Published CVE records from cvelistV5, rejected excluded · critical = CVSS 9.0 or higher · dates in UTC · through Nov 3, 2026 · live edition, updated daily
Last update, Nov 4: +19 new
Last 12 months
Nov 4, 2025 – Nov 3, 2026
24.9%
of all CVEs published
99,622 of 400,089 since 1999
Last 12 months
Nov 4, 2025 – Nov 3, 2026
21.9%
of all critical CVEs
10,721 of 48,994 · 10.8% of 99,622 CVEs CVSS v3/v4 only: 27.7%
Last 6 months
May 4 – Nov 3, 2026
16.3%
of all critical CVEs
7,965 of 48,994 · 11.4% of 69,871 CVEs CVSS v3/v4 only: 20.6%
Last 3 months
Aug 4 – Nov 3, 2026
10.2%
of all critical CVEs
4,977 of 48,994 · 11.0% of 45,097 CVEs CVSS v3/v4 only: 12.9%
A new CVE every
Last 30 days · Oct 5 – Nov 3, 2026
2.5 min
581 a day
A year ago: 12 min · 123 a day
A new critical CVE every
Last 30 days · Oct 5 – Nov 3, 2026
28 min
52 a day · 9.0% of all
A year ago: 2.5 hours · 9.7 a day · 7.9% of all
2026 so far
Jan 1 – Nov 3, 2026 vs the same days of 2025
+130%
more CVEs than last year
91,212 vs 39,740 by Nov 3, 2025
2026 so far, critical
Jan 1 – Nov 3, 2026 vs the same days of 2025
+192%
more critical CVEs than last year
10,052 vs 3,444 by Nov 3, 2025
Busiest day
Oct 13, 2026
2,291
CVEs in one day
166 critical
Known exploited
On CISA's KEV catalog
1.3%
of critical CVEs known exploited
624 of 48,994 · 35.3% of KEV's 1,767 With VulnCheck KEV: 4.5% · 2,221 on either
From publication to exploited
CVEs published since KEV began, Nov 3, 2021
8 days
median to a KEV listing
57.2% within 30 days · 62 before publication · 886 CVEs VulnCheck listed 69.5% of the 886 on both first, a median 6 days earlier
Wide open
Critical CVEs, last 12 months
73.8%
exploitable over the network, no login or user action
7,910 of 10,721 · AV:N/PR:N/UI:N
Every day of the last yearCVEs published per day, to Nov 3, 2026 · busiest days brightest
CVEs by month, 2026
Month
Published
Scored
Critical
Critical % of scored
Critical share
Nov (to date)
1,355
78.2%
109
10.3%
Oct
17,058
92.5%
1,570
10.0%
Sep
14,933
91.3%
1,559
11.4%
Aug
12,258
94.4%
1,815
15.7%
Jul
9,759
99.1%
1,315
13.6%
Jun
7,949
100.0%
938
11.8%
May
6,933
100.0%
680
9.8%
Apr
5,813
100.0%
574
9.9%
Mar
6,236
100.0%
644
10.3%
Feb
4,616
99.2%
419
9.1%
Jan
4,302
98.6%
429
10.1%
CVEs by year
Year
Published
Scored
Critical
Critical % of scored
Critical share
2026*
91,212
95.9%
10,052
11.5%
2025
48,150
98.1%
4,113
8.7%
2024
39,924
100.0%
3,800
9.5%
2023
28,847
100.0%
3,450
12.0%
2022
24,999
100.0%
3,784
15.1%
2021
20,177
100.0%
2,539
12.6%
2020
18,363
100.0%
2,641
14.4%
2019
17,308
100.0%
2,561
14.8%
2018
16,510
100.0%
2,530
15.3%
2017
14,642
100.0%
2,116
14.5%
2016
6,457
100.0%
893
13.8%
2015
6,494
100.0%
1,141
17.6%
2014
7,928
100.0%
790
10.0%
2013
5,187
100.0%
895
17.3%
2012
5,288
100.0%
950
18.0%
2011
4,150
100.0%
877
21.1%
2010
4,639
100.0%
1,018
21.9%
2009
5,732
100.0%
1,013
17.7%
2008
5,673
100.0%
1,007
17.8%
2007
7,211
100.0%
1,085
15.0%
2006
6,885
100.0%
427
6.2%
2005
6,708
100.0%
307
4.6%
2004
1,612
100.0%
307
19.0%
2003
1,223
100.0%
115
9.4%
2002
1,690
100.0%
127
7.5%
2001
1,323
100.0%
155
11.7%
2000
1,437
100.0%
267
18.6%
1999
320
100.0%
34
10.6%
Score: the record's own (CNA, then CISA), newest CVSS version; NVD's where the record has none. Recent critical scores are almost all from records, older ones mostly NVD's, often CVSS v2, which has no critical band; 9.0 is applied anyway. *2026 to date.
Likely to be exploited
Critical CVEs, last 12 months
2.1%
at least 10% likely to be exploited in the next 30 days
223 of 10,667 · 54 not yet scored · FIRST's EPSS of Nov 3, 2026
Severity vs likelihoodCritical CVEs, last 12 months · CVSS across, EPSS up · 10% or more
Most likely to be exploited
Critical CVEs, last 12 months · EPSS, then CVSS
CVE-2026-109618 PHP Group99.9% CVSS 9.2
CVE-2026-109619 PHP Group99.9% CVSS 9.2
CVE-2026-10520 ivanti99.9% CVSS 10.0
CVE-2026-8037 Progress Software99.8% CVSS 9.6
CVE-2026-39987 marimo-team99.7% CVSS 9.3
CVE-2025-55182 Meta99.7% CVSS 10.0
CVE-2026-21589 Atlassian99.5% CVSS 9.3
CVE-2025-68613 n8n-io99.0% CVSS 10.0
All time
Sep 29, 1999 – Nov 3, 2026
48,994
critical CVEs
of 400,089 CVEs · 98.8% scored, NVD included
This month
Nov 1 – Nov 3, 2026
0.2%
of all critical CVEs
109 of 48,994 · 8.0% of 1,355 CVEs
Last 30 days
Oct 5 – Nov 3, 2026
3.2%
of all critical CVEs
1,569 of 48,994 · 9.0% of 17,443 CVEs
Severity by yearShare of each year's scored CVEs: critical · high · medium · lowCritical share over 10 yearsCritical as a share of scored CVEs · 3-month average
Top weakness types
Critical CVEs, last 12 months · a CVE can name several
Missing authentication CWE-306756 7.1%
SQL injection CWE-89725 6.8%
OS command injection CWE-78702 6.5%
Improper access control CWE-284676 6.3%
Code injection CWE-94592 5.5%
Unsafe deserialization CWE-502517 4.8%
Improper authentication CWE-287429 4.0%
Path traversal CWE-22369 3.4%
Top vendors
Critical CVEs, last 12 months · as named in the CVE record
Oracle Corporation658 6.1%
Linux588 5.5%
Google493 4.6%
Microsoft283 2.6%
Apache Software Foundation238 2.2%
Mozilla212 2.0%
IBM185 1.7%
Totolink148 1.4%
Attack vectors
Critical CVEs, last 12 months · from the CVSS vector
Attack vector10,721
Network 97.3%Adjacent 1.1%Local 1.6%
Privileges required10,721
None 83.3%Low 12.6%High 4.1%
User interaction10,721
None 91.3%Required 7.2%Passive 1.1%Active 0.4%
Memory safety
Critical CVEs, last 12 months
13.1%
name a memory-safety weakness
1,402 of 10,721
By quarter, last 5 years
Any of CWE-119, 120, 121, 122, 125, 131, 190, 415, 416, 476, 787, 824
Weakness types by quarterShare of each quarter's critical CVEs, last 5 years to Nov 3, 2026 · a CVE can name several · brighter is higher
Last 12 months
Nov 4, 2025 – Nov 3, 2026
24.9%
of all CVEs published
99,622 of 400,089 since 1999
Last 12 months
Nov 4, 2025 – Nov 3, 2026
44.8%
of all critical CVEs
10,720 of 23,929 · 10.8% of 99,622 CVEs
Last 6 months
May 4 – Nov 3, 2026
33.3%
of all critical CVEs
7,964 of 23,929 · 11.4% of 69,871 CVEs
Last 3 months
Aug 4 – Nov 3, 2026
20.8%
of all critical CVEs
4,976 of 23,929 · 11.0% of 45,097 CVEs
A new CVE every
Last 30 days · Oct 5 – Nov 3, 2026
2.5 min
581 a day
A year ago: 12 min · 123 a day
A new critical CVE every
Last 30 days · Oct 5 – Nov 3, 2026
28 min
52 a day · 9.0% of all
A year ago: 2.5 hours · 9.7 a day · 7.9% of all
2026 so far
Jan 1 – Nov 3, 2026 vs the same days of 2025
+130%
more CVEs than last year
91,212 vs 39,740 by Nov 3, 2025
2026 so far, critical
Jan 1 – Nov 3, 2026 vs the same days of 2025
+192%
more critical CVEs than last year
10,051 vs 3,444 by Nov 3, 2025
Busiest day
Oct 13, 2026
2,291
CVEs in one day
166 critical
Known exploited
On CISA's KEV catalog
2.6%
of critical CVEs known exploited
624 of 23,929 · 35.3% of KEV's 1,767 With VulnCheck KEV: 6.4% · 1,535 on either
From publication to exploited
CVEs published since KEV began, Nov 3, 2021
8 days
median to a KEV listing
57.2% within 30 days · 62 before publication · 886 CVEs VulnCheck listed 69.5% of the 886 on both first, a median 6 days earlier
Wide open
Critical CVEs, last 12 months
73.8%
exploitable over the network, no login or user action
7,909 of 10,720 · AV:N/PR:N/UI:N
Every day of the last yearCVEs published per day, to Nov 3, 2026 · busiest days brightest
CVEs by month, 2026
Month
Published
Scored
Critical
Critical % of scored
Critical share
Nov (to date)
1,355
78.2%
109
10.3%
Oct
17,058
92.1%
1,569
10.0%
Sep
14,933
90.9%
1,559
11.5%
Aug
12,258
94.4%
1,815
15.7%
Jul
9,759
96.0%
1,315
14.0%
Jun
7,949
96.6%
938
12.2%
May
6,933
90.2%
680
10.9%
Apr
5,813
96.4%
574
10.2%
Mar
6,236
97.8%
644
10.6%
Feb
4,616
96.1%
419
9.4%
Jan
4,302
96.1%
429
10.4%
CVEs by year
Year
Published
Scored
Critical
Critical % of scored
Critical share
2026*
91,212
93.7%
10,051
11.8%
2025
48,150
93.9%
4,113
9.1%
2024
39,924
94.5%
3,794
10.1%
2023
28,847
80.3%
2,356
10.2%
2022
24,999
59.1%
1,669
11.3%
2021
20,177
41.6%
762
9.1%
2020
18,363
33.1%
508
8.3%
2019
17,308
15.3%
225
8.5%
2018
16,510
10.6%
175
10.0%
2017
14,642
2.9%
136
31.6%
2016
6,457
1.6%
12
11.9%
2015
6,494
1.2%
20
24.7%
2014
7,928
1.8%
15
10.5%
2013
5,187
1.6%
12
14.3%
2012
5,288
1.2%
14
21.9%
2011
4,150
0.9%
4
10.8%
2010
4,639
1.1%
7
13.7%
2009
5,732
0.8%
9
19.6%
2008
5,673
0.7%
7
18.9%
2007
7,211
0.5%
18
48.6%
2006
6,885
0.5%
12
32.4%
2005
6,708
0.4%
4
14.8%
2004
1,612
0.4%
0
0.0%
2003
1,223
0.2%
1
50.0%
2002
1,690
0.2%
1
25.0%
2001
1,323
0.1%
0
0.0%
2000
1,437
0.3%
1
25.0%
1999
320
5.6%
3
16.7%
Score: the record's own (CNA, then CISA), newest CVSS version, as on the charts. Few CVEs before 2018 carry one, so early years undercount. *2026 to date.
Likely to be exploited
Critical CVEs, last 12 months
2.1%
at least 10% likely to be exploited in the next 30 days
223 of 10,666 · 54 not yet scored · FIRST's EPSS of Nov 3, 2026
Severity vs likelihoodCritical CVEs, last 12 months · CVSS across, EPSS up · 10% or more
Most likely to be exploited
Critical CVEs, last 12 months · EPSS, then CVSS
CVE-2026-109618 PHP Group99.9% CVSS 9.2
CVE-2026-109619 PHP Group99.9% CVSS 9.2
CVE-2026-10520 ivanti99.9% CVSS 10.0
CVE-2026-8037 Progress Software99.8% CVSS 9.6
CVE-2026-39987 marimo-team99.7% CVSS 9.3
CVE-2025-55182 Meta99.7% CVSS 10.0
CVE-2026-21589 Atlassian99.5% CVSS 9.3
CVE-2025-68613 n8n-io99.0% CVSS 10.0
All time
Sep 29, 1999 – Nov 3, 2026
23,929
critical CVEs
of 400,089 CVEs · 56.6% scored in the record
This month
Nov 1 – Nov 3, 2026
0.5%
of all critical CVEs
109 of 23,929 · 8.0% of 1,355 CVEs
Last 30 days
Oct 5 – Nov 3, 2026
6.6%
of all critical CVEs
1,568 of 23,929 · 9.0% of 17,443 CVEs
Severity by yearShare of each year's scored CVEs: critical · high · medium · lowCritical share over 10 yearsCritical as a share of scored CVEs · 3-month average
Top weakness types
Critical CVEs, last 12 months · a CVE can name several
Missing authentication CWE-306756 7.1%
SQL injection CWE-89724 6.8%
OS command injection CWE-78702 6.5%
Improper access control CWE-284676 6.3%
Code injection CWE-94592 5.5%
Unsafe deserialization CWE-502517 4.8%
Improper authentication CWE-287429 4.0%
Path traversal CWE-22369 3.4%
Top vendors
Critical CVEs, last 12 months · as named in the CVE record
Oracle Corporation658 6.1%
Linux588 5.5%
Google493 4.6%
Microsoft283 2.6%
Apache Software Foundation237 2.2%
Mozilla212 2.0%
IBM185 1.7%
Totolink148 1.4%
Attack vectors
Critical CVEs, last 12 months · from the CVSS vector
Attack vector10,720
Network 97.3%Adjacent 1.1%Local 1.6%
Privileges required10,720
None 83.3%Low 12.6%High 4.1%
User interaction10,720
None 91.2%Required 7.2%Passive 1.1%Active 0.4%
Memory safety
Critical CVEs, last 12 months
13.1%
name a memory-safety weakness
1,402 of 10,720
By quarter, last 5 years
Any of CWE-119, 120, 121, 122, 125, 131, 190, 415, 416, 476, 787, 824
Weakness types by quarterShare of each quarter's critical CVEs, last 5 years to Nov 3, 2026 · a CVE can name several · brighter is higher