What’s Vulnerable › Statistics

Vulnerability statistics

396,199 CVEs published since 1999, 1,758 of them confirmed exploited in the wild (CISA KEV). 2026 so far: 87,321 CVEs through 2026-10-27, against 39,023 in the same period of 2025. Data as of 2026-10-27.

CVEs published per year

• 2015: 6,494 (1,148 critical)
• 2016: 6,449 (895 critical)
• 2017: 14,642 (2,110 critical)
• 2018: 16,510 (2,598 critical)
• 2019: 17,305 (2,651 critical)
• 2020: 18,322 (2,746 critical)
• 2021: 20,149 (2,713 critical)
• 2022: 25,073 (4,355 critical)
• 2023: 28,816 (4,628 critical)
• 2024: 39,953 (4,997 critical)
• 2025: 48,151 (6,489 critical)
• 2026: 87,321 (10,488 critical)

2026 to date is 181.3% of the 2025 total.

Vendors with the most CVEs

1. Linux: 21,530
2. Microsoft: 18,012
3. Google: 16,639
4. Oracle: 14,205
5. Debian: 10,163
6. Apple: 9,532
7. IBM: 9,284
8. Adobe: 7,902
9. Red Hat: 7,050
10. Cisco: 7,029
11. Fedora: 5,446
12. Canonical (Ubuntu): 4,282

Vendors with the most exploited vulnerabilities (CISA KEV)

1. Microsoft: 405
2. Debian: 124
3. Cisco: 106
4. Apple: 106
5. Google: 98
6. Red Hat: 97
7. Fedora: 88
8. Oracle: 82
9. Adobe: 82
10. openSUSE: 61
11. SUSE: 50
12. Canonical (Ubuntu): 47

Products with the most CVEs in the last 12 months

1. Linux kernel: 9,314
2. Google Chrome: 3,678
3. Microsoft Windows Server 2025: 2,844
4. Apple macOS: 1,178
5. OpenClaw: 646
6. Google Android: 598
7. Mozilla Firefox: 591
8. Apple iOS: 560
9. Apple iPadOS: 559
10. Microsoft 365 Apps: 541
11. Mozilla Thunderbird: 516
12. Apple visionOS: 513

How fast vulnerabilities are exploited

Of 892 CVEs added to CISA KEV since 2023-01-01, 42.3% were listed within a week of publication and 21.2% on or before the day the CVE was published. Median: 17 days. 20.5% of all KEV entries are known to be used in ransomware campaigns.

Most common weaknesses in the last 12 months

1. CWE-79 Cross-site scripting (XSS): 8,891
2. CWE-862 Missing authorization: 4,866
3. CWE-284 Improper access control: 3,993
4. CWE-22 Path traversal: 3,055
5. CWE-89 SQL injection: 2,979
6. CWE-416 Use after free: 2,969
7. CWE-125 Out-of-bounds read: 2,319
8. CWE-74 Injection: 2,267
9. CWE-200 Sensitive information exposure: 2,109
10. CWE-20 Improper input validation: 2,079

Who publishes CVEs (last 12 months)

1. GitHub: 12,747
2. VulnCheck: 9,550
3. Linux kernel: 9,313
4. VulDB: 6,892
5. Patchstack: 6,038
6. MITRE: 4,729
7. Microsoft: 4,555
8. Wordfence: 4,388
9. Oracle: 4,154
10. Google Chrome: 3,678

Machine-readable: /api/public/stats (JSON, refreshed daily).