month report
September 2015
Data as of Jun 11, 2026, 06:04 UTCSnapshot v1 Sources CVEList V5+NVD+GHSA+CSAF+FSTEC BDU+CISA KEV+EPSS+Nuclei templates Methodology →
September 2015 closed with 499 published CVEs. 77 criticals, apple led volume, mostly via iphone os. Top weakness class — CWE-119 (126 CVE). 10 vendors cracked the top-100 for the first time.
Total CVEs
499
— MoM— YoY
Severity mix
77 / 107
critical / high
KEV added
0
0 ransomware-linked
Nuclei coverage
2.6%
13 CVEs with templates
Time to exploit
How fast the community ships detection after a CVE drops.
Days → Nuclei (median)
3824.3
n=13
Within 7 days
0.0%
Within 30 days
0.0%
Days → KEV (median)
2373
n=2
Detection gap
KEV pressure, no Nuclei coverage
September 2015 · vendors with active exploitation listed by CISA but no public detection template.
- KEV 2microsoft52 CVE
Weakness × Vendor
What's spreading where in September 2015
Cells shaded by share of vendor's hottest weakness. Click any cell to open the CWE history.
119Memory Buffer Bounds79XSS200Information Exposure264CWE-26420Improper Input Validation254CWE-254399CWE-39989SQL Injection352CSRF22Path Traversalapple51221106apple inc.501976microsoft21621151microsoft corp21621151cisco32651111google101316mozilla163115mozilla corp.16315adobe13411adobe systems inc.13411google inc36canonical211311
Most discussed CVEs — September 2015
No CVE mentions in the news this month yet.
First time in top-100
Vendors never in top-100 in the prior 24 periods.
- #10refbase9 CVE
- #13newphoria corporation6 CVE
- #14free software foundation, inc.5 CVE
- #16securifi5 CVE
- #17synology5 CVE
- #25ibc solar3 CVE
- #26libvdpau project3 CVE
- #28moxa3 CVE
- #30philippine long distance telephone3 CVE
- #32s9y3 CVE
Top vendors
Ranked by distinct CVE count this period.
- 101 CVE8 critCVSS 6.1PoC 1iphone os (90) · ios (88) · safari (43)
- 52 CVE25 critCVSS 7.6KEV 2PoC 15windows 10 (19) · windows 8.1 (19) · windows server 2012 (19)
- 32 CVE4 critCVSS 6.5PoC 2ios xe (5) · ios (4) · cisco ios (3)
- 32 CVE16 critCVSS 7.6PoC 2android (17) · chrome (15) · google chrome (15)
- 29 CVE1 critCVSS 6.7PoC 1firefox (28) · firefox esr (17) · bugzilla (1)
- 25 CVE21 critCVSS 9.1PoC 2air sdk (23) · air sdk \& compiler (23) · flash player (23)
- 12 CVECVSS 6.6ubuntu linux (12) · ubuntu (4)
- 10 CVECVSS 6.6web gateway (6) · endpoint protection (3) · ghost solutions suite (1)
- 9 CVECVSS 7.5ffmpeg (9)
- 9 CVECVSS 6.2NEWPoC 2refbase (9)
- 7 CVE1 critCVSS 5.5PoC 5rsa archer grc (3) · rsa identity management and governance (2) · atmos (1)
- 7 CVECVSS 5.1mediawiki (7)
- 6 CVECVSS 6.8NEWmegaphone music (1) · 1.1 (1) · applican (1)
- 5 CVECVSS 6.6NEWlibvdpau (3) · gnutls (1) · sblim-sfcb (1)
- 5 CVECVSS 4.3arcsight logger (1) · integrated lights-out 3 firmware (1) · integrated lights-out 4 firmware (1)
- 5 CVECVSS 5.5NEWalmond-2015 firmware (5) · almond firmware (5)
- 5 CVE1 critCVSS 6.7NEWPoC 5video station (3) · download station (2)
- 4 CVECVSS 5.7debian linux (4)
- 4 CVECVSS 5.9PoC 4forticlient (4)
- 4 CVE1 critCVSS 6.5http server (1) · websphere commerce (1) · websphere mq (1)
- 4 CVE1 critCVSS 6.1PoC 1opensuse (4)
- 4 CVECVSS 4.3PoC 2datatables/datatables (1) · october/october (1) · phpmyadmin/phpmyadmin (1)
- 4 CVECVSS 6.1enterprise linux (1) · enterprise linux desktop (1) · enterprise linux hpc node (1)
- 3 CVECVSS 6.4glibc (1) · gnu screen (1) · gnutls (1)
- 3 CVECVSS 4.8NEWdanfoss tlx pro\+ (3) · servemaster tlp\+ (3)
- 3 CVECVSS 6.9NEWlibvdpau (3)
- 3 CVECVSS 5.3enterprise security manager (1) · enterprise security manager\/log manager (1) · enterprise security manager\/receiver (1)
- 3 CVECVSS 6.5NEWeds-405a firmware (3) · eds-408a firmware (3)
- 3 CVECVSS 6.5moxa eds-405a (3) · moxa eds-408a (3)
- 3 CVECVSS 6.3NEWkasda kw58293 firmware (3) · speedsurf 504an firmware (3)
- 3 CVECVSS 5.8PoC 1ipython (2) · notebook (2) · nova (1)
- 3 CVECVSS 5.6NEWPoC 3serendipity (3)
- 3 CVECVSS 3.9NEWopen semantic framework (3)
- 3 CVECVSS 6.2PoC 3x2crm (3)
- 2 CVE1 critCVSS 8.4NEWPoC 1webaccess (2)
- 2 CVE1 critCVSS 7.2netscaler application delivery controller firmware (2) · netscaler gateway firmware (2)
- 2 CVECVSS 5.9NEWNuclei 2PoC 2appointment booking calendar (2)
- 2 CVECVSS 4.6NEWcms updater (2)
- 2 CVECVSS 4.4PoC 1big-ip edge gateway (2) · big-ip advanced firewall manager (2) · big-ip analytics (2)
- 2 CVECVSS 5.5PoC 1fedora (2)
- 2 CVE2 critCVSS 9.5mds pulsenet (2)
- 2 CVECVSS 5.5NEWPoC 2openfire (2)
- 2 CVE1 critCVSS 8.9NEWimpero education pro (2)
- 2 CVECVSS 7.5NEWweb studio (2)
- 2 CVECVSS 5.5NEWPoC 1notebook (2)
- 2 CVECVSS 7.5bind (2)
- 2 CVECVSS 5.5NEWPoC 2jsp\/mysql administrador web (2)
- 2 CVECVSS 5.5NEWPoC 1notebook (2)
- 2 CVECVSS 6.7NEWPoC 2nibbleblog (2)
- 2 CVE1 critCVSS 7.5opensuse (2)
| # | Vendor | CVEs | Crit | KEV | Nuclei | Signals | Top products | Δ | |
|---|---|---|---|---|---|---|---|---|---|
| 1 | apple | 101 | 8 | · | · | PoC 1 | iphone os (90) · ios (88) · safari (43) | — | |
| 2 | microsoft | 52 | 25 | 2 | · | KEV 2PoC 15 | windows 10 (19) · windows 8.1 (19) · windows server 2012 (19) | — | |
| 3 | cisco | 32 | 4 | · | · | PoC 2 | ios xe (5) · ios (4) · cisco ios (3) | — | |
| 4 | 32 | 16 | · | · | PoC 2 | android (17) · chrome (15) · google chrome (15) | — | ||
| 5 | mozilla | 29 | 1 | · | · | PoC 1 | firefox (28) · firefox esr (17) · bugzilla (1) | — | |
| 6 | adobe | 25 | 21 | · | · | PoC 2 | air sdk (23) · air sdk \& compiler (23) · flash player (23) | — | |
| 7 | canonical | 12 | · | · | · | ubuntu linux (12) · ubuntu (4) | — | ||
| 8 | symantec | 10 | · | · | · | web gateway (6) · endpoint protection (3) · ghost solutions suite (1) | — | ||
| 9 | ffmpeg | 9 | · | · | · | ffmpeg (9) | — | ||
| 10 | refbase | 9 | · | · | · | NEWPoC 2 | refbase (9) | — | |
| 11 | emc | 7 | 1 | · | · | PoC 5 | rsa archer grc (3) · rsa identity management and governance (2) · atmos (1) | — | |
| 12 | mediawiki | 7 | · | · | · | mediawiki (7) | — | ||
| 13 | newphoria corporation | 6 | · | · | · | NEW | megaphone music (1) · 1.1 (1) · applican (1) | — | |
| 14 | free software foundation, inc. | 5 | · | · | · | NEW | libvdpau (3) · gnutls (1) · sblim-sfcb (1) | — | |
| 15 | hp | 5 | · | · | · | arcsight logger (1) · integrated lights-out 3 firmware (1) · integrated lights-out 4 firmware (1) | — | ||
| 16 | securifi | 5 | · | · | · | NEW | almond-2015 firmware (5) · almond firmware (5) | — | |
| 17 | synology | 5 | 1 | · | · | NEWPoC 5 | video station (3) · download station (2) | — | |
| 18 | debian | 4 | · | · | · | debian linux (4) | — | ||
| 19 | fortinet | 4 | · | · | · | PoC 4 | forticlient (4) | — | |
| 20 | ibm | 4 | 1 | · | · | http server (1) · websphere commerce (1) · websphere mq (1) | — | ||
| 21 | opensuse | 4 | 1 | · | · | PoC 1 | opensuse (4) | — | |
| 22 | packagist | 4 | · | · | · | PoC 2 | datatables/datatables (1) · october/october (1) · phpmyadmin/phpmyadmin (1) | — | |
| 23 | redhat | 4 | · | · | · | enterprise linux (1) · enterprise linux desktop (1) · enterprise linux hpc node (1) | — | ||
| 24 | gnu | 3 | · | · | · | glibc (1) · gnu screen (1) · gnutls (1) | — | ||
| 25 | ibc solar | 3 | · | · | · | NEW | danfoss tlx pro\+ (3) · servemaster tlp\+ (3) | — | |
| 26 | libvdpau project | 3 | · | · | · | NEW | libvdpau (3) | — | |
| 27 | mcafee | 3 | · | · | · | enterprise security manager (1) · enterprise security manager\/log manager (1) · enterprise security manager\/receiver (1) | — | ||
| 28 | moxa | 3 | · | · | · | NEW | eds-405a firmware (3) · eds-408a firmware (3) | — | |
| 29 | moxa inc. | 3 | · | · | · | moxa eds-405a (3) · moxa eds-408a (3) | — | ||
| 30 | philippine long distance telephone | 3 | · | · | · | NEW | kasda kw58293 firmware (3) · speedsurf 504an firmware (3) | — | |
| 31 | pypi | 3 | · | · | · | PoC 1 | ipython (2) · notebook (2) · nova (1) | — | |
| 32 | s9y | 3 | · | · | · | NEWPoC 3 | serendipity (3) | — | |
| 33 | structured dynamics | 3 | · | · | · | NEW | open semantic framework (3) | — | |
| 34 | x2engine | 3 | · | · | · | PoC 3 | x2crm (3) | — | |
| 35 | advantech | 2 | 1 | · | · | NEWPoC 1 | webaccess (2) | — | |
| 36 | citrix | 2 | 1 | · | · | netscaler application delivery controller firmware (2) · netscaler gateway firmware (2) | — | ||
| 37 | codepeople | 2 | · | · | 2 | NEWNuclei 2PoC 2 | appointment booking calendar (2) | — | |
| 38 | drupaldise | 2 | · | · | · | NEW | cms updater (2) | — | |
| 39 | f5 | 2 | · | · | · | PoC 1 | big-ip edge gateway (2) · big-ip advanced firewall manager (2) · big-ip analytics (2) | — | |
| 40 | fedoraproject | 2 | · | · | · | PoC 1 | fedora (2) | — | |
| 41 | ge | 2 | 2 | · | · | mds pulsenet (2) | — | ||
| 42 | igniterealtime | 2 | · | · | · | NEWPoC 2 | openfire (2) | — | |
| 43 | impero | 2 | 1 | · | · | NEW | impero education pro (2) | — | |
| 44 | indusoft | 2 | · | · | · | NEW | web studio (2) | — | |
| 45 | ipython | 2 | · | · | · | NEWPoC 1 | notebook (2) | — | |
| 46 | isc | 2 | · | · | · | bind (2) | — | ||
| 47 | jsp\/mysql administrador web project | 2 | · | · | · | NEWPoC 2 | jsp\/mysql administrador web (2) | — | |
| 48 | jupyter | 2 | · | · | · | NEWPoC 1 | notebook (2) | — | |
| 49 | nibbleblog | 2 | · | · | · | NEWPoC 2 | nibbleblog (2) | — | |
| 50 | novell inc. | 2 | 1 | · | · | opensuse (2) | — |
Sectors
Solution categories ranked by distinct CVE count this period.
- Mobile Apps133 CVE39 crit4 vendorsCVSS 7.6iphone os (90) · ios (88) · itunes (71)
- Operating Systems81 CVE194 crit24 KEV15 vendorsCVSS 7.6windows 8.1 (38) · windows 10 (37) · windows server 2012 (37)
- Consumer Software56 CVE120 crit6 vendorsCVSS 9.1firefox (56) · firefox esr (17) · bugzilla (1)
- Web & CMS Plugins48 CVE28 vendorsCVSS 5.9refbase (9) · mediawiki (7) · serendipity (3)
- 9 crit10 vendorsCVSS 10.0almond firmware (5) · almond-2015 firmware (5) · ios xe (5)
- Security Products35 CVE6 crit15 vendorsCVSS 9.0web gateway (6) · endpoint protection (3) · avira management console (1)
- OSS Libraries34 CVE15 vendorsCVSS 6.3ffmpeg (9) · libvdpau (6) · open semantic framework (3)
- Enterprise Software25 CVE3 crit16 vendorsCVSS 7.5impero education pro (3) · arcsight logger (1) · hipchat (1)
- ICS / OT / IoT20 CVE8 crit15 vendorsCVSS 8.1mds pulsenet (2) · web studio (2) · webaccess (2)
- Cloud & SaaS13 CVE4 crit12 vendorsCVSS 7.9netscaler application delivery controller firmware (2) · netscaler gateway firmware (2) · qemu (1)
- Hardware Firmware8 CVE1 crit6 vendorsCVSS 9.3kasda kw58293 firmware (3) · speedsurf 504an firmware (3) · windows vga display manager (1)
- Communications7 CVE2 crit6 vendorsCVSS 6.2openfire (2) · mdc private message (1) · messenger (1)
- Databases4 CVE3 crit5 vendorsCVSS 9.7sqlite (2) · ibm http server (1)
- AI / ML2 CVE2 vendorsCVSS 5.5notebook (4)
- Unclassified26 CVE2 crit18 vendorsCVSS 6.5data manager (2) · jsp\/mysql administrador web (2) · pacemaker\/corosync configuration system (2)
| Sector | CVEs | Crit | KEV | Vendors | Products | Avg CVSS | Top products |
|---|---|---|---|---|---|---|---|
| Mobile Apps▸ 2 | 133 | 39 | · | 4 | 13 | 7.6 | iphone os (90) · ios (88) · itunes (71) |
| Operating Systems▸ 3 | 81 | 194 | 24 | 15 | 74 | 7.6 | windows 8.1 (38) · windows 10 (37) · windows server 2012 (37) |
| Consumer Software▸ 3 | 56 | 120 | · | 6 | 11 | 9.1 | firefox (56) · firefox esr (17) · bugzilla (1) |
| Web & CMS Plugins▸ 4 | 48 | · | · | 28 | 27 | 5.9 | refbase (9) · mediawiki (7) · serendipity (3) |
| Networking Infrastructure▸ 5 | 44 | 9 | · | 10 | 41 | 10.0 | almond firmware (5) · almond-2015 firmware (5) · ios xe (5) |
| Security Products▸ 5 | 35 | 6 | · | 15 | 38 | 9.0 | web gateway (6) · endpoint protection (3) · avira management console (1) |
| OSS Libraries▸ 6 | 34 | · | · | 15 | 22 | 6.3 | ffmpeg (9) · libvdpau (6) · open semantic framework (3) |
| Enterprise Software▸ 6 | 25 | 3 | · | 16 | 27 | 7.5 | impero education pro (3) · arcsight logger (1) · hipchat (1) |
| ICS / OT / IoT▸ 3 | 20 | 8 | · | 15 | 19 | 8.1 | mds pulsenet (2) · web studio (2) · webaccess (2) |
| Cloud & SaaS▸ 4 | 13 | 4 | · | 12 | 14 | 7.9 | netscaler application delivery controller firmware (2) · netscaler gateway firmware (2) · qemu (1) |
| Hardware Firmware▸ 4 | 8 | 1 | · | 6 | 8 | 9.3 | kasda kw58293 firmware (3) · speedsurf 504an firmware (3) · windows vga display manager (1) |
| Communications▸ 3 | 7 | 2 | · | 6 | 7 | 6.2 | openfire (2) · mdc private message (1) · messenger (1) |
| Databases▸ 3 | 4 | 3 | · | 5 | 4 | 9.7 | sqlite (2) · ibm http server (1) |
| AI / ML▸ 1 | 2 | · | · | 2 | 1 | 5.5 | notebook (4) |
| Unclassified | 26 | 2 | · | 18 | 25 | 6.5 | data manager (2) · jsp\/mysql administrador web (2) · pacemaker\/corosync configuration system (2) |
Weakness × Sector
Which weaknesses hit which solution categories in September 2015
Cells shaded by share of the sector's hottest weakness. Click a row to open the sector history.
119Memory Buffer Bounds79XSS200Information Exposure264CWE-26420Improper Input Validation254CWE-254399CWE-39989SQL Injection352CSRF22Path TraversalOperating Systems7192512207121Consumer Software85111761111OSS Libraries215518233Web & CMS Plugins244812641Networking Infrastructure4328911122Security Products25262141Enterprise Software18511231ICS / OT / IoT42221Cloud & SaaS22211Communications361