Data source
CISA Known Exploited Vulnerabilities
The US Cybersecurity and Infrastructure Security Agency lists software vulnerabilities with evidence of real-world exploitation. It is the only series here counted the same way across every year, so the Security signal uses it for its headline number.
Provides measurements used by the linked signal.
Data from the CISA Known Exploited Vulnerabilities catalog. Use does not imply endorsement by CISA or DHS. We count entries and publish the results.
Vulnerabilities1766
Last 12 months313
Previous 12 months252
Linked to ransomware361
What the data shows
Computed from every record, as of Oct 30, 2026.
- 313 vulnerabilities were added in the last 12 months, against 252 in the 12 months before: up 24%.
- 282 were added in 2026 by Oct 30, 2026, already more than the 245 added in all of 2025.
- Microsoft is the most listed vendor, with 390 entries (22% of the catalog).
- 20% of listed vulnerabilities are known to have been used in ransomware campaigns.
Added per year
| Year | Added |
|---|---|
| 2021 | 311 |
| 2022 | 555 |
| 2023 | 187 |
| 2024 | 186 |
| 2025 | 245 |
| 2026 (to Oct 30, 2026) | 282 |
Most listed vendors
| Vendor | Vulnerabilities |
|---|---|
| Microsoft | 390 |
| Cisco | 102 |
| Apple | 95 |
| Adobe | 83 |
| 76 | |
| Oracle | 46 |
| Apache | 41 |
| Ivanti | 38 |
| Linux | 32 |
| Fortinet | 32 |
Limitations
- It counts when CISA added a vulnerability, not when it was first exploited.
- It only covers vulnerabilities CISA knows about and considers actionable, so it undercounts total exploitation.
- Its first years include a bulk load of older vulnerabilities, so the trend starts in 2023.