Data source
National Vulnerability Database
The US National Institute of Standards and Technology publishes the National Vulnerability Database, the broadest public record of disclosed software vulnerabilities. This product uses NVD data but is not endorsed or certified by the NVD.
Provides measurements used by the linked signal.
This product uses data from the NVD but is not endorsed or certified by the NVD. We count entries and publish the results.
CVEs398763
Last 12 months98363
Previous 12 months46923
Critical in 202611%
What the data shows
Computed from every record, as of Nov 1, 2026.
- 98,363 CVEs were published in the last 12 months against 46,923 in the 12 months before: up 110%.
- 89,885 were published in 2026 by Nov 1, 2026, against 48,151 in all of 2025.
- The share rated critical moved from 10% in 2024 to 11% in 2026.
- CWE-79 is the most reported weakness since 2025, with 16,187 CVEs.
Published per year
| Year | CVEs |
|---|---|
| 2019 | 17305 |
| 2020 | 18322 |
| 2021 | 20149 |
| 2022 | 25073 |
| 2023 | 28816 |
| 2024 | 39953 |
| 2025 | 48151 |
| 2026 (to Nov 1, 2026) | 89885 |
Top weaknesses since 2025
| Weakness | CVEs |
|---|---|
| CWE-79 | 16187 |
| CWE-89 | 8045 |
| CWE-862 | 7233 |
| CWE-284 | 5738 |
| CWE-74 | 4466 |
Limitations
- It counts disclosed vulnerabilities, not exploited ones.
- More organizations can now issue CVEs, so growth partly reflects more reporting.
- Publication dates can trail discovery by a long time.