Skip to content
CVE Tracker

CVE statistics

What the CVEs published in the last 12 months were: how severe, which weaknesses, whose products and who assigned them.

Severity

The best CVSS score each CVE has: the assigner’s, then CISA’s, then NVD’s.

Top weaknesses

CWE named by the record or NVD; a CVE may name several.

  1. CWE-79 Cross-site scripting (XSS)9,172
  2. CWE-862 Missing authorization5,636
  3. CWE-284 Improper access control4,706
  4. CWE-89 SQL injection4,596
  5. CWE-416 Use after free3,439
  6. CWE-22 Path traversal3,234
  7. CWE-125 Out-of-bounds read2,673
  8. CWE-200 Exposure of sensitive information2,480
  9. CWE-863 Incorrect authorization2,464
  10. CWE-787 Out-of-bounds write2,418

Top vendors

Vendors named among the affected products.

  1. Linux9,412
  2. Google4,657
  3. Microsoft4,629
  4. Oracle Corporation4,155
  5. IBM1,588
  6. Red Hat1,330
  7. Apache Software Foundation1,319
  8. Apple1,254
  9. Adobe1,186
  10. Mozilla894

Top CNAs

Who assigned the CVE id: a vendor, a project or a research team.

  1. GitHub_M13,092
  2. VulnCheck9,996
  3. Linux9,411
  4. VulDB6,930
  5. Patchstack6,245
  6. mitre4,669
  7. microsoft4,573
  8. Wordfence4,521
  9. oracle4,154
  10. Chrome3,967

Every number opens the CVEs behind it. The same figures are in the API as GET /v1/stats.