CVE statistics
What the CVEs published in the last 12 months were: how severe, which weaknesses, whose products and who assigned them.
- 100,900Publishedin the last 12 months
- 96%Scored4,036 have no CVSS score yet
- 238Known exploitedof them in CISA KEV now
- 314Added to KEVCVEs of any age, in this window
Severity
The best CVSS score each CVE has: the assigner’s, then CISA’s, then NVD’s.
Top weaknesses
CWE named by the record or NVD; a CVE may name several.
- CWE-79 Cross-site scripting (XSS)9,300
- CWE-862 Missing authorization5,775
- CWE-284 Improper access control4,784
- CWE-89 SQL injection4,631
- CWE-416 Use after free3,549
- CWE-22 Path traversal3,298
- CWE-125 Out-of-bounds read2,707
- CWE-200 Exposure of sensitive information2,572
- CWE-863 Incorrect authorization2,531
- CWE-787 Out-of-bounds write2,448
Top vendors
Vendors named among the affected products.
Top CNAs
Who assigned the CVE id: a vendor, a project or a research team.
Every number opens the CVEs behind it. The same figures are in the API as GET /v1/stats.