CVE statistics
What the CVEs published in the last 90 days were: how severe, which weaknesses, whose products and who assigned them.
- 44,927Publishedin the last 90 days
- 94%Scored2,875 have no CVSS score yet
- 70Known exploitedof them in CISA KEV now
- 107Added to KEVCVEs of any age, in this window
Severity
The best CVSS score each CVE has: the assigner’s, then CISA’s, then NVD’s.
Top weaknesses
CWE named by the record or NVD; a CVE may name several.
- CWE-79 Cross-site scripting (XSS)3,389
- CWE-862 Missing authorization2,711
- CWE-284 Improper access control2,578
- CWE-416 Use after free1,607
- CWE-89 SQL injection1,491
- CWE-863 Incorrect authorization1,432
- CWE-22 Path traversal1,362
- CWE-200 Exposure of sensitive information1,338
- CWE-125 Out-of-bounds read1,304
- CWE-639 Authorization bypass through a user-controlled key (IDOR)1,280
Top vendors
Vendors named among the affected products.
Top CNAs
Who assigned the CVE id: a vendor, a project or a research team.
Every number opens the CVEs behind it. The same figures are in the API as GET /v1/stats.