Shield illustration Daniel Christensen
NOEN
Book a talk →
Tools

CVE statistics

How many vulnerabilities are actually published each year? The charts you find on Google usually stop in 2021. This one reads NVD and refreshes every day.

Updated 19/10/2026

  • 49 972CVEs published in 2025
  • 137new vulnerabilities per day
  • 3 365rated critical in 2025
  • 7.7×more than in 2016

Published vulnerabilities per year

High and criticalMediumLow2026 is not finished
6 517
2016
18 113
2017
18 154
2018
18 938
2019
19 222
2020
21 950
2021
26 431
2022
30 949
2023
40 704
2024
49 972
2025
84 575
2026

The bars are every CVE NVD published that year. The severity split follows the vulnerabilities NVD has managed to give a CVSS score, applied to the whole year. NVD has not scored everything, and the backlog is largest on the newest years.

The numbers, year by year

Critical, high, medium and low are NVD's own counts for the vulnerabilities it has scored, so they add up to the scored column rather than to the total.

YearTotalCriticalHighMediumLowScored
2026ongoing84 5752 1715 3146 66527217 %
202549 9723 3654 9928 08122733 %
202440 7043 0378 25611 49037157 %
202330 9494 3969 89811 86137086 %
202226 4314 1539 1959 38142788 %
202121 9502 5457 4547 82235683 %
202019 2222 6817 2837 22639992 %
201918 9382 6257 1307 07531091 %
201818 1542 5967 5426 19816791 %
201718 1132 1106 6025 69722981 %
20166 5178872 8742 28418696 %

Use the chart

The chart is also an image you can download or embed. It is re-rendered whenever the numbers change, so an embedded copy never goes out of date.

The chart is free to use under CC BY 4.0, commercially and on Wikipedia too, as long as you credit it like this:

Chart: Daniel Christensen / danielchristensen.no (CC BY 4.0)

Download PNG ↓
Bar chart of CVEs published per year, split by severity, with figures from NVD
Questions and answers

What people ask
about CVEs

Shield illustration

NVD has given 3 365 of the vulnerabilities from 2025 a critical CVSS score. That is among the 16 665 it has assessed so far, out of 49 972 published in total. NVD does not manage to score everything, so the real number is higher.

Talks

Numbers land. Stories are what people remember.

This chart is one slide in my talks on digital security. The rest is about what actually happens when somebody uses one of them.

See the talks →