--- title: "CVE statistics: vulnerabilities by year | Daniel Christensen" description: "49 972 CVEs were published in 2025. See the trend year by year, split by severity, with figures pulled from NVD and refreshed every day." canonical_url: "https://danielchristensen.no/en/tools/cve-statistics" last_updated: "2026-09-17T12:50:00.418Z" locale: en meta: "og:description": "49 972 CVEs were published in 2025. See the trend year by year, split by severity, with figures pulled from NVD and refreshed every day." "og:image": "https://danielchristensen.no/tools/cve-statistics/graph.png" "og:image:alt": "Bar chart of CVEs published per year, split by severity, with figures from NVD" "og:image:height": "675" "og:image:width": "1200" "og:title": "CVE statistics: vulnerabilities by year" --- > Index of every page on this site: [llms.txt](https://danielchristensen.no/llms.txt) Tools # CVE statistics How many vulnerabilities are actually published each year? The charts you find on Google usually stop in 2021. This one reads NVD and refreshes every day. Updated 19/10/2026 - **49 972**CVEs published in 2025 - **137**new vulnerabilities per day - **3 365**rated critical in 2025 - **7.7×**more than in 2016 ## Published vulnerabilities per year High and criticalMediumLow2026 is not finished 90 00080 00070 00060 00050 00040 00030 00020 00010 0000 6 517 2016 18 113 2017 18 154 2018 18 938 2019 19 222 2020 21 950 2021 26 431 2022 30 949 2023 40 704 2024 49 972 2025 84 575 2026 The bars are every CVE NVD published that year. The severity split follows the vulnerabilities NVD has managed to give a CVSS score, applied to the whole year. NVD has not scored everything, and the backlog is largest on the newest years. ## The numbers, year by year Critical, high, medium and low are NVD's own counts for the vulnerabilities it has scored, so they add up to the scored column rather than to the total. | Year | Total | Critical | High | Medium | Low | Scored | | --- | --- | --- | --- | --- | --- | --- | | 2026ongoing | 84 575 | 2 171 | 5 314 | 6 665 | 272 | 17 % | | 2025 | 49 972 | 3 365 | 4 992 | 8 081 | 227 | 33 % | | 2024 | 40 704 | 3 037 | 8 256 | 11 490 | 371 | 57 % | | 2023 | 30 949 | 4 396 | 9 898 | 11 861 | 370 | 86 % | | 2022 | 26 431 | 4 153 | 9 195 | 9 381 | 427 | 88 % | | 2021 | 21 950 | 2 545 | 7 454 | 7 822 | 356 | 83 % | | 2020 | 19 222 | 2 681 | 7 283 | 7 226 | 399 | 92 % | | 2019 | 18 938 | 2 625 | 7 130 | 7 075 | 310 | 91 % | | 2018 | 18 154 | 2 596 | 7 542 | 6 198 | 167 | 91 % | | 2017 | 18 113 | 2 110 | 6 602 | 5 697 | 229 | 81 % | | 2016 | 6 517 | 887 | 2 874 | 2 284 | 186 | 96 % | ## Use the chart The chart is also an image you can download or embed. It is re-rendered whenever the numbers change, so an embedded copy never goes out of date. The chart is free to use under [CC BY 4.0](https://creativecommons.org/licenses/by/4.0/), commercially and on Wikipedia too, as long as you credit it like this: `Chart: Daniel Christensen / danielchristensen.no (CC BY 4.0)` [Download PNG ↓](https://danielchristensen.no/tools/cve-statistics/graph.png) [![Bar chart of CVEs published per year, split by severity, with figures from NVD](https://danielchristensen.no/tools/cve-statistics/graph.png?v=1fvbx67)](https://danielchristensen.no/tools/cve-statistics/graph.png) Questions and answers ## What people ask
about CVEs ![Shield illustration](https://danielchristensen.no/_nuxt/mvewcfdo/shield-2.CMD95R2A.svg) NVD has given 3 365 of the vulnerabilities from 2025 a critical CVSS score. That is among the 16 665 it has assessed so far, out of 49 972 published in total. NVD does not manage to score everything, so the real number is higher. Talks ## Numbers land. Stories are what people remember. This chart is one slide in my talks on digital security. The rest is about what actually happens when somebody uses one of them. [See the talks →](https://danielchristensen.no/en/talks) ```json {"@context":"https://schema.org","@graph":[{"@id":"https://danielchristensen.no/en#website","@type":"WebSite","description":"Ethical hacker and keynote speaker. Talks on digital security, pentesting and how to avoid getting hacked.","inLanguage":"en","name":"Daniel Christensen","url":"https://danielchristensen.no/en","publisher":{"@id":"https://danielchristensen.no/#identity"},"translationOfWork":{"@id":"https://danielchristensen.no/#website"}},{"@id":"https://danielchristensen.no/en/tools/cve-statistics#webpage","@type":"WebPage","description":"49\u00a0972 CVEs were published in 2025. See the trend year by year, split by severity, with figures pulled from NVD and refreshed every day.","name":"CVE statistics","url":"https://danielchristensen.no/en/tools/cve-statistics","breadcrumb":{"@id":"https://danielchristensen.no/en/tools/cve-statistics#/schema/breadcrumb-list/#breadcrumb"},"isPartOf":{"@id":"https://danielchristensen.no/en#website"},"potentialAction":[{"@type":"ReadAction","target":["https://danielchristensen.no/en/tools/cve-statistics"]}]},{"@id":"https://danielchristensen.no/#identity","@type":"Person","alternateName":"BobTheShoplifter","description":"Ethical hacker, speaker and content creator (BobTheShoplifter). Talks on digital security and pentesting.","name":"Daniel Christensen","url":"https://danielchristensen.no","address":{"@type":"PostalAddress","addressLocality":"Oslo","addressRegion":"Oslo","addressCountry":"NO"},"contactPoint":{"@type":"ContactPoint","telephone":"+4798332280","email":"daniel@websecured.io","contactType":"booking","areaServed":"NO","availableLanguage":["nb","en"]},"image":{"@id":"https://danielchristensen.no/#/schema/image/1"},"interactionStatistic":{"@type":"InteractionCounter","interactionType":{"@type":"FollowAction"},"userInteractionCount":130500},"jobTitle":["Ethical hacker","Keynote speaker","Content creator"],"knowsAbout":["Digital security","Cybersecurity","Ethical hacking","Penetration testing","Social engineering","Fraud and phishing"],"sameAs":["https://www.wikidata.org/wiki/Q109401760","https://www.tiktok.com/@bobtheshoplifter","https://www.instagram.com/bobtheshoplifter","https://www.youtube.com/channel/UCp2mLClUy4kwbg_uUWbR_5w","https://www.linkedin.com/in/-daniel-/","https://twitter.com/BobTShoplifter","https://www.facebook.com/daniel.christensen.5648/"],"worksFor":{"@type":"Organization","name":"Websecured","url":"https://websecured.io"}},{"@id":"https://danielchristensen.no/en/tools/cve-statistics#/schema/breadcrumb-list/#breadcrumb","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","name":"Home","item":"https://danielchristensen.no/en","position":1},{"@type":"ListItem","name":"Tools","item":"https://danielchristensen.no/en/tools","position":2},{"@type":"ListItem","name":"CVE statistics","item":"https://danielchristensen.no/en/tools/cve-statistics","position":3}]},{"@id":"https://danielchristensen.no/en/tools/cve-statistics#chart","@type":"ImageObject","acquireLicensePage":"https://danielchristensen.no/en/tools/cve-statistics#bruk-grafen","caption":"Bar chart of CVEs published per year, split by severity, with figures from NVD","contentUrl":"https://danielchristensen.no/tools/cve-statistics/graph.png","copyrightNotice":"Daniel Christensen","creditText":"Daniel Christensen / danielchristensen.no","dateModified":"2026-10-19T02:18:41.641Z","encodingFormat":"image/png","height":675,"inLanguage":"en","license":"https://creativecommons.org/licenses/by/4.0/","name":"CVEs published per year","representativeOfPage":true,"url":"https://danielchristensen.no/tools/cve-statistics/graph.png","width":1200,"creator":{"@id":"https://danielchristensen.no/#/schema/person/1"}},{"@id":"https://danielchristensen.no/en/tools/cve-statistics#dataset","@type":"Dataset","dateModified":"2026-10-19T02:18:41.641Z","description":"Number of vulnerabilities published per year in the National Vulnerability Database, split by CVSS severity. Updated daily.","isAccessibleForFree":true,"license":"https://creativecommons.org/publicdomain/zero/1.0/","name":"Published CVEs per year, by severity","temporalCoverage":"2016/2026","url":"https://danielchristensen.no/en/tools/cve-statistics","variableMeasured":"Number of published CVEs per year","creator":{"@type":"Organization","name":"NVD","url":"https://nvd.nist.gov/"},"distribution":[{"@type":"DataDownload","encodingFormat":"application/json","contentUrl":"https://danielchristensen.no/api/cve-stats"},{"@type":"DataDownload","encodingFormat":"image/png","contentUrl":"https://danielchristensen.no/tools/cve-statistics/graph.png"}],"image":{"@id":"https://danielchristensen.no/en/tools/cve-statistics#chart"}},{"@id":"https://danielchristensen.no/en/tools/cve-statistics#faq","@type":"FAQPage","mainEntity":[{"@type":"Question","name":"How many critical CVEs were there in 2025?","acceptedAnswer":{"@type":"Answer","text":"NVD has given 3\u00a0365 of the vulnerabilities from 2025 a critical CVSS score. That is among the 16\u00a0665 it has assessed so far, out of 49\u00a0972 published in total. NVD does not manage to score everything, so the real number is higher."}},{"@type":"Question","name":"How many CVEs were published in 2025?","acceptedAnswer":{"@type":"Answer","text":"49\u00a0972 vulnerabilities were assigned a CVE number in 2025. That is roughly 137 every single day, weekends and holidays included."}},{"@type":"Question","name":"How many vulnerabilities are found per day?","acceptedAnswer":{"@type":"Answer","text":"An average of 137 per day through 2025. The figure has risen every single year since 2016."}},{"@type":"Question","name":"Is the number of vulnerabilities growing?","acceptedAnswer":{"@type":"Answer","text":"Yes. 7.7 times as many CVEs were published in 2025 as in 2016, and the curve has not flattened."}},{"@type":"Question","name":"How many CVEs have been published in 2026?","acceptedAnswer":{"@type":"Answer","text":"84\u00a0575 so far in 2026, last updated 19/10/2026. The year is not over, so the 2026 bar is marked as ongoing in the chart and left out of the comparisons."}},{"@type":"Question","name":"What is a CVE?","acceptedAnswer":{"@type":"Answer","text":"CVE stands for Common Vulnerabilities and Exposures. It is a unique number for a known flaw in software or hardware, for example CVE-2021-44228, better known as Log4Shell. The number is what lets everyone talk about the same bug."}},{"@type":"Question","name":"What does the severity mean?","acceptedAnswer":{"@type":"Answer","text":"It comes from CVSS, a scale from 0 to 10. Low is under 4, medium up to 7, high up to 9, and critical from 9 upwards. In the chart critical is folded into high, the way NVD presents it itself."}},{"@type":"Question","name":"Where do the numbers come from?","acceptedAnswer":{"@type":"Answer","text":"The National Vulnerability Database (NVD) at NIST in the United States. This page queries their API once a day and stores the answer, so you always see what NVD had the last time we checked. The date at the top says when that was."}},{"@type":"Question","name":"Why do other sites show different numbers?","acceptedAnswer":{"@type":"Answer","text":"Two reasons. Most charts were made once and never updated. And NVD backfills: vulnerabilities are published late and scored later still, so last year's totals keep climbing for months after New Year. That is why this page carries a date."}},{"@type":"Question","name":"Can I use the chart elsewhere?","acceptedAnswer":{"@type":"Answer","text":"Yes, please do. Download the PNG or copy the embed code. The figures are public data from NVD. A link back here is appreciated but not required."}}]},{"@id":"https://danielchristensen.no/#/schema/person/1","@type":"Person","name":"Daniel Christensen"},{"@id":"https://danielchristensen.no/#/schema/image/1","@type":"ImageObject","contentUrl":"https://danielchristensen.no/assets/photos/daniel-portrait.jpg","inLanguage":"en","url":"https://danielchristensen.no/assets/photos/daniel-portrait.jpg"}]} ``` ## Sitemap See the full [sitemap](https://danielchristensen.no/sitemap.md) for all pages.