Analysis
How Attacks Work
What CVSS records say about reaching a flaw: over the network, without a login, and without any action by a user.
Computed from the whole catalog when the site is built.
Reachable over the network
74.8%
173,092 records
Network, no login needed
41.5%
96,104 records
Network, no login, no user action
27.9%
64,490 records
Same, and low complexity
23.9%
55,195 records
Share of 231,423 records with a CVSS v3 or v4 score. 173,441 records have only CVSS v2 or no score and are not counted.
Attack Vector
Attack Complexity
Privileges Required
User Interaction
By year
| Period | Scored records | Network, no login needed | Network, no login, no user action |
|---|---|---|---|
| 2026 | 90,624 | 45.6% | 31.5% |
| 2025 | 45,195 | 41.7% | 27.8% |
| 2024 | 37,708 | 37.8% | 24.4% |
| 2023 | 23,158 | 36.8% | 23.0% |
| 2022 | 14,778 | 38.4% | 26.9% |
| 2021 | 8,388 | 33.6% | 22.2% |
| 2020 | 6,084 | 35.3% | 22.5% |
| 2019 | 2,642 | 40.0% | 27.8% |
| 2018 | 1,744 | 41.5% | 26.8% |
| 2017 | 430 | 69.8% | 50.2% |
Vendors with the highest share
Profiled vendors with at least 200 scored records, sorted by the share reachable with no login and no user action.
| Vendor | Scored records | Network, no login needed | Network, no login, no user action |
|---|---|---|---|
| ThemeREX | 235 | 97.4% | 96.2% |
| Apache | 2,150 | 64.7% | 59.4% |
| Eclipse Foundation | 308 | 58.1% | 53.9% |
| F5 | 368 | 57.6% | 53.0% |
| Spring | 241 | 61.4% | 51.5% |
| itsourcecode | 704 | 53.6% | 49.0% |
| code-projects | 1,390 | 54.3% | 48.3% |
| PHPGurukul | 777 | 53.7% | 47.6% |
| Juniper Networks | 1,055 | 51.8% | 46.9% |
| Rockwell Automation | 293 | 50.9% | 46.4% |
| ImageMagick | 263 | 47.9% | 46.0% |
| Campcodes | 606 | 43.2% | 42.6% |
| WWBN | 346 | 60.4% | 38.7% |
| Drupal | 543 | 55.6% | 37.0% |
| siyuan-note | 220 | 54.1% | 36.8% |
| FreeRDP | 323 | 78.3% | 34.4% |
| Mozilla | 1,604 | 95.3% | 34.0% |
| Huawei | 797 | 37.5% | 33.9% |
| Gitea | 208 | 36.5% | 33.7% |
| Schneider Electric | 287 | 41.1% | 32.8% |