Statistics

Catalogue aggregates over time. Last sync Oct 24, 2026

Total

414,120

TodayOct 24th

19

7 days

4,689 -15%

30 days

17,013 +16%

CISA KEV

1,756

Has exploit

37,907

Critical

43,690

Published over time

Published by day

By severity

Share of catalog CVEs with a current CVSS score

CVSS score distribution

Highest current score per CVE, by CVSS version. Bars are 0 to 10.

EPSS distribution

Latest FIRST snapshot. Bars open Browse at that floor.

Source coverage

Share of catalog CVEs with scores, CPE, packages, or KEV (a CVE can be in several)

CVSS scored 393,741 (95%)
NVD CPE 320,093 (77%)
MITRE CPE 249,268 (60%)
GHSA alias 32,251 (8%)
OSV packages 11,325 (3%)
CISA KEV 1,756 (<1%)
Has exploit 37,907 (9%)

Top weaknesses

Most assigned CWEs. KEV overlap in red.

CWE-79 Cross-site Scripting (XSS) 48,952 32 KEV
CWE-89 SQL Injection 21,440 32 KEV
CWE-787 Out-of-bounds Write 16,142 165 KEV
CWE-119 Buffer Overflow 15,206 68 KEV
CWE-20 Improper Input Validation 14,904 103 KEV
CWE-200 Exposure of Sensitive Information 12,120 21 KEV
CWE-125 Out-of-bounds Read 11,480 19 KEV
CWE-862 Missing Authorization 11,248 12 KEV
CWE-22 Path Traversal 11,073 100 KEV
CWE-416 Use After Free 10,030 109 KEV

Top ecosystems

Package ecosystems with the most tracked CVEs

npm 6,507
Go 4,829
Maven 69
NuGet 59
Packagist 54
RubyGems 53
PyPI 50
crates.io 30
SwiftURL 4
GitHub Actions 3
Hex 3
1
Pub 1

Top vendors

Vendors with the most tracked CVEs

Top products

Products with the most tracked CVEs

Recent KEV additions

Actively exploited vulnerabilities

CVE-2026-114625 KEV

Security Advisory 0199

CVE-2026-110447 KEV

Collabora Online Built-in CODE Server before 26.4.303 (richdocumentscode), a Nextcloud app, allows remote code executio…

CVE-2026-96656 KEV

Plex Media Server arbitrary file write

CVE-2026-96655 KEV

Plex Media Server arbitrary-host SSRF

CVE-2026-96654 KEV

Plex Media Server URL injection

Highest EPSS

Highest exploit probability scores

Browse high EPSS

CVE-2014-0160

openssl: information disclosure in handling of TLS heartbeat extension packets

CVE-2014-3566

SSL/TLS: Padding Oracle On Downgraded Legacy Encryption attack

CVE-2014-6271

bash: specially-crafted environment variables can be used to inject shell commands

CVE-2015-1635

HTTP.sys in Microsoft Windows 7 SP1, Windows Server 2008 R2 SP1, Windows 8, Windows 8.1, and Windows Server 2012 Gold a…

CVE-2017-5638

struts2: RCE when performing file upload based on Jakarta Multipart parser