Request demo

Vulnerability Insights

Watch How Fast Vulnerabilities Arrive and Which Get Exploited.

Disclosure counts, CISA KEV additions, the spread of CVSS scores and the weaknesses behind them, from the CVE database the Deepinfo Platform uses to rank findings. Each figure is the Vulnerability API’s answer as of the last hourly refresh, shown exactly as returned.

Talk to us about API access Vulnerability reference

CVSS on 7 of the 10 newest

Brand-new records often arrive before scoring and enrichment are complete.

CVEs in the database Last refresh

Track Disclosure Velocity and What’s Already Exploited.

CVEs published and modified, and CVEs added to CISA’s Known Exploited Vulnerabilities catalog, over the last 1, 7 and 30 days.

SnapshotUpdated hourlyLast refresh Source: CVE Stats and CISA KEV Stats

Last 1 dayLast 7 daysLast 30 days
CVEs publishedNew CVE records. Many arrive before a CVSS score is attached.1,284Last 1 day3,899Last 7 days17,897Last 30 days
CVEs modifiedUpdates to existing records: new scores, affected products, references.3,298Last 1 day25,961Last 7 days65,689Last 30 days
Added to CISA KEVCVEs with evidence of exploitation in the wild. Each entry carries a required action and a due date.2Last 1 day8Last 7 days34Last 30 days

CVSS Scores Cluster on a Few Values.

Each scored CVE, placed by its CVSS base score from 0.0 to 10.0. The spikes are common vectors: in CVSS v3.x, 9.8 is a low-complexity network flaw that needs no privileges or user interaction and fully compromises confidentiality, integrity and availability.

Six values account for 43.9% of the 393,103 scored CVEs: 7.5, 7.8, 9.8, 8.8, 5.5 and 6.5.

Low0.1 to 3.917,930
Medium4.0 to 6.9176,281
High7.0 to 8.9147,505
Critical9.0 to 10.051,387

Unscored 23,552 CVEs have no CVSS score yet, and 95 carry a score of 0.0. They sit outside the bands.

Show the numbers
CVSS base scoreCVEs
0.095
0.12
0.314
0.41
0.56
0.616
0.923
1.062
1.176
1.2209
1.3205
1.42
1.530
1.61
1.7103
1.8101
1.91,138
2.01,108
2.15,370
2.273
2.3692
2.4351
2.5130
2.6849
2.7723
2.879
2.9354
3.053
3.1576
3.291
3.32,117
3.496
3.51,656
3.6328
3.7898
3.8294
3.9103
4.01,749
4.1310
4.2492
4.320,505
4.42,098
4.5160
4.62,502
4.71,928
4.85,053
4.93,175
5.011,577
5.13,449
5.2228
5.314,579
5.416,505
5.524,007
5.6396
5.7846
5.81,456
5.93,671
6.01,372
6.115,642
6.2861
6.32,300
6.43,830
6.521,595
6.6785
6.72,523
6.87,950
6.94,737
7.02,813
7.19,035
7.28,231
7.32,319
7.42,161
7.542,990
7.61,385
7.71,439
7.829,123
7.9148
8.01,150
8.15,971
8.22,585
8.31,292
8.41,497
8.52,035
8.62,673
8.74,237
8.825,997
8.9424
9.01,088
9.13,711
9.2571
9.37,428
9.4754
9.5111
9.61,222
9.74
9.828,754
9.91,202
10.06,542
Unscored23,552

Count Disclosures by Year and Severity.

CVE counts per year and severity since 1999. The latest year is year to date, not a projection.

2025 closed with 49,972 CVEs. 2026 has 91,473 so far, already more than any full year on record.

  • Critical
  • High
  • Medium
  • Low
  • Unscored
  • 2026 is year to date
Show every year
YearTotalCriticalHighMediumLowUnscored
2026 (to date)91,4739,87236,33932,9376,0176,308
202549,9724,17315,90524,0643,1022,728
202440,7044,30014,03620,755853760
202330,9494,63410,95612,8024232,134
202226,4314,24710,15810,1794871,360
202121,9502,6768,5668,4634441,801
202019,2222,7197,6817,498424900
201918,9382,6357,2067,1533111,633
201818,1542,5977,5426,2031681,644
201718,1132,1116,5975,6982363,471
20166,5178872,8952,44622168
20156,595512,3523,502589101
20148,008201,9245,32466080
20135,324231,7332,914517137
20125,351211,7243,03550863
20114,17251,7842,10026122
20104,667282,0932,24127728
20095,778152,7342,78619746
20085,664192,8462,58218532
20076,596213,1623,10123280
20066,659112,7633,32550951
20055,010132,0482,43044178
20042,479109731,26520328
20031,54896747479721
20022,170101,02398014314
20011,679127767061823
20001,0202454467961
1999923342335711129
1998247113785231
1997253114389191
1996751432191
199525117610
1994260141011
19931308320
199214012011
199115011400
19901108210
1989302100
1988202000

Severity here is the rating recorded with each CVE’s score. CVSS v2, which scores many older CVEs, has no Critical rating, so this view shows fewer Critical CVEs than the score distribution above.

New CVEs Appear Here as They Land.

The ten most recently added CVE records. Brand-new records often arrive before scoring and enrichment are complete, so expect gaps at the top of this list.

CVEPublished (UTC)CVSSWeaknessEPSS / KEVDescription
CVE-2026-9536Received7.5High · v3.1CWE-122Heap-based buffer overflowPendingA heap-based buffer overflow vulnerability exists in the vtkWindBladeReader FindVariableOffsets functionality of vtk (version(s): 9.6.1). A specially crafted .wind can lead to a buffer overflow. An…
CVE-2026-9535Received8.2High · v3.1CWE-125Out-of-bounds readPendingA out-of-bounds read vulnerability exists in the vtkChacoReader InputGraph2 functionality of vtk (version(s): 9.6.1). A specially crafted chaco can lead to an out-of-bounds read. An attacker can…
CVE-2026-8824Received7.5High · v3.1CWE-787Out-of-bounds writePendingA memory corruption vulnerability exists in the vtkBMPReader ExecuteDataWithInformation functionality of vtk (version(s): 9.6.1). A specially crafted .bmp file can lead to a buffer overflow. An…
CVE-2026-8822Received7.5High · v3.1CWE-787Out-of-bounds writePendingA memory corruption vulnerability exists in the vtkDEMReader ReadProfiles functionality of vtk (version(s): 9.6.1). A specially crafted USGS DEM can lead to a buffer overflow. An attacker can provide…
CVE-2026-6877Received5.3Medium · v4.0CWE-284Improper access controlPendingServiceNow has addressed a domain separation bypass security issue that was identified in the ServiceNow SR - CSM - Task Plan Templates Store application. This vulnerability could enable an…
CVE-2026-58120Rejectedn/aUnscoredNot classified yetPendingRejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
CVE-2026-58119Rejectedn/aUnscoredNot classified yetPendingRejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
CVE-2026-58118Rejectedn/aUnscoredNot classified yetPendingRejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
CVE-2026-42057Received7.5High · v3.1CWE-825Expired pointer dereferencePendingAn invalid pointer dereference vulnerability exists in the vtkPNGReader::vtkPNGReaderUpdate2 functionality of vtk 9.6. A specially crafted .png file can lead to a denial of service. An attacker can…
CVE-2026-41216Received7.5High · v3.1CWE-825Expired pointer dereferencePendingAn invalid pointer dereference vulnerability exists in the vtkPNGReader::ExecuteInformation functionality of vtk 9.6. A specially crafted .png file can lead to a denial of service. An attacker can…

Times are UTC. EPSS estimates the probability of exploitation in the next 30 days; a CISA KEV tag means the CVE is in the Known Exploited Vulnerabilities catalog.

The Weaknesses That Keep Coming Back.

The ten weakness types (CWE) with the most CVEs over the last ten years, and how each one moved year by year.

Cross-site scripting (CWE-79) leads with 42,085 CVEs since 2017. The steepest climb belongs to Missing authorization (CWE-862): 43 CVEs in 2017, 2,354 in 2025.

Weakness2017 to 2026Total2026 YTD
01CWE-79Cross-site scripting42,0857,766
02CWE-89SQL injection17,2194,016
03CWE-787Out-of-bounds write14,9672,132
04CWE-862Missing authorization11,2734,803
05CWE-125Out-of-bounds read10,3172,448
06CWE-20Improper input validation9,6542,013
07CWE-416Use after free9,1363,169
08CWE-22Path traversal8,9452,939
09CWE-352Cross-site request forgery8,6611,132
10CWE-200Sensitive information exposure8,6202,259

Bars share one scale across rows. The last bar in each row is the current year to date, drawn in outline.

The Method Behind Each Count.

The Vulnerability endpoints, called every hour, drawn as returned.

SourceDeepinfo’s CVE database, read through the Vulnerability endpoints of the Deepinfo API.
EnrichmentCVSS v2, v3.0, v3.1 and v4.0 metrics where published, EPSS, CISA KEV, CWE with its OWASP Top 10 2021 mapping, and vDeep, Deepinfo’s own CVSS scoring layer.
RefreshHourly. A scheduled job calls each endpoint and keeps the previous answer if a call fails.
Score bandsLow 0.1 to 3.9, Medium 4.0 to 6.9, High 7.0 to 8.9, Critical 9.0 to 10.0, as in the CVSS v3.x qualitative scale.
UnscoredCVEs without a CVSS score are counted apart and never folded into a band.
Partial periodsThe current year is year to date. Nothing is projected.
FiltersSeverity By Year Stats, CVSS Score Stats and Latest Added accept vendor, product and version, so these views work for a single product.
EndpointsCVE Stats, CISA KEV Stats, CVSS Score Stats, Severity By Year Stats, CWE Timeline, Latest Added

From Every CVE to Yours.

DSI Vulnerability Intelligence The endpoints behind this page, with parameters, samples and EPSS history per CVE. Read API Vulnerability Search Query the CVE database with filters, including EPSS and CISA KEV fields. Read EASM Risk Scoring The CVEs on your assets, ranked with CVSS, EPSS and CISA KEV together. Read

Questions About Vulnerability Insights

What is the CISA KEV catalog?

The Known Exploited Vulnerabilities catalog is CISA’s list of CVEs with evidence of exploitation in the wild. Each entry names a required action and a due date, which makes it a strong signal for what to patch first.

Why are fields missing on the newest CVEs?

A CVE record is often published before its CVSS metrics, EPSS score or CWE classification are attached, and those fill in as the record is analyzed. CISA adds a CVE to KEV only once there is evidence of exploitation, so most records never carry a KEV entry.

Can we list the CVEs behind a count?

Yes. Vulnerability Search filters on published or enrichment.cisa_kev.date_added with gte, so the CVEs published, or added to CISA KEV, in the last 7 or 30 days take one query.

Can we see these views for one vendor or product?

Yes, through the API. Severity By Year Stats, CVSS Score Stats and Latest Added take vendor, product and version parameters. See the Vulnerability reference.

Where does EPSS fit in?

EPSS estimates the probability that a CVE will be exploited in the next 30 days. It sits between CVSS, which rates the damage if a flaw is exploited, and KEV, which records exploitation that already happened. Each CVE record carries its EPSS score, with a daily history.

How does the Deepinfo Platform use this data?

External Attack Surface Management enriches each CVE it finds on your assets from this database, and ranks them with CVSS, EPSS and CISA KEV together. See Risk Scoring.

How is API access to these endpoints priced?

The Vulnerability endpoints are part of Deepinfo API Services, priced by volume and frequency, separately from the platform. See Data & API pricing.

Rank Your CVEs by What Gets Exploited.

The Deepinfo Platform applies CVSS, EPSS and CISA KEV to the vulnerabilities on your own attack surface. Book a demo on your domain.

Request demo