Vulnerability trends
How vulnerabilities, and the ones known to be exploited, are changing year on year.
Updated every few hours. Page built 13 October 2026, 11:22 UTC; sources last refreshed: NVD 13 October 2026, 11:16 UTC, CISA KEV 13 October 2026, 11:12 UTC. How these are counted
- CVEs published in 2026 so far
- 77,847
- up 110% on the same dates of 2025 (36,988)
- Added to CISA KEV in 2026 so far
- 255
- up 29% on the same dates of 2025 (197)
- Median NVD publication to KEV
- 15 days
- 2026 so far; 26 days in 2025
- Added within 30 days of NVD publication
- 56%
- of 2026's additions so far; 51% in 2025
cves published per year
all CVEs cves published per year7 times as many CVEs in 2025 as in 2016, and 2026 has already passed 2025's total.
CVEs NVD published each year, by severity. Starts in 2016, when CVSS v3 (the first version with a Critical rating) came into use; 2026 is so far, with a line where 2025 stood on the same date.
- Critical
- High
- Medium
- Low
- None (0.0)
- No score
- 2025 by the same date
| Year | CVEs | Critical | High | Medium | Low | None (0.0) | No score |
|---|---|---|---|---|---|---|---|
| 2016 | 6,449 | 887 | 2,895 | 2,446 | 221 | 0 | 0 |
| 2017 | 14,642 | 2,111 | 6,595 | 5,700 | 236 | 0 | 0 |
| 2018 | 16,510 | 2,597 | 7,542 | 6,203 | 168 | 0 | 0 |
| 2019 | 17,305 | 2,635 | 7,209 | 7,150 | 311 | 0 | 0 |
| 2020 | 18,322 | 2,706 | 7,678 | 7,513 | 425 | 0 | 0 |
| 2021 | 20,149 | 2,666 | 8,554 | 8,488 | 441 | 0 | 0 |
| 2022 | 25,073 | 4,247 | 10,151 | 10,178 | 495 | 0 | 2 |
| 2023 | 28,816 | 4,628 | 10,952 | 12,814 | 421 | 0 | 1 |
| 2024 | 39,953 | 4,997 | 14,484 | 19,635 | 828 | 1 | 8 |
| 2025 | 48,152 | 6,490 | 17,024 | 22,496 | 1,238 | 7 | 897 |
| 2026 so far | 77,847 | 9,766 | 32,512 | 30,315 | 2,736 | 28 | 2,490 |
what kind of mistakes
Memory safety fell from 30% of CVEs in 2016 to 15% in 2025; injection rose from 3.3% to 15%.
Share of each year's classified CVEs (those with a weakness, or CWE) in five families of weaknesses. A CVE can be in more than one; the families are listed under how these are counted.
- Memory safety 16%
- Cross-site scripting 9.8%
- Access control 20%
- Injection 11%
- Path traversal 4%
- 2026 so far
| Year | Classified CVEs | Memory safety | Cross-site scripting | Access control | Injection | Path traversal |
|---|---|---|---|---|---|---|
| 2016 | 5,373 | 30% | 8.8% | 8.8% | 3.3% | 1.5% |
| 2017 | 12,979 | 31% | 11% | 5% | 6.6% | 2.1% |
| 2018 | 14,644 | 28% | 14% | 4.4% | 7.2% | 3.9% |
| 2019 | 15,045 | 24% | 16% | 6.7% | 8.3% | 3.2% |
| 2020 | 14,667 | 22% | 15% | 8.1% | 8.8% | 3% |
| 2021 | 17,097 | 24% | 16% | 7.3% | 9.7% | 3.2% |
| 2022 | 22,149 | 23% | 15% | 8.7% | 13% | 3.4% |
| 2023 | 26,507 | 19% | 18% | 9.6% | 13% | 3% |
| 2024 | 37,919 | 20% | 19% | 11% | 12% | 3% |
| 2025 | 44,991 | 15% | 18% | 12% | 15% | 2.9% |
| 2026 so far | 71,938 | 16% | 9.8% | 20% | 11% | 4% |
added to kev per quarter
whole KEV catalogue added to kev per quarter2026 has already passed all of 2025's 245 KEV additions.
Vulnerabilities CISA added to its Known Exploited Vulnerabilities (KEV) catalogue each quarter, whatever year they were published. 2022 is greyed: the catalogue spent it catching up on older flaws. The date is catalogue admission, not when exploitation began.
| Quarter | Added to KEV |
|---|---|
| 2022 Q1 | 298 |
| 2022 Q2 | 176 |
| 2022 Q3 | 50 |
| 2022 Q4 | 31 |
| 2023 Q1 | 37 |
| 2023 Q2 | 60 |
| 2023 Q3 | 43 |
| 2023 Q4 | 47 |
| 2024 Q1 | 40 |
| 2024 Q2 | 33 |
| 2024 Q3 | 58 |
| 2024 Q4 | 55 |
| 2025 Q1 | 73 |
| 2025 Q2 | 59 |
| 2025 Q3 | 51 |
| 2025 Q4 | 62 |
| 2026 Q1 | 71 |
| 2026 Q2 | 75 |
| 2026 Q3 | 100 |
| 2026 Q4 so far | 9 |
how old are the vulnerabilities added to kev
56% of 2026's additions so far came within 30 days of NVD publication, and 9% were more than five years old.
Each year's KEV additions by the interval between NVD publication and KEV addition. Neither date marks when exploitation began, and NVD publication isn't always the first public disclosure.
- On or before NVD publication
- 1–30 days
- 31–365 days
- 366 days to 5 years
- Over 5 years
| Year | Added to KEV | On or before NVD publication | 1–30 days | 31–365 days | 366 days to 5 years | Over 5 years | Median days |
|---|---|---|---|---|---|---|---|
| 2023 | 187 | 44 | 59 | 38 | 30 | 16 | 12 |
| 2024 | 186 | 40 | 55 | 46 | 29 | 16 | 22 |
| 2025 | 245 | 49 | 77 | 63 | 32 | 24 | 26 |
| 2026 so far | 255 | 52 | 91 | 62 | 27 | 23 | 15 |
vendors cisa names most
Microsoft has the most additions every year; Cisco went from 8 to 18 in 2026 so far.
KEV additions per year for the 8 vendors CISA names most since 2023, by CISA's own attribution (one vendor per entry). A count of catalogue entries, not of attacks.
| Vendor | 2023 | 2024 | 2025 | 2026 so far |
|---|---|---|---|---|
| Microsoft | 27 | 36 | 39 | 39 |
| Apple | 21 | 7 | 9 | 9 |
| Cisco | 7 | 6 | 8 | 18 |
| 7 | 9 | 7 | 8 | |
| Ivanti | 3 | 11 | 7 | 5 |
| Adobe | 6 | 8 | 3 | 6 |
| Fortinet | 2 | 4 | 8 | 8 |
| Linux | 3 | 4 | 7 | 8 |
How these are counted
- CVEs are counted by NVD publication date from 2016; rejected ones aren't counted. Severity is the CVSS rating selected from each record: version 3.1 first, then 4.0, 3.0 and 2.0, and within a version the assessment marked Primary if there is one, otherwise the first listed, which can come from NVD, the CVE's publisher (its CNA) or another contributor. "None (0.0)" is a score of zero; "No score" means no assessment yet.
- Weakness families, as shares of the CVEs that have at least one CWE: Memory safety (CWE-787, CWE-125, CWE-416, CWE-119, CWE-120, CWE-121, CWE-122, CWE-415, CWE-476, CWE-190); Cross-site scripting (CWE-79); Access control (CWE-862, CWE-863, CWE-285, CWE-284, CWE-639, CWE-287, CWE-306); Injection (CWE-89, CWE-78, CWE-77, CWE-94, CWE-917, CWE-1336); Path traversal (CWE-22, CWE-23, CWE-35).
- KEV additions are counted by the date CISA added them, which is catalogue admission, not when exploitation began, whatever year the CVE was published. The catalogue started in late 2021 and spent 2022 mostly catching up on older flaws, so its figures are compared from 2023.
- KEV vendors follow CISA's attribution, one per entry.
- The current year is shown so far and compared with the same dates of the year before. Early in a year, headlines describe the last full year.
- Everything is built from the latest source records, so past figures can move slightly as the sources correct or enrich them.