Stats

CVEs since 2017
318,879
Critical
37,193
11.7% of all CVEs
In CISA KEV
1,766
since the list began in 2021
Per day
89
average

CVEs per year · since 2017

CriticalHighMediumLowNot scored1 dot = 1,000 CVEs
2017
2018
2019
2020
2021
2022
2023
2024
2025
2026

Most affected vendors

linux18,326microsoft12,292Oracle Corporation8,870google7,484IBM5,941Adobe5,107Apple4,628

Most common weaknesses

Cross-site scripting CWE-7942,221
SQL injection CWE-8917,247
Out-of-bounds write CWE-78714,993
Missing authorization CWE-86211,362
Out-of-bounds read CWE-12510,346
Improper input validation CWE-209,674

How fast it moves

Fix listed
31%
of CVEs in this period
Disclosure to Exploit-DB
15 days
median
Disclosure to CISA KEV
265 days
median
In KEV by disclosure day
231
exploited before or at disclosure