Neuhaus, StephanZimmermann, Thomas2010-08-132010-08-132010-08-13http://hdl.handle.net/1880/48066We study the vulnerability reports in the Common Vulnerability and Exposures (CVE) database by using topic models on their description texts to find prevalent vulnerability types and new trends semi-automatically. In our study of the 39,393 unique CVEs until the end of 2009, we identify the following trends, given here in the form of a weather forecast: PHP: declining, with occasional SQL injection. Buffer Overflows: flattening out after decline. Format Strings: in steep decline. SQL Injection and XSS: remaining strong, and rising. Cross-Site Request Forgery: a sleeping giant perhaps, stirring. Application Servers: rising steeply.engSecuritySecurity, trends, machine learningtechnical report2010-970-1910.11575/PRISM/31260