Statistics
Catalogue aggregates over time. Last sync Nov 10, 2026
Share of catalog CVEs with a current CVSS score
- CRITICAL 44,530 (11%)
- HIGH 164,361 (39%)
- MEDIUM 179,476 (43%)
- LOW 12,978 (3%)
- Unscored 20,806 (5%)
Highest current score per CVE, by CVSS version. Bars are 0 to 10.
- Score 0: 0
- Score 1: 50
- Score 2: 1,599
- Score 3: 4,754
- Score 4: 21,410
- Score 5: 47,824
- Score 6: 47,872
- Score 7: 74,142
- Score 8: 41,252
- Score 9: 38,823
- Score 10: 1,696
Latest FIRST snapshot. Bars open Browse at that floor.
- ≥ 50% 4,383 (1%)
- 10-50% 13,151 (3%)
- 1-10% 131,083 (33%)
- < 1% 253,582 (63%)
Share of catalog CVEs with scores, CPE, packages, or KEV (a CVE can be in several)
- CVSS scored 401,345 (95%)
- NVD CPE 323,424 (77%)
- MITRE CPE 256,533 (61%)
- GHSA alias 32,632 (8%)
- OSV packages 11,533 (3%)
- CISA KEV 1,773 (<1%)
- Has exploit 38,219 (9%)
Most assigned CWEs. KEV overlap in red.
- CWE-79 Cross-site Scripting (XSS) 49,692 32 KEV
- CWE-89 SQL Injection 21,668 32 KEV
- CWE-787 Out-of-bounds Write 16,562 167 KEV
- CWE-119 Buffer Overflow 15,331 68 KEV
- CWE-20 Improper Input Validation 15,074 103 KEV
- CWE-200 Exposure of Sensitive Information 12,560 21 KEV
- CWE-862 Missing Authorization 11,853 12 KEV
- CWE-125 Out-of-bounds Read 11,720 19 KEV
- CWE-22 Path Traversal 11,354 101 KEV
- CWE-416 Use After Free 10,371 111 KEV
Vendors with the most tracked CVEs
Actively exploited vulnerabilities
CVE-2026-123218 KEV
IBM Aspera Faspex Authorization Bypass
CVE-2026-123158 KEV
openssh: OpenSSH: Password authentication bypass via password hash misinterpretation
CVE-2026-116779 KEV
FreeSWITCH: Inbound SIP MESSAGE can select the api chat proto and run FreeSWITCH API commands
CVE-2026-102895 KEV
GPUStack: Authentication bypass via trusted loopback source (reverse-proxy TCP peer or X-GPUStack-Real-IP header) grants unauthenticated admin
CVE-2026-19868 KEV
An authentication enforcement vulnerability in SonicOS SSLVPN service may allow a user with valid credentials for an al…
Highest exploit probability scores
CVE-2014-0160
openssl: information disclosure in handling of TLS heartbeat extension packets
CVE-2014-3566
SSL/TLS: Padding Oracle On Downgraded Legacy Encryption attack
CVE-2014-6271
bash: specially-crafted environment variables can be used to inject shell commands
CVE-2015-1635
HTTP.sys in Microsoft Windows 7 SP1, Windows Server 2008 R2 SP1, Windows 8, Windows 8.1, and Windows Server 2012 Gold a…
CVE-2017-5638
struts2: RCE when performing file upload based on Jakarta Multipart parser