Analysis
Trends
How many vulnerabilities are published over time, how severe they are, and which bug types are growing.
Computed from the whole catalog when the site is built.
2026 so far
95,987
To 11 November
Same dates in 2025
40,948
To 11 November
Change
+134.4%
- Critical
- High
- Medium
- Low
- None or not scored
Show as table
| Period | Total | Critical | High | Medium | Low | None or not scored | Known Exploited | Exploit available |
|---|---|---|---|---|---|---|---|---|
| 2026 (incomplete) | 95,987 | 10,222 | 39,473 | 36,418 | 4,426 | 5,448 | 217 | 10,990 |
| 2025 | 48,150 | 4,094 | 17,368 | 21,304 | 2,416 | 2,968 | 197 | 7,116 |
| 2024 | 39,924 | 3,784 | 14,108 | 17,990 | 1,820 | 2,222 | 161 | 3,642 |
| 2023 | 28,847 | 2,356 | 8,135 | 11,327 | 1,336 | 5,693 | 166 | 2,278 |
| 2022 | 24,999 | 1,669 | 5,682 | 6,489 | 936 | 10,223 | 131 | 257 |
| 2021 | 20,177 | 761 | 3,578 | 3,558 | 491 | 11,789 | 215 | 29 |
| 2020 | 18,363 | 508 | 2,398 | 2,865 | 313 | 12,279 | 146 | 46 |
| 2019 | 17,308 | 226 | 1,040 | 1,267 | 110 | 14,665 | 129 | 279 |
| 2018 | 16,510 | 175 | 639 | 827 | 104 | 14,765 | 76 | 1,089 |
| 2017 | 14,642 | 136 | 224 | 62 | 9 | 14,211 | 89 | 1,179 |
| 2016 | 6,457 | 12 | 68 | 21 | 0 | 6,356 | 54 | 377 |
| 2015 | 6,494 | 20 | 48 | 11 | 2 | 6,413 | 47 | 479 |
| 2014 | 7,928 | 16 | 74 | 48 | 5 | 7,785 | 34 | 385 |
| 2013 | 5,187 | 11 | 52 | 17 | 4 | 5,103 | 35 | 195 |
| 2012 | 5,288 | 14 | 35 | 15 | 0 | 5,224 | 22 | 342 |
| 2011 | 4,150 | 4 | 25 | 8 | 0 | 4,113 | 9 | 374 |
| 2010 | 4,639 | 7 | 36 | 7 | 1 | 4,588 | 23 | 897 |
| 2009 | 5,732 | 9 | 31 | 6 | 0 | 5,686 | 14 | 1,822 |
| 2008 | 5,673 | 7 | 16 | 13 | 1 | 5,636 | 6 | 1,845 |
| 2007 | 7,211 | 18 | 11 | 8 | 0 | 7,174 | 2 | 1,455 |
| 2006 | 6,885 | 12 | 13 | 11 | 1 | 6,848 | 2 | 888 |
| 2005 | 6,708 | 4 | 7 | 15 | 1 | 6,681 | 2 | 34 |
| 2004 | 1,612 | 0 | 7 | 0 | 0 | 1,605 | 1 | 2 |
| 2003 | 1,223 | 1 | 1 | 0 | 0 | 1,221 | 1 | 3 |
| 2002 | 1,690 | 1 | 3 | 0 | 0 | 1,686 | 0 | 2 |
| 2001 | 1,323 | 0 | 1 | 0 | 0 | 1,322 | 0 | 1 |
| 2000 | 1,437 | 1 | 0 | 3 | 0 | 1,433 | 0 | 0 |
| 1999 | 320 | 3 | 12 | 2 | 1 | 302 | 0 | 0 |
- Critical
- High
- Medium
- Low
- None or not scored
Show as table
| Period | Total | Critical | High | Medium | Low | None or not scored | Known Exploited | Exploit available |
|---|---|---|---|---|---|---|---|---|
| 2026-11 (incomplete) | 6,142 | 478 | 2,603 | 2,373 | 289 | 399 | 10 | 516 |
| 2026-10 | 17,051 | 1,519 | 6,787 | 7,083 | 788 | 874 | 22 | 1,590 |
| 2026-09 | 14,929 | 1,477 | 6,247 | 5,157 | 684 | 1,364 | 32 | 1,535 |
| 2026-08 | 12,257 | 1,744 | 5,292 | 4,061 | 464 | 696 | 21 | 1,234 |
| 2026-07 | 9,759 | 1,296 | 4,161 | 3,475 | 423 | 404 | 23 | 810 |
| 2026-06 | 7,949 | 931 | 3,346 | 3,052 | 342 | 278 | 26 | 733 |
| 2026-05 | 6,933 | 667 | 2,745 | 2,511 | 320 | 690 | 23 | 933 |
| 2026-04 | 5,813 | 564 | 2,293 | 2,430 | 313 | 213 | 14 | 995 |
| 2026-03 | 6,236 | 643 | 2,600 | 2,513 | 332 | 148 | 10 | 967 |
| 2026-02 | 4,616 | 450 | 1,690 | 1,971 | 292 | 213 | 20 | 914 |
| 2026-01 | 4,302 | 453 | 1,709 | 1,792 | 179 | 169 | 16 | 763 |
| 2025-12 | 5,493 | 429 | 1,961 | 2,161 | 215 | 727 | 23 | 876 |
| 2025-11 | 3,019 | 257 | 1,052 | 1,496 | 154 | 60 | 11 | 343 |
| 2025-10 | 4,274 | 314 | 1,509 | 1,846 | 194 | 411 | 10 | 460 |
| 2025-09 | 4,319 | 297 | 1,480 | 2,060 | 219 | 263 | 16 | 658 |
| 2025-08 | 3,629 | 425 | 1,358 | 1,488 | 260 | 98 | 12 | 773 |
| 2025-07 | 3,774 | 390 | 1,507 | 1,452 | 187 | 238 | 14 | 733 |
| 2025-06 | 3,682 | 284 | 1,291 | 1,602 | 219 | 286 | 18 | 826 |
| 2025-05 | 3,980 | 347 | 1,402 | 1,688 | 197 | 346 | 19 | 830 |
| 2025-04 | 4,033 | 318 | 1,602 | 1,806 | 211 | 96 | 16 | 508 |
| 2025-03 | 4,001 | 396 | 1,506 | 1,803 | 234 | 62 | 26 | 544 |
| 2025-02 | 3,673 | 264 | 1,229 | 1,699 | 170 | 311 | 15 | 243 |
| 2025-01 | 4,273 | 373 | 1,471 | 2,203 | 156 | 70 | 17 | 322 |
| 2024-12 | 3,433 | 301 | 1,196 | 1,711 | 142 | 83 | 11 | 242 |
Counted by publication date. The most recent period is incomplete and drawn lighter.
Bug types growing and shrinking
Each bug type's share of all new vulnerabilities in 2026 so far, against the same dates in 2025. Only types with at least 200 records across both periods are compared.
Growing share
| Bug type | 2025 | 2026 | Change (points) |
|---|---|---|---|
| Memory Corruption | 11.3% | 13.7% | +2.4 |
| Improper Access Control | 2.0% | 4.3% | +2.3 |
| Authentication Issues | 1.9% | 3.5% | +1.6 |
| Insecure Direct Object Reference | 0.7% | 2.3% | +1.6 |
| Incorrect Authorization | 1.0% | 2.3% | +1.3 |
| Server-Side Request Forgery | 1.1% | 2.2% | +1.1 |
| Path Traversal | 2.2% | 3.3% | +1.0 |
| Missing Authorization | 4.2% | 5.1% | +0.9 |
| Information Disclosure | 2.1% | 2.8% | +0.7 |
| Improper Input Validation | 1.1% | 1.8% | +0.7 |
Shrinking share
| Bug type | 2025 | 2026 | Change (points) |
|---|---|---|---|
| Cross-Site Scripting | 17.6% | 8.6% | -9.0 |
| SQL Injection | 8.6% | 4.3% | -4.3 |
| Cross-Site Request Forgery | 4.0% | 1.2% | -2.8 |
| Unrestricted File Upload | 1.8% | 0.9% | -0.9 |
| Missing Release of Memory after Effective Lifetime | 0.6% | 0.2% | -0.4 |
| Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') | 1.0% | 0.6% | -0.4 |
| Incorrect Permissions | 0.5% | 0.2% | -0.3 |
| Uncontrolled Search Path Element | 0.4% | 0.2% | -0.2 |
| Stack-based Buffer Overflow | 1.0% | 0.9% | -0.1 |
| Incorrect Permission Assignment for Critical Resource | 0.3% | 0.2% | -0.1 |