Skip to content
CVE Tracker

CVE statistics

What the CVEs published in the last 30 days were: how severe, which weaknesses, whose products and who assigned them.

Severity

The best CVSS score each CVE has: the assigner’s, then CISA’s, then NVD’s.

Top weaknesses

CWE named by the record or NVD; a CVE may name several.

  1. CWE-79 Cross-site scripting (XSS)1,303
  2. CWE-862 Missing authorization1,213
  3. CWE-416 Use after free813
  4. CWE-284 Improper access control724
  5. CWE-125 Out-of-bounds read635
  6. CWE-863 Incorrect authorization628
  7. CWE-200 Exposure of sensitive information569
  8. CWE-89 SQL injection527
  9. CWE-639 Authorization bypass through a user-controlled key (IDOR)488
  10. CWE-22 Path traversal487

Top vendors

Vendors named among the affected products.

  1. Microsoft1,485
  2. Google1,117
  3. Linux1,104
  4. Oracle Corporation1,078
  5. Apple375
  6. IBM287
  7. Apache Software Foundation280
  8. Mozilla270
  9. Red Hat228
  10. Adobe192

Top CNAs

Who assigned the CVE id: a vendor, a project or a research team.

  1. VulnCheck2,489
  2. GitHub_M1,524
  3. microsoft1,474
  4. Linux1,104
  5. oracle1,078
  6. Patchstack1,024
  7. Chrome936
  8. VulDB774
  9. Wordfence544
  10. WPScan517

Every number opens the CVEs behind it. The same figures are in the API as GET /v1/stats.