48,152 CVEs in 2025.
7.4× the number ten years earlier.
Every published CVE since 1999, counted by year: how many, how fast it is growing, how 2026 compares so far, how severe they are and who issues them.
Data from the NVD and CISA, as of 15 October 2026. How we count.
- Published in 2025
- 48,152
- +20.5% vs 2024
- 2026 to 15 Oct
- 81,062
- +115.8% vs same period 2025
- Published since 1999
- 389,262
- rejected CVEs excluded
- Known exploited (CISA KEV)
- 1,746
- 245 added in 2025
Scan the years
Drag through 1999 to 2026, or press play, and watch the program grow from under a thousand CVEs a year to tens of thousands.
- vs previous year
- +20.5%
- per day
- 131.9
- rank
- #1 of 27
- added to KEV
- 245
- largest new issuer
- WordPress plugin CNAs11,053
- Critical 20%
- High 30%
- Medium 48%
- Low 1%
of NVD-scored CVEs · 65% not scored by NVD
CVEs published per year
894 CVEs were published in 1999, the first year of the program. 2025 closed at 48,152, 7.4 times 2015. The single largest jump was 2024: +11,137 CVEs (+38.6%) on the year before. At 2025's pace, a new CVE is published roughly every 11 minutes.
The striped 2026 column is the year so far, to 15 October 2026; it is not a full year and is compared fairly in the next section.
* 2026 to 15 Oct. Hover a column for its exact count and change.
| Year | CVEs published | Change | Change % | Per day | Added to KEV |
|---|---|---|---|---|---|
| 2026 (to 15 Oct) | 81,062 | — | — | 281.5 | 262 |
| 2025 | 48,152 | +8,199 | +20.5% | 131.9 | 245 |
| 2024 | 39,953 | +11,137 | +38.6% | 109.2 | 186 |
| 2023 | 28,816 | +3,743 | +14.9% | 78.9 | 187 |
| 2022 | 25,073 | +4,924 | +24.4% | 68.7 | 555 |
| 2021 | 20,149 | +1,827 | +10.0% | 55.2 | 311 |
| 2020 | 18,322 | +1,017 | +5.9% | 50.1 | — |
| 2019 | 17,305 | +795 | +4.8% | 47.4 | — |
| 2018 | 16,510 | +1,868 | +12.8% | 45.2 | — |
| 2017 | 14,642 | +8,193 | +127.0% | 40.1 | — |
| 2016 | 6,449 | −45 | −0.7% | 17.6 | — |
| 2015 | 6,494 | −1,434 | −18.1% | 17.8 | — |
| 2014 | 7,928 | +2,741 | +52.8% | 21.7 | — |
| 2013 | 5,187 | −101 | −1.9% | 14.2 | — |
| 2012 | 5,288 | +1,138 | +27.4% | 14.4 | — |
| 2011 | 4,150 | −489 | −10.5% | 11.4 | — |
| 2010 | 4,639 | −1,093 | −19.1% | 12.7 | — |
| 2009 | 5,732 | +100 | +1.8% | 15.7 | — |
| 2008 | 5,632 | −884 | −13.6% | 15.4 | — |
| 2007 | 6,516 | −92 | −1.4% | 17.9 | — |
| 2006 | 6,608 | +1,676 | +34.0% | 18.1 | — |
| 2005 | 4,932 | +2,481 | +101.2% | 13.5 | — |
| 2004 | 2,451 | +924 | +60.5% | 6.7 | — |
| 2003 | 1,527 | −629 | −29.2% | 4.2 | — |
| 2002 | 2,156 | +480 | +28.6% | 5.9 | — |
| 2001 | 1,676 | +657 | +64.5% | 4.6 | — |
| 2000 | 1,019 | +125 | +14.0% | 2.8 | — |
| 1999 | 894 | — | — | 2.4 | — |
The KEV catalog started in November 2021, so earlier years show a dash.
2026 against the same period of previous years
Comparing a part-year with full years makes any year look quiet, so each column here counts the same window: 1 January to 15 Oct. In that window 2026 has 81,062 CVEs, against 37,567 in 2025: +115.8%. The pace has also been rising through the year rather than arriving in one burst: see the monthly chart below.
Tens of thousands a year. How many touch what you run?
Free, no account needed to look.
Month by month, last three years
Monthly volume is lumpy: large vendors publish in batches on fixed patch days, and a single issuer clearing a backlog can move a month by thousands. The busiest month on record was September 2026, with 14,939 CVEs. The current, unfinished month is left out.
- 2024
- 2025
- 2026
How severe are they?
Each year's CVEs by the CVSS v3 severity NVD's analysts assigned. Of the 2025 CVEs NVD has scored, 20.2% are critical and 30.0% high, so about 50% land in the two bands most teams treat as urgent. That is why severity alone cannot set patch order: it measures potential impact, not likelihood. Exploitation data (KEV, EPSS) is what narrows the list.
The grey band is CVEs NVD has not scored. It was a sliver until 2023 and is now most of each year (65% of 2025): NVD's analysis has not kept pace with publication since early 2024. Many of these CVEs do carry a CVSS score from the organisation that issued them, which this count, like NVD's own severity filter, does not include.
| Year | Critical | High | Medium | Low | Not scored by NVD |
|---|---|---|---|---|---|
| 2026* | 2,187 (3%) | 5,368 (7%) | 6,607 (8%) | 262 (0%) | 66,638 (82%) |
| 2025 | 3,365 (7%) | 4,992 (10%) | 8,081 (17%) | 227 (0%) | 31,487 (65%) |
| 2024 | 3,037 (8%) | 8,256 (21%) | 11,490 (29%) | 371 (1%) | 16,799 (42%) |
| 2023 | 4,396 (15%) | 9,898 (34%) | 11,861 (41%) | 370 (1%) | 2,291 (8%) |
| 2022 | 4,153 (17%) | 9,195 (37%) | 9,381 (37%) | 427 (2%) | 1,917 (8%) |
| 2021 | 2,545 (13%) | 7,454 (37%) | 7,822 (39%) | 356 (2%) | 1,972 (10%) |
| 2020 | 2,681 (15%) | 7,283 (40%) | 7,226 (39%) | 399 (2%) | 733 (4%) |
| 2019 | 2,625 (15%) | 7,130 (41%) | 7,075 (41%) | 310 (2%) | 165 (1%) |
| 2018 | 2,596 (16%) | 7,542 (46%) | 6,198 (38%) | 167 (1%) | 7 (0%) |
| 2017 | 2,110 (14%) | 6,602 (45%) | 5,697 (39%) | 229 (2%) | 4 (0%) |
Percentages in the table are of all CVEs published that year. The shares quoted above are of the CVEs NVD has scored.
Who issues the CVEs
A CVE is published by a CNA, a CVE Numbering Authority: a vendor, a security firm, or MITRE as the catch-all. The growth since 2022 is largely a story of new, very prolific CNAs rather than of software suddenly getting worse.
The Linux kernel project became a CNA in 2024 and now assigns a CVE to most fixes it backports to stable branches; it published 5,675 CVEs in 2025. WordPress plugin specialists (Wordfence, Patchstack, WPScan) together issued 11,053 in 2025. VulDB, GitHub (for open-source advisories) and VulnCheck add thousands more each. None of these issued a single CVE in 2017; together they published 26,566 in 2025, 55% of the year. Between 2020 and 2025 they account for 87% of the entire increase in yearly CVEs.
For defenders that cuts both ways. More CVEs means more known issues are tracked at all, which is good. It also means volume is a poor proxy for risk: a year with twice the CVEs is not a year with twice the danger.
| CNA | 2017 | 2018 | 2019 | 2020 | 2021 | 2022 | 2023 | 2024 | 2025 | 2026* |
|---|---|---|---|---|---|---|---|---|---|---|
| MITRE (catch-all) | 6,611 | 7,290 | 7,727 | 7,188 | 6,441 | 7,677 | 6,220 | 5,918 | 5,196 | 3,532 |
| Linux kernel | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 4,287 | 5,675 | 7,424 |
| Wordfence | 0 | 0 | 0 | 0 | 154 | 169 | 879 | 3,524 | 3,450 | 3,433 |
| Patchstack | 0 | 0 | 0 | 0 | 30 | 381 | 2,146 | 4,562 | 7,008 | 4,711 |
| VulDB | 0 | 0 | 0 | 0 | 0 | 853 | 1,925 | 2,936 | 5,899 | 5,728 |
| GitHub (advisories) | 0 | 0 | 26 | 499 | 1,065 | 1,292 | 1,771 | 2,120 | 2,867 | 11,630 |
| WPScan | 0 | 0 | 0 | 0 | 747 | 1,144 | 935 | 773 | 595 | 1,726 |
| VulnCheck | 0 | 0 | 0 | 0 | 0 | 0 | 10 | 38 | 1,072 | 7,976 |
| Microsoft | 695 | 703 | 845 | 1,262 | 871 | 931 | 994 | 1,095 | 1,244 | 4,378 |
| All CNAs | 14,642 | 16,510 | 17,305 | 18,322 | 20,149 | 25,073 | 28,816 | 39,953 | 48,152 | 81,062 |
Attribution is NVD's source field. Before CVE Services rolled out in the early 2020s, many issuers' records reached NVD through MITRE and are credited to it, so the MITRE row overstates what MITRE itself assigned in earlier years. * 2026 to 15 Oct.
281 CVEs a day. You need the handful that touch your stack.
Tell vulneraibility.com what each of your apps runs, with versions. Every new CVE is matched against it, checked against your versions, and only what affects you reaches your inbox, Slack or Telegram, with exploitation data alongside.
Common questions
- How many CVEs were published in 2025?
- 48,152 CVEs were published in 2025, +8,199 (+20.5%) compared with 39,953 in 2024. That is about 132 new CVEs a day.
- How many CVEs have been published in 2026 so far?
- 81,062 CVEs were published between 1 January and 15 October 2026. Over the same window in 2025 there were 37,567, so 2026 is running +115.8% year on year.
- Why does the number of CVEs keep increasing?
- Mostly because more organisations now issue CVEs, not only because software got worse. The Linux kernel project became its own CVE issuer in 2024 and published 5,675 CVEs in 2025; WordPress-focused security firms (Wordfence, Patchstack, WPScan) issued 11,053 in 2025.
- What share of CVEs are critical?
- Of the 2025 CVEs that NVD has scored, 20.2% are critical and 30.0% high under CVSS v3. 65% of that year's CVEs had not been scored by NVD at the time of counting, although many carry a score from the organisation that issued them.
- How many CVEs are actually exploited?
- CISA's Known Exploited Vulnerabilities catalog lists 1,746 CVEs with evidence of exploitation in the wild; 245 were added in 2025. Set against 48,152 CVEs published that year, confirmed exploitation is a small fraction of the total.
How these numbers are counted
Source. NVD CVE API 2.0 (services.nvd.nist.gov), counted by published date, rejected CVEs excluded. Exploitation figures: CISA Known Exploited Vulnerabilities catalog, version 2026.10.15. Snapshot taken 15 October 2026.
Year = publication date. A CVE counts in the year its record was published, not the year in its ID. CVE-2025-1234 can be published in 2026, and IDs are often reserved months before publication.
Rejected CVEs are excluded. IDs withdrawn as duplicates or non-issues are not counted. Reserved IDs that were never published are not CVEs and are not counted either.
Counts move slightly. Records are occasionally rejected or backfilled after the fact, so a re-count can differ by a handful from the figures here.
Severity is the CVSS v3 severity assigned by NVD (its primary score). Scores supplied only by the issuing CNA are not counted, which matches how NVD's own severity filter behaves; CVEs NVD has not analysed appear as “not scored by NVD”. Issuers are identified by the CNA identifiers NVD publishes; the table lists the issuers that explain most of the growth, and everyone else is grouped.