Published CVE records from cvelistV5, rejected excluded · critical = CVSS 9.0 or higher · dates in UTC · through Oct 31, 2026 · monthly edition, updated on the 1st
Last 12 months
Nov 1, 2025 – Oct 31, 2026
24.7%
of all CVEs published
98,373 of 398,738 since 1999
Last 12 months
Nov 1, 2025 – Oct 31, 2026
21.7%
of all critical CVEs
10,597 of 48,857 · 10.8% of 98,373 CVEs CVSS v3/v4 only: 27.5%
Last 6 months
May 1 – Oct 31, 2026
16.1%
of all critical CVEs
7,849 of 48,857 · 11.4% of 68,893 CVEs CVSS v3/v4 only: 20.3%
Last 3 months
Aug 1 – Oct 31, 2026
10.1%
of all critical CVEs
4,916 of 48,857 · 11.1% of 44,252 CVEs CVSS v3/v4 only: 12.7%
A new CVE every
Last 30 days · Oct 2 – Oct 31, 2026
2.6 min
556 a day
A year ago: 11 min · 134 a day
A new critical CVE every
Last 30 days · Oct 2 – Oct 31, 2026
29 min
50 a day · 8.9% of all
A year ago: 2.3 hours · 10 a day · 7.7% of all
2026 so far
Jan 1 – Oct 31, 2026 vs the same days of 2025
+127%
more CVEs than last year
89,860 vs 39,638 by Oct 31, 2025
2026 so far, critical
Jan 1 – Oct 31, 2026 vs the same days of 2025
+189%
more critical CVEs than last year
9,915 vs 3,431 by Oct 31, 2025
Busiest day
Oct 13, 2026
2,291
CVEs in one day
166 critical
Known exploited
On CISA's KEV catalog
1.3%
of critical CVEs known exploited
624 of 48,857 · 35.3% of KEV's 1,766 With VulnCheck KEV: 4.5% · 2,209 on either
From publication to exploited
CVEs published since KEV began, Nov 3, 2021
8 days
median to a KEV listing
57.2% within 30 days · 61 before publication · 884 CVEs VulnCheck listed 69.5% of the 884 on both first, a median 6 days earlier
Wide open
Critical CVEs, last 12 months
74.0%
exploitable over the network, no login or user action
7,845 of 10,597 · AV:N/PR:N/UI:N
Every day of the last yearCVEs published per day, to Oct 31, 2026 · busiest days brightest
CVEs by month, 2026
Month
Published
Scored
Critical
Critical % of scored
Critical share
Oct
17,060
90.8%
1,541
9.9%
Sep
14,934
91.3%
1,560
11.4%
Aug
12,258
94.4%
1,815
15.7%
Jul
9,759
99.1%
1,315
13.6%
Jun
7,949
100.0%
938
11.8%
May
6,933
100.0%
680
9.8%
Apr
5,813
100.0%
574
9.9%
Mar
6,236
100.0%
644
10.3%
Feb
4,616
99.2%
419
9.1%
Jan
4,302
98.6%
429
10.1%
CVEs by year
Year
Published
Scored
Critical
Critical % of scored
Critical share
2026*
89,860
95.8%
9,915
11.5%
2025
48,151
98.1%
4,113
8.7%
2024
39,924
100.0%
3,800
9.5%
2023
28,847
100.0%
3,450
12.0%
2022
24,999
100.0%
3,784
15.1%
2021
20,177
100.0%
2,539
12.6%
2020
18,363
100.0%
2,641
14.4%
2019
17,308
100.0%
2,561
14.8%
2018
16,510
100.0%
2,530
15.3%
2017
14,642
100.0%
2,116
14.5%
2016
6,457
100.0%
893
13.8%
2015
6,494
100.0%
1,141
17.6%
2014
7,928
100.0%
790
10.0%
2013
5,187
100.0%
895
17.3%
2012
5,288
100.0%
950
18.0%
2011
4,150
100.0%
877
21.1%
2010
4,639
100.0%
1,018
21.9%
2009
5,732
100.0%
1,013
17.7%
2008
5,673
100.0%
1,007
17.8%
2007
7,211
100.0%
1,085
15.0%
2006
6,885
100.0%
427
6.2%
2005
6,708
100.0%
307
4.6%
2004
1,612
100.0%
307
19.0%
2003
1,223
100.0%
115
9.4%
2002
1,690
100.0%
127
7.5%
2001
1,323
100.0%
155
11.7%
2000
1,437
100.0%
267
18.6%
1999
320
100.0%
34
10.6%
Score: the record's own (CNA, then CISA), newest CVSS version; NVD's where the record has none. Recent critical scores are almost all from records, older ones mostly NVD's, often CVSS v2, which has no critical band; 9.0 is applied anyway. *2026 to date.
Likely to be exploited
Critical CVEs, last 12 months
2.1%
at least 10% likely to be exploited in the next 30 days
225 of 10,594 · 3 not yet scored · FIRST's EPSS of Oct 31, 2026
Severity vs likelihoodCritical CVEs, last 12 months · CVSS across, EPSS up · 10% or more
Most likely to be exploited
Critical CVEs, last 12 months · EPSS, then CVSS
CVE-2026-109618 PHP Group99.9% CVSS 9.2
CVE-2026-109619 PHP Group99.9% CVSS 9.2
CVE-2026-10520 ivanti99.9% CVSS 10.0
CVE-2025-55182 Meta99.8% CVSS 10.0
CVE-2026-8037 Progress Software99.8% CVSS 9.6
CVE-2026-39987 marimo-team99.6% CVSS 9.3
CVE-2026-21589 Atlassian99.5% CVSS 9.3
CVE-2025-68613 n8n-io99.0% CVSS 10.0
All time
Sep 29, 1999 – Oct 31, 2026
48,857
critical CVEs
of 398,738 CVEs · 98.8% scored, NVD included
This month
Oct 1 – Oct 31, 2026
3.2%
of all critical CVEs
1,541 of 48,857 · 9.0% of 17,060 CVEs
Last 30 days
Oct 2 – Oct 31, 2026
3.0%
of all critical CVEs
1,489 of 48,857 · 8.9% of 16,666 CVEs
Severity by yearShare of each year's scored CVEs: critical · high · medium · lowCritical share over 10 yearsCritical as a share of scored CVEs · 3-month average
Top weakness types
Critical CVEs, last 12 months · a CVE can name several
Missing authentication CWE-306753 7.1%
SQL injection CWE-89726 6.9%
OS command injection CWE-78685 6.5%
Improper access control CWE-284673 6.4%
Code injection CWE-94583 5.5%
Unsafe deserialization CWE-502514 4.9%
Improper authentication CWE-287423 4.0%
Path traversal CWE-22357 3.4%
Top vendors
Critical CVEs, last 12 months · as named in the CVE record
Oracle Corporation658 6.2%
Linux588 5.5%
Google465 4.4%
Microsoft283 2.7%
Apache Software Foundation236 2.2%
Mozilla212 2.0%
IBM185 1.7%
Totolink148 1.4%
Attack vectors
Critical CVEs, last 12 months · from the CVSS vector
Attack vector10,597
Network 97.3%Adjacent 1.1%Local 1.6%
Privileges required10,597
None 83.3%Low 12.6%High 4.1%
User interaction10,597
None 91.4%Required 7.0%Passive 1.1%Active 0.4%
Memory safety
Critical CVEs, last 12 months
13.1%
name a memory-safety weakness
1,383 of 10,597
By quarter, last 5 years
Any of CWE-119, 120, 121, 122, 125, 131, 190, 415, 416, 476, 787, 824
Weakness types by quarterShare of each quarter's critical CVEs, last 5 years to Oct 31, 2026 · a CVE can name several · brighter is higher
Last 12 months
Nov 1, 2025 – Oct 31, 2026
24.7%
of all CVEs published
98,373 of 398,738 since 1999
Last 12 months
Nov 1, 2025 – Oct 31, 2026
44.5%
of all critical CVEs
10,597 of 23,793 · 10.8% of 98,373 CVEs
Last 6 months
May 1 – Oct 31, 2026
33.0%
of all critical CVEs
7,849 of 23,793 · 11.4% of 68,893 CVEs
Last 3 months
Aug 1 – Oct 31, 2026
20.7%
of all critical CVEs
4,916 of 23,793 · 11.1% of 44,252 CVEs
A new CVE every
Last 30 days · Oct 2 – Oct 31, 2026
2.6 min
556 a day
A year ago: 11 min · 134 a day
A new critical CVE every
Last 30 days · Oct 2 – Oct 31, 2026
29 min
50 a day · 8.9% of all
A year ago: 2.3 hours · 10 a day · 7.7% of all
2026 so far
Jan 1 – Oct 31, 2026 vs the same days of 2025
+127%
more CVEs than last year
89,860 vs 39,638 by Oct 31, 2025
2026 so far, critical
Jan 1 – Oct 31, 2026 vs the same days of 2025
+189%
more critical CVEs than last year
9,915 vs 3,431 by Oct 31, 2025
Busiest day
Oct 13, 2026
2,291
CVEs in one day
166 critical
Known exploited
On CISA's KEV catalog
2.6%
of critical CVEs known exploited
624 of 23,793 · 35.3% of KEV's 1,766 With VulnCheck KEV: 6.4% · 1,525 on either
From publication to exploited
CVEs published since KEV began, Nov 3, 2021
8 days
median to a KEV listing
57.2% within 30 days · 61 before publication · 884 CVEs VulnCheck listed 69.5% of the 884 on both first, a median 6 days earlier
Wide open
Critical CVEs, last 12 months
74.0%
exploitable over the network, no login or user action
7,845 of 10,597 · AV:N/PR:N/UI:N
Every day of the last yearCVEs published per day, to Oct 31, 2026 · busiest days brightest
CVEs by month, 2026
Month
Published
Scored
Critical
Critical % of scored
Critical share
Oct
17,060
90.8%
1,541
9.9%
Sep
14,934
90.9%
1,560
11.5%
Aug
12,258
94.4%
1,815
15.7%
Jul
9,759
96.0%
1,315
14.0%
Jun
7,949
96.6%
938
12.2%
May
6,933
90.2%
680
10.9%
Apr
5,813
96.4%
574
10.2%
Mar
6,236
97.8%
644
10.6%
Feb
4,616
96.1%
419
9.4%
Jan
4,302
96.1%
429
10.4%
CVEs by year
Year
Published
Scored
Critical
Critical % of scored
Critical share
2026*
89,860
93.7%
9,915
11.8%
2025
48,151
93.9%
4,113
9.1%
2024
39,924
94.5%
3,794
10.1%
2023
28,847
80.3%
2,356
10.2%
2022
24,999
59.1%
1,669
11.3%
2021
20,177
41.6%
762
9.1%
2020
18,363
33.1%
508
8.3%
2019
17,308
15.3%
225
8.5%
2018
16,510
10.6%
175
10.0%
2017
14,642
2.9%
136
31.6%
2016
6,457
1.6%
12
11.9%
2015
6,494
1.2%
20
24.7%
2014
7,928
1.8%
15
10.5%
2013
5,187
1.6%
12
14.3%
2012
5,288
1.2%
14
21.9%
2011
4,150
0.9%
4
10.8%
2010
4,639
1.1%
7
13.7%
2009
5,732
0.8%
9
19.6%
2008
5,673
0.7%
7
18.9%
2007
7,211
0.5%
18
48.6%
2006
6,885
0.5%
12
32.4%
2005
6,708
0.4%
4
14.8%
2004
1,612
0.4%
0
0.0%
2003
1,223
0.2%
1
50.0%
2002
1,690
0.2%
1
25.0%
2001
1,323
0.1%
0
0.0%
2000
1,437
0.3%
1
25.0%
1999
320
5.6%
3
16.7%
Score: the record's own (CNA, then CISA), newest CVSS version, as on the charts. Few CVEs before 2018 carry one, so early years undercount. *2026 to date.
Likely to be exploited
Critical CVEs, last 12 months
2.1%
at least 10% likely to be exploited in the next 30 days
225 of 10,594 · 3 not yet scored · FIRST's EPSS of Oct 31, 2026
Severity vs likelihoodCritical CVEs, last 12 months · CVSS across, EPSS up · 10% or more
Most likely to be exploited
Critical CVEs, last 12 months · EPSS, then CVSS
CVE-2026-109618 PHP Group99.9% CVSS 9.2
CVE-2026-109619 PHP Group99.9% CVSS 9.2
CVE-2026-10520 ivanti99.9% CVSS 10.0
CVE-2025-55182 Meta99.8% CVSS 10.0
CVE-2026-8037 Progress Software99.8% CVSS 9.6
CVE-2026-39987 marimo-team99.6% CVSS 9.3
CVE-2026-21589 Atlassian99.5% CVSS 9.3
CVE-2025-68613 n8n-io99.0% CVSS 10.0
All time
Sep 29, 1999 – Oct 31, 2026
23,793
critical CVEs
of 398,738 CVEs · 56.5% scored in the record
This month
Oct 1 – Oct 31, 2026
6.5%
of all critical CVEs
1,541 of 23,793 · 9.0% of 17,060 CVEs
Last 30 days
Oct 2 – Oct 31, 2026
6.3%
of all critical CVEs
1,489 of 23,793 · 8.9% of 16,666 CVEs
Severity by yearShare of each year's scored CVEs: critical · high · medium · lowCritical share over 10 yearsCritical as a share of scored CVEs · 3-month average
Top weakness types
Critical CVEs, last 12 months · a CVE can name several
Missing authentication CWE-306753 7.1%
SQL injection CWE-89726 6.9%
OS command injection CWE-78685 6.5%
Improper access control CWE-284673 6.4%
Code injection CWE-94583 5.5%
Unsafe deserialization CWE-502514 4.9%
Improper authentication CWE-287423 4.0%
Path traversal CWE-22357 3.4%
Top vendors
Critical CVEs, last 12 months · as named in the CVE record
Oracle Corporation658 6.2%
Linux588 5.5%
Google465 4.4%
Microsoft283 2.7%
Apache Software Foundation236 2.2%
Mozilla212 2.0%
IBM185 1.7%
Totolink148 1.4%
Attack vectors
Critical CVEs, last 12 months · from the CVSS vector
Attack vector10,597
Network 97.3%Adjacent 1.1%Local 1.6%
Privileges required10,597
None 83.3%Low 12.6%High 4.1%
User interaction10,597
None 91.4%Required 7.0%Passive 1.1%Active 0.4%
Memory safety
Critical CVEs, last 12 months
13.1%
name a memory-safety weakness
1,383 of 10,597
By quarter, last 5 years
Any of CWE-119, 120, 121, 122, 125, 131, 190, 415, 416, 476, 787, 824
Weakness types by quarterShare of each quarter's critical CVEs, last 5 years to Oct 31, 2026 · a CVE can name several · brighter is higher