--- title: "CVE statistics: vulnerabilities by year | Daniel Christensen" canonical_url: "https://danielchristensen.no/en/tools/cve-statistics" last_updated: "2026-09-17T12:50:00.418Z" locale: en meta: description: "49 972 CVEs were published in 2025. See the trend year by year, split by severity, with figures pulled from NVD and refreshed every day." "og:description": "49 972 CVEs were published in 2025. See the trend year by year, split by severity, with figures pulled from NVD and refreshed every day." "og:title": "CVE statistics: vulnerabilities by year" --- Tools # CVE statistics How many vulnerabilities are actually published each year? The charts you find on Google usually stop in 2021. This one reads NVD and refreshes every day. Updated 15/10/2026 - **49 972**CVEs published in 2025 - **137**new vulnerabilities per day - **3 365**rated critical in 2025 - **7.7×**more than in 2016 ## Published vulnerabilities per year High and criticalMediumLow2026 is not finished 90 00080 00070 00060 00050 00040 00030 00020 00010 0000 6 517 2016 18 113 2017 18 154 2018 18 938 2019 19 222 2020 21 950 2021 26 431 2022 30 949 2023 40 704 2024 49 972 2025 82 882 2026 The bars are every CVE NVD published that year. The severity split follows the vulnerabilities NVD has managed to give a CVSS score, applied to the whole year. NVD has not scored everything, and the backlog is largest on the newest years. ## The numbers, year by year Critical, high, medium and low are NVD's own counts for the vulnerabilities it has scored, so they add up to the scored column rather than to the total. | Year | Total | Critical | High | Medium | Low | Scored | | --- | --- | --- | --- | --- | --- | --- | | 2026ongoing | 82 882 | 2 191 | 5 408 | 6 692 | 273 | 18 % | | 2025 | 49 972 | 3 365 | 4 992 | 8 081 | 227 | 33 % | | 2024 | 40 704 | 3 037 | 8 256 | 11 490 | 371 | 57 % | | 2023 | 30 949 | 4 396 | 9 897 | 11 861 | 370 | 86 % | | 2022 | 26 431 | 4 153 | 9 195 | 9 382 | 427 | 88 % | | 2021 | 21 950 | 2 545 | 7 454 | 7 822 | 356 | 83 % | | 2020 | 19 222 | 2 681 | 7 283 | 7 226 | 399 | 92 % | | 2019 | 18 938 | 2 625 | 7 130 | 7 075 | 310 | 91 % | | 2018 | 18 154 | 2 596 | 7 542 | 6 198 | 167 | 91 % | | 2017 | 18 113 | 2 110 | 6 602 | 5 697 | 229 | 81 % | | 2016 | 6 517 | 887 | 2 874 | 2 284 | 186 | 96 % | ## Use the chart The chart is also an image you can download or embed. It is re-rendered whenever the numbers change, so an embedded copy never goes out of date. The chart is free to use under [CC BY 4.0](https://creativecommons.org/licenses/by/4.0/), commercially and on Wikipedia too, as long as you credit it like this: `Chart: Daniel Christensen / danielchristensen.no (CC BY 4.0)` [Download PNG ↓](https://danielchristensen.no/tools/cve-statistics/graph.png) [![Bar chart of CVEs published per year, split by severity, with figures from NVD](https://danielchristensen.no/tools/cve-statistics/graph.png?v=a30pxo)](https://danielchristensen.no/tools/cve-statistics/graph.png) Questions and answers ## What people ask
about CVEs ![Shield illustration](https://danielchristensen.no/_nuxt/mv0saeg5/shield-2.CMD95R2A.svg) NVD has given 3 365 of the vulnerabilities from 2025 a critical CVSS score. That is among the 16 665 it has assessed so far, out of 49 972 published in total. NVD does not manage to score everything, so the real number is higher. Talks ## Numbers land. Stories are what people remember. This chart is one slide in my talks on digital security. The rest is about what actually happens when somebody uses one of them. [See the talks →](https://danielchristensen.no/en/talks) ## Sitemap See the full [sitemap](/sitemap.md) for all pages.