explorer (11)
- 26 CVE1 critCVSS 4.8PoC 5libvirt (10) · red hat enterprise linux (4) · openstack (3)
- 24 CVE2 critCVSS 4.9rational requirements composer (4) · spss analytical decision management (4) · data studio web console (3)
- 19 CVE9 critCVSS 7.7×4.8firefox (19) · seamonkey (16) · thunderbird (15)
- 17 CVECVSS 4.9PoC 1linux kernel (17)
- 17 CVECVSS 4.4NEWPoC 3open-xchange server (11) · open-xchange appsuite (10)
- 15 CVE15 critCVSS 10.0acrobat (8) · acrobat reader (8) · flash player (4)
- 14 CVECVSS 4.0×3.5PoC 1nova (3) · ansible (2) · cinder (2)
- 12 CVE4 critCVSS 5.9KEV 1PoC 1procurve manager (5) · identity driven manager (4) · icewall sso agent option (4)
- 10 CVE1 critCVSS 6.2NEWcoursemill learning management system (10)
- 9 CVE8 critCVSS 9.7NEWcloudportal services manager (8) · xenclient xt (1)
- 7 CVECVSS 5.4ubuntu linux (7)
- 7 CVE1 critCVSS 6.0org.apache.struts:struts2-core (2) · org.owasp.esapi:esapi (2) · org.apache.struts:struts2-rest-plugin (1)
- 7 CVECVSS 4.5compute (2) · cinder (2) · keystone (2)
- 6 CVECVSS 5.4PoC 1debian linux (4) · phpbb3 (1) · txt2man (1)
- 6 CVECVSS 5.3PoC 2gentoo linux (6)
- 6 CVECVSS 4.4PoC 1wireshark (6)
- 5 CVE3 critCVSS 9.0NEWdvr0404hd-a (5) · dvr0404hd-l (5) · dvr0404hd-s (5)
- 5 CVECVSS 5.3Nuclei 5PoC 3wordpress (5)
- 5 CVECVSS 5.5debian gnu/linux (3) · linux (2)
- 4 CVECVSS 5.3NEWeucalyptus (3) · eustore (1)
- 4 CVECVSS 5.1freebsd (4)
- 4 CVECVSS 6.3PoC 1moodle (4)
- 4 CVECVSS 4.0opensuse (4)
- 3 CVE1 critCVSS 6.4struts (2) · subversion (1)
- 3 CVECVSS 5.5fedora (2) · 389 directory server (1)
- 3 CVECVSS 6.0NEWPoC 1graphite (3)
- 3 CVECVSS 6.8NEWlibtiff (3)
- 3 CVE2 critCVSS 9.1PoC 1unified threat management software (1) · web appliance (1) · web appliance firmware (1)
- 3 CVE3 critCVSS 10.0NEWh8dcl-6f (3) · h8dcl-if (3) · h8dct-hibqf (3)
- 3 CVE1 critCVSS 7.1esx (3) · esxi (3)
- 2 CVE1 critCVSS 7.9struts (2)
- 2 CVECVSS 5.5NEWclick2sell suite module (2)
- 2 CVECVSS 5.0asterisk (2) · certified asterisk (2) · asterisk digiumphones (1)
- 2 CVECVSS 5.0django (2)
- 2 CVECVSS 6.3dwl-2100ap firmware (1) · des-3810 (1) · des-3810 firmware (1)
- 2 CVECVSS 5.9rsa archer egrc (2)
- 2 CVE1 critCVSS 7.2PoC 1gom player (2)
- 2 CVECVSS 6.9android (2)
- 2 CVE1 critCVSS 7.9ibm call center for commerce (2)
- 2 CVECVSS 7.2NEWNuclei 2PoC 2testimonial plugin (2)
- 2 CVECVSS 5.0NEWive os (1) · junos pulse access control service (1) · junos pulse secure access service (1)
- 2 CVECVSS 6.8NEWPoC 1libmodplug (2)
- 2 CVECVSS 6.9NEWdefy xt (2)
- 2 CVE1 critCVSS 8.6oracle flexcube private banking (2) · mysql enterprise monitor (2) · webcenter sites (2)
- 2 CVECVSS 4.2NEWenterprise security api (2)
- 2 CVECVSS 5.9NEWPoC 2real estate php script (2)
- 2 CVECVSS 6.3netweaver (2)
| # | Vendor | CVEs | Crit | KEV | Nuclei | Signals | Top products | Δ | |
|---|---|---|---|---|---|---|---|---|---|
| 1 | cisco | 62 | 6 | · | · | PoC 1 | unified computing system (17) · ios (10) · ios xe (4) | — | |
| 2 | apple | 54 | 2 | · | · | iphone os (44) · mac os x (11) · itunes (8) | — | ||
| 3 | microsoft | 48 | 30 | 1 | · | ×5.3KEV 1PoC 2 | word (13) · word viewer (11) · internet explorer (11) | — | |
| 4 | redhat | 26 | 1 | · | · | PoC 5 | libvirt (10) · red hat enterprise linux (4) · openstack (3) | — | |
| 5 | ibm | 24 | 2 | · | · | rational requirements composer (4) · spss analytical decision management (4) · data studio web console (3) | — | ||
| 6 | mozilla | 19 | 9 | · | · | ×4.8 | firefox (19) · seamonkey (16) · thunderbird (15) | — | |
| 7 | linux | 17 | · | · | · | PoC 1 | linux kernel (17) | — | |
| 8 | open-xchange | 17 | · | · | · | NEWPoC 3 | open-xchange server (11) · open-xchange appsuite (10) | — | |
| 9 | adobe | 15 | 15 | · | · | acrobat (8) · acrobat reader (8) · flash player (4) | — | ||
| 10 | pypi | 14 | · | · | · | ×3.5PoC 1 | nova (3) · ansible (2) · cinder (2) | — | |
| 11 | hp | 12 | 4 | 1 | · | KEV 1PoC 1 | procurve manager (5) · identity driven manager (4) · icewall sso agent option (4) | — | |
| 12 | trivantis | 10 | 1 | · | · | NEW | coursemill learning management system (10) | — | |
| 13 | citrix | 9 | 8 | · | · | NEW | cloudportal services manager (8) · xenclient xt (1) | — | |
| 14 | canonical | 7 | · | · | · | ubuntu linux (7) | — | ||
| 15 | maven | 7 | 1 | · | · | org.apache.struts:struts2-core (2) · org.owasp.esapi:esapi (2) · org.apache.struts:struts2-rest-plugin (1) | — | ||
| 16 | openstack | 7 | · | · | · | compute (2) · cinder (2) · keystone (2) | — | ||
| 17 | debian | 6 | · | · | · | PoC 1 | debian linux (4) · phpbb3 (1) · txt2man (1) | — | |
| 18 | gentoo foundation inc. | 6 | · | · | · | PoC 2 | gentoo linux (6) | — | |
| 19 | wireshark | 6 | · | · | · | PoC 1 | wireshark (6) | — | |
| 20 | dahuasecurity | 5 | 3 | · | · | NEW | dvr0404hd-a (5) · dvr0404hd-l (5) · dvr0404hd-s (5) | — | |
| 21 | wordpress | 5 | · | · | 5 | Nuclei 5PoC 3 | wordpress (5) | — | |
| 22 | сообщество свободного программного обеспечения | 5 | · | · | · | debian gnu/linux (3) · linux (2) | — | ||
| 23 | eucalyptus | 4 | · | · | · | NEW | eucalyptus (3) · eustore (1) | — | |
| 24 | freebsd | 4 | · | · | · | freebsd (4) | — | ||
| 25 | moodle | 4 | · | · | · | PoC 1 | moodle (4) | — | |
| 26 | opensuse | 4 | · | · | · | opensuse (4) | — | ||
| 27 | apache | 3 | 1 | · | · | struts (2) · subversion (1) | — | ||
| 28 | fedoraproject | 3 | · | · | · | fedora (2) · 389 directory server (1) | — | ||
| 29 | graphite project | 3 | · | · | · | NEWPoC 1 | graphite (3) | — | |
| 30 | libtiff | 3 | · | · | · | NEW | libtiff (3) | — | |
| 31 | sophos | 3 | 2 | · | · | PoC 1 | unified threat management software (1) · web appliance (1) · web appliance firmware (1) | — | |
| 32 | supermicro | 3 | 3 | · | · | NEW | h8dcl-6f (3) · h8dcl-if (3) · h8dct-hibqf (3) | — | |
| 33 | vmware | 3 | 1 | · | · | esx (3) · esxi (3) | — | ||
| 34 | apache software foundation | 2 | 1 | · | · | struts (2) | — | ||
| 35 | click2sell | 2 | · | · | · | NEW | click2sell suite module (2) | — | |
| 36 | digium | 2 | · | · | · | asterisk (2) · certified asterisk (2) · asterisk digiumphones (1) | — | ||
| 37 | djangoproject | 2 | · | · | · | django (2) | — | ||
| 38 | dlink | 2 | · | · | · | dwl-2100ap firmware (1) · des-3810 (1) · des-3810 firmware (1) | — | ||
| 39 | emc | 2 | · | · | · | rsa archer egrc (2) | — | ||
| 40 | gomlab | 2 | 1 | · | · | PoC 1 | gom player (2) | — | |
| 41 | 2 | · | · | · | android (2) | — | |||
| 42 | ibm corp. | 2 | 1 | · | · | ibm call center for commerce (2) | — | ||
| 43 | indianic | 2 | · | · | 2 | NEWNuclei 2PoC 2 | testimonial plugin (2) | — | |
| 44 | juniper | 2 | · | · | · | NEW | ive os (1) · junos pulse access control service (1) · junos pulse secure access service (1) | — | |
| 45 | konstanty bialkowski | 2 | · | · | · | NEWPoC 1 | libmodplug (2) | — | |
| 46 | motorola | 2 | · | · | · | NEW | defy xt (2) | — | |
| 47 | oracle | 2 | 1 | · | · | oracle flexcube private banking (2) · mysql enterprise monitor (2) · webcenter sites (2) | — | ||
| 48 | owasp | 2 | · | · | · | NEW | enterprise security api (2) | — | |
| 49 | real-estate-php-script | 2 | · | · | · | NEWPoC 2 | real estate php script (2) | — | |
| 50 | sap | 2 | · | · | · | netweaver (2) | — |
Sectors
Solution categories ranked by distinct CVE count this period.
- Operating Systems112 CVE78 crit1 KEV14 vendorsCVSS 8.0linux kernel (17) · libvirt (10) · ubuntu linux (7)
- 6 crit8 vendorsCVSS 6.8unified computing system (17) · ios (10) · ios xe (4)
- Enterprise Software64 CVE11 crit2 KEV16 vendorsCVSS 7.1procurve manager (5) · icewall sso agent option (4) · identity driven manager (4)
- Mobile Apps56 CVE2 crit3 vendorsCVSS 6.9iphone os (44) · mac os x (11) · itunes (8)
- OSS Libraries41 CVE2 crit18 vendorsCVSS 6.0nova (3) · ansible (2) · cinder (2)
- Consumer Software39 CVE65 crit6 vendorsCVSS 9.9firefox (19) · seamonkey (16) · thunderbird (15)
- Web & CMS Plugins33 CVE2 crit22 vendorsCVSS 5.8wordpress (5) · moodle (4) · struts (4)
- Cloud & SaaS25 CVE10 crit5 vendorsCVSS 7.9cloudportal services manager (8) · esx (3) · esxi (3)
- Communications21 CVE4 vendorsCVSS 5.3open-xchange server (11) · open-xchange appsuite (10) · zimbra collaboration suite (1)
- Security Products13 CVE2 crit5 vendorsCVSS 9.1wireshark (6)
- ICS / OT / IoT11 CVE196 crit6 vendorsCVSS 9.0dvr0404hd-a (5) · dvr0404hd-l (5) · dvr0404hd-s (5)
- Hardware Firmware4 CVE399 crit2 vendorsCVSS 10.0h8dcl-6f (3) · h8dcl-if (3) · h8dct-hibqf (3)
- Databases2 CVE7 crit3 vendorsCVSS 8.5mysql enterprise monitor (3) · webcenter sites (3) · ibm call center for commerce (2)
- Unclassified9 CVE8 vendorsCVSS 5.1real estate php script (2) · bitcoin core (1) · bitcoin-qt (1)
| Sector | CVEs | Crit | KEV | Vendors | Products | Avg CVSS | Top products |
|---|---|---|---|---|---|---|---|
| Operating Systems▸ 3 | 112 | 78 | 1 | 14 | 52 | 8.0 | linux kernel (17) · libvirt (10) · ubuntu linux (7) |
| Networking Infrastructure▸ 4 | 72 | 6 | · | 8 | 44 | 6.8 | unified computing system (17) · ios (10) · ios xe (4) |
| Enterprise Software▸ 5 | 64 | 11 | 2 | 16 | 66 | 7.1 | procurve manager (5) · icewall sso agent option (4) · identity driven manager (4) |
| Mobile Apps▸ 2 | 56 | 2 | · | 3 | 9 | 6.9 | iphone os (44) · mac os x (11) · itunes (8) |
| OSS Libraries▸ 6 | 41 | 2 | · | 18 | 31 | 6.0 | nova (3) · ansible (2) · cinder (2) |
| Consumer Software▸ 3 | 39 | 65 | · | 6 | 16 | 9.9 | firefox (19) · seamonkey (16) · thunderbird (15) |
| Web & CMS Plugins▸ 5 | 33 | 2 | · | 22 | 22 | 5.8 | wordpress (5) · moodle (4) · struts (4) |
| Cloud & SaaS▸ 3 | 25 | 10 | · | 5 | 12 | 7.9 | cloudportal services manager (8) · esx (3) · esxi (3) |
| Communications▸ 2 | 21 | · | · | 4 | 7 | 5.3 | open-xchange server (11) · open-xchange appsuite (10) · zimbra collaboration suite (1) |
| Security Products▸ 4 | 13 | 2 | · | 5 | 7 | 9.1 | wireshark (6) |
| ICS / OT / IoT▸ 3 | 11 | 196 | · | 6 | 72 | 9.0 | dvr0404hd-a (5) · dvr0404hd-l (5) · dvr0404hd-s (5) |
| Hardware Firmware▸ 2 | 4 | 399 | · | 2 | 143 | 10.0 | h8dcl-6f (3) · h8dcl-if (3) · h8dct-hibqf (3) |
| Databases▸ 1 | 2 | 7 | · | 3 | 5 | 8.5 | mysql enterprise monitor (3) · webcenter sites (3) · ibm call center for commerce (2) |
| Unclassified | 9 | · | · | 8 | 9 | 5.1 | real estate php script (2) · bitcoin core (1) · bitcoin-qt (1) |
Weakness × Sector
Which weaknesses hit which solution categories in September 2013
Cells shaded by share of the sector's hottest weakness. Click a row to open the sector history.
119Memory Buffer Bounds20Improper Input Validation264CWE-26479XSS200Information Exposure399CWE-399310CWE-310255CWE-255287Improper Authentication94Code InjectionOperating Systems50202885831Networking Infrastructure112988335242Consumer Software58532241Enterprise Software8106161215OSS Libraries1229233212Web & CMS Plugins431412Communications11334231322Cloud & SaaS216321Security Products23221ICS / OT / IoT322121