We study the vulnerability reports in the Common
Vulnerability and Exposures (CVE) database by using topic
models on their description texts to find prevalent vulnerability
types and new trends semi-automatically. In our study of the
39,393 unique CVEs until the end of 2009, we identify the
following trends, given here in the form of a weather forecast:
PHP: declining, with occasional SQL injection.
Buffer Overflows: flattening out after decline.
Format Strings: in steep decline.
SQL Injection and XSS: remaining strong, and rising.
Cross-Site Request Forgery: a sleeping giant perhaps, stirring.
Application Servers: rising steeply.