CVE Tools
Track your stack

May 2009

367 CVEs published, −36% on April 2009 and −5% on May 2008. CISA added 0 to KEV.

2009 month by month

2009, month by month. Point at another month to read it.
2009: CVEs published per month
YearJanFebMarAprMayJunJulAugSepOctNovDecYear total
2009January 2009: 469 CVEsFebruary 2009: 689 CVEsMarch 2009: 566 CVEsApril 2009: 570 CVEsMay 2009: 367 CVEsJune 2009: 452 CVEsJuly 2009: 449 CVEsAugust 2009: no snapshotSeptember 2009: 576 CVEsOctober 2009: 353 CVEsNovember 2009: 311 CVEsDecember 2009: 445 CVEs5,24711 of 12 months11/12
Critical
8022% of the 364 with a CVSS score
Added to CISA KEV
01 of this month's CVEs are in KEV, listed a median 6200 days after publication
Vendors
214307 products
Top weakness
SQL InjectionCWE-89 · 66 CVEs

Who drove it

Vendors by distinct CVEs this month, with how many of those CVEs are now in CISA KEV and how far each moved in the ranking.

  1. 1AppleMac OS X, Mac OS X Server, Safari213nonenew
  2. 2MicrosoftOffice Powerpoint, Windows Xp, Office Compatibility Pack For Word Excel Ppt 200716131new
  3. 3Gentoo Foundation Inc.Gentoo Linux92nonenew
  4. 4SunSolaris, Jre, Java System Portal Server94nonenew
  5. 5CiscoWVC54GCA, WVC54GC, Telepresence Readiness Assessment Manager81nonenew
  6. 6Red HatRed Hat Enterprise Linux, Dogtag Certificate System, Fedora82nonenew
  7. 7Scripts-for-sitesEz Affiliate, Ez Adult Directory, Ez Auction80nonenew
  8. 8IBMTivoli Storage Manager Client, Tivoli Storage Manager Express, Aix73nonenew
  9. 9CollectorMycolex, Mygesuad60nonenew
  10. 102daybizBusiness Community Script, Custom T-shirt Design Script, Template Monster Clone50nonenew
  11. 11Cgi RescueFORM2MAIL, Rescue, Cgi Rescue Minibbs50nonenew
  12. 12DrupalDrupal, News Page, Nodeaccess Userreference50nonenew
  13. 13Easy-scriptsAnswer and Question Script50nonenew
  14. 14GoogleChrome, Android52nonenew
  15. 15Mini-streamEasy Rm-mp3 Converter, Castripper, Mini-stream Rm Downloader55nonenew
  16. 16SquirrelmailSquirrelmail, Imap General.php50nonenew
  17. 17Сообщество Свободного Программного ОбеспеченияDebian Gnu/linux51nonenew
  18. 18AtenKH1516I Ip Kvm Switch, KN9116 Ip Kvm Switch, PN9108 Power Over The Net43nonenew
  19. 19HPOpenview Network Node Manager, Data Protector Express, Remote Graphics Software42nonenew
  20. 20IcewarpWebmail Server, Email Server, Merak Mail Server40nonenew
  21. 21LinuxLinux Kernel40nonenew
  22. 22NovellGroupwise41nonenew
  23. 23PidginPidgin41nonenew
  24. 24ArmorlogicProfense Web Application Firewall31nonenew
  25. 25CanonicalUbuntu Linux30nonenew

Severity

How this month's CVEs score on CVSS; 3 have no score yet. Severity is not exploitation.

  • Critical8022%
  • High10930%
  • Medium16846%
  • Low72%

New in the top 100

Not in the top 100 in any of the 24 months before.

  1. Scripts-for-sites8#7
  2. Collector6#9
  3. 2daybiz5#10
  4. Cgi Rescue5#11
  5. Easy-scripts5#13
  6. Mini-stream5#15
  7. Aten4#18
  8. Icewarp4#20
  9. Pidgin4#23
  10. Armorlogic3#24

What kind of weakness

Weakness classes (CWE) by distinct CVEs, with how far each moved in the ranking.

  1. CWE-89SQL Injection66new
  2. CWE-119Memory Buffer Bounds63new
  3. CWE-79XSS40new
  4. CWE-22Path Traversal26new
  5. CWE-26422new
  6. CWE-20Improper Input Validation21new
  7. CWE-287Improper Authentication20new
  8. CWE-94Code Injection19new
  9. CWE-1899new
  10. CWE-3107new
  11. CWE-352CSRF7new
  12. CWE-3997new
  13. CWE-200Information Exposure5new
  14. CWE-163new
  15. CWE-312Cleartext Storage3new
  16. CWE-2552new
  17. CWE-362Race Condition2new
  18. CWE-592new
  19. CWE-1581new
  20. CWE-306Missing Auth for Critical Function1new

Where it landed

The month's CVEs by the sector of the software they affect. A CVE that touches several sectors counts in each.

Area is CVEs this month. Point at a sector to read it.

Which weakness, where

The top weakness classes against the vendors and the sectors that carried them.

Snapshot v1, computed Jun 11, 2026, 06:04 UTC. MethodologyAll months on record

Nuclei coverage and the detection gap are held back while the template mirror is repaired.

We use analytics cookies to see which pages and articles actually help people. Decline and none of them run — the site works the same. What we store