Skip to content
CVE Tracker

CVE statistics

What the CVEs published in the last 90 days were: how severe, which weaknesses, whose products and who assigned them.

Severity

The best CVSS score each CVE has: the assigner’s, then CISA’s, then NVD’s.

Top weaknesses

CWE named by the record or NVD; a CVE may name several.

  1. CWE-79 Cross-site scripting (XSS)3,264
  2. CWE-862 Missing authorization2,608
  3. CWE-284 Improper access control2,524
  4. CWE-416 Use after free1,551
  5. CWE-89 SQL injection1,462
  6. CWE-863 Incorrect authorization1,390
  7. CWE-22 Path traversal1,340
  8. CWE-125 Out-of-bounds read1,297
  9. CWE-200 Exposure of sensitive information1,279
  10. CWE-639 Authorization bypass through a user-controlled key (IDOR)1,197

Top vendors

Vendors named among the affected products.

  1. Linux4,836
  2. Microsoft2,949
  3. Oracle Corporation2,602
  4. Google2,190
  5. IBM1,049
  6. Red Hat706
  7. Apache Software Foundation701
  8. Apple666
  9. Mozilla520
  10. Adobe510

Top CNAs

Who assigned the CVE id: a vendor, a project or a research team.

  1. VulnCheck5,365
  2. Linux4,836
  3. GitHub_M4,264
  4. microsoft2,930
  5. oracle2,602
  6. VulDB2,354
  7. Patchstack1,976
  8. Chrome1,810
  9. WPScan1,538
  10. mitre1,348

Every number opens the CVEs behind it. The same figures are in the API as GET /v1/stats.