CVEs · by publication year
How the mix of weaknesses shifted, year by year
347,225 CVEs · 1999 to 2026 · 21 classes
Each band is a weakness class; its height in a year is its share of that year's CVEs. Memory Corruption led 2026 with 19%, against 12% in 2008. Point at a class to follow it alone; choose a year to open that year's CVEs.
- CVEs counted
- 347,225
- years
- 28
Each year's CVEs by publication year that name a weakness (CWE), as shares of that year. 59,346 CVEs name none and are not counted; most are from before 2010, when few records named one.
| Year | Total | Memory Corruption | Cross-site Scripting | Access Control | File and Path Handling | SQL Injection | Input Validation and Logic | Authentication | Command and Code Injection | Information Disclosure | Denial of Service | Cryptography | Cross-Site Request Forgery | Injection and Smuggling | Race Conditions | Deserialization and Object Injection | Server-Side Request Forgery | Insecure Direct Object Reference | Other weaknesses | Misconfiguration and Insecure Design | Open Redirect | Supply Chain and Malicious Code |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 1999 | 35 | 34% | 0% | 11% | 2.9% | 0% | 5.7% | 8.6% | 11% | 11% | 5.7% | 2.9% | 0% | 0% | 2.9% | 0% | 0% | 0% | 2.9% | 0% | 0% | 0% |
| 2000 | 72 | 14% | 0% | 11% | 6.9% | 0% | 17% | 8.3% | 6.9% | 17% | 2.8% | 1.4% | 0% | 0% | 2.8% | 0% | 0% | 0% | 2.8% | 9.7% | 0% | 0% |
| 2001 | 49 | 22% | 0% | 14% | 12% | 0% | 14% | 8.2% | 6.1% | 8.2% | 6.1% | 4.1% | 0% | 0% | 4.1% | 0% | 0% | 0% | 0% | 0% | 0% | 0% |
| 2002 | 72 | 19% | 2.8% | 15% | 13% | 1.4% | 8.3% | 8.3% | 2.8% | 13% | 8.3% | 4.2% | 0% | 0% | 2.8% | 0% | 0% | 0% | 0% | 0% | 0% | 1.4% |
| 2003 | 85 | 36% | 4.7% | 7.1% | 5.9% | 3.5% | 8.2% | 4.7% | 5.9% | 7.1% | 9.4% | 1.2% | 0% | 0% | 1.2% | 0% | 1.2% | 0% | 2.4% | 0% | 0% | 1.2% |
| 2004 | 115 | 51% | 2.6% | 6.1% | 7.0% | 0.9% | 7.8% | 0.9% | 7.0% | 4.3% | 7.0% | 0% | 0% | 0.9% | 1.7% | 0% | 0% | 0% | 0% | 0.9% | 0% | 1.7% |
| 2005 | 553 | 16% | 9.0% | 10% | 7.2% | 9.2% | 8.7% | 2.7% | 8.1% | 5.8% | 8.1% | 6.9% | 1.5% | 1.1% | 1.5% | 0.2% | 0.2% | 0% | 1.8% | 0.4% | 0.7% | 0% |
| 2006 | 949 | 20% | 13% | 6.0% | 3.8% | 10% | 5.3% | 1.9% | 20% | 3.2% | 9.3% | 0.7% | 0.3% | 0.1% | 1.3% | 0% | 0% | 0% | 4.2% | 0.3% | 0% | 0% |
| 2007 | 2,984 | 20% | 14% | 8.6% | 7.5% | 9.4% | 8.9% | 4.4% | 11% | 4.3% | 3.8% | 1.2% | 1.3% | 0.1% | 0.7% | 0.0% | 0% | 0% | 2.8% | 1.8% | 0% | 0% |
| 2008 | 5,192 | 12% | 15% | 8.5% | 10% | 21% | 7.1% | 3.6% | 6.1% | 3.8% | 5.6% | 1.1% | 1.5% | 0.0% | 0.4% | 0% | 0% | 0% | 2.7% | 0.7% | 0.1% | 0.0% |
| 2009 | 4,931 | 13% | 17% | 8.7% | 7.2% | 19% | 6.1% | 5.6% | 6.8% | 3.2% | 4.7% | 2.0% | 2.3% | 0.1% | 0.8% | 0% | 0% | 0% | 3.0% | 1.0% | 0.0% | 0% |
| 2010 | 3,773 | 17% | 16% | 9.0% | 8.0% | 14% | 7.5% | 3.4% | 7.1% | 4.2% | 5.3% | 1.8% | 2.0% | 0.1% | 0.9% | 0.1% | 0.0% | 0% | 3.5% | 0.6% | 0% | 0.0% |
| 2011 | 3,379 | 23% | 14% | 7.7% | 4.3% | 8.6% | 11% | 2.8% | 3.4% | 8.7% | 9.0% | 1.9% | 1.6% | 0.1% | 0.5% | 0.1% | 0% | 0% | 3.1% | 0.9% | 0% | 0% |
| 2012 | 4,162 | 21% | 18% | 14% | 3.4% | 5.7% | 8.4% | 3.6% | 3.7% | 5.4% | 5.8% | 2.6% | 3.7% | 0.1% | 1.6% | 0.1% | 0% | 0.0% | 3.2% | 0.4% | 0.0% | 0% |
| 2013 | 4,135 | 20% | 15% | 14% | 3.0% | 3.5% | 12% | 4.8% | 4.2% | 6.0% | 6.4% | 3.2% | 2.9% | 0.2% | 1.6% | 0.1% | 0% | 0% | 3.2% | 0.5% | 0% | 0% |
| 2014 | 6,824 | 12% | 15% | 10% | 3.8% | 4.3% | 7.9% | 3.8% | 3.7% | 5.2% | 3.5% | 23% | 3.6% | 0.1% | 0.6% | 0% | 0% | 0.0% | 2.1% | 0.1% | 0.0% | 0.0% |
| 2015 | 5,202 | 21% | 14% | 13% | 3.3% | 4.1% | 7.1% | 2.2% | 2.4% | 11% | 6.9% | 2.0% | 4.6% | 0.4% | 0.9% | 0.1% | 0% | 0% | 7.2% | 0.0% | 0.0% | 0% |
| 2016 | 5,373 | 30% | 8.8% | 19% | 2.1% | 1.7% | 9.3% | 1.9% | 1.6% | 13% | 4.0% | 1.4% | 1.5% | 0.7% | 0.8% | 0.2% | 0.1% | 0% | 4.2% | 0.0% | 0.2% | 0% |
| 2017 | 12,979 | 32% | 11% | 7.3% | 4.6% | 3.9% | 7.4% | 4.1% | 2.7% | 10% | 5.5% | 3.2% | 2.4% | 1.6% | 0.8% | 0.5% | 0.3% | 0.1% | 1.3% | 0.3% | 0.7% | 0.0% |
| 2018 | 14,644 | 30% | 14% | 5.5% | 6.2% | 3.4% | 8.3% | 4.9% | 3.7% | 7.3% | 4.4% | 4.0% | 3.0% | 2.0% | 0.7% | 0.8% | 0.4% | 0.1% | 0.4% | 0.4% | 0.6% | 0.4% |
| 2019 | 15,048 | 26% | 16% | 7.9% | 6.2% | 3.6% | 6.7% | 5.7% | 4.7% | 5.0% | 4.1% | 4.2% | 3.4% | 2.1% | 0.9% | 0.9% | 0.8% | 0.3% | 0.7% | 0.6% | 0.7% | 0.2% |
| 2020 | 14,702 | 24% | 15% | 9.0% | 6.6% | 3.1% | 5.9% | 7.7% | 5.7% | 4.0% | 3.7% | 4.7% | 2.6% | 2.8% | 1.4% | 1.5% | 0.8% | 0.3% | 0.3% | 0.7% | 0.7% | 0.3% |
| 2021 | 17,128 | 26% | 15% | 8.9% | 6.6% | 4.3% | 4.9% | 5.3% | 5.1% | 3.5% | 4.5% | 4.0% | 2.5% | 2.4% | 1.2% | 1.6% | 1.2% | 0.4% | 0.1% | 0.7% | 0.7% | 0.2% |
| 2022 | 22,205 | 24% | 15% | 9.3% | 6.9% | 8.0% | 4.8% | 5.2% | 4.6% | 3.7% | 4.6% | 3.0% | 2.8% | 1.8% | 1.5% | 1.2% | 1.0% | 0.6% | 0.3% | 0.8% | 0.6% | 0.2% |
| 2023 | 27,298 | 20% | 19% | 11% | 6.5% | 7.5% | 4.4% | 4.6% | 5.3% | 3.9% | 3.8% | 2.8% | 4.9% | 1.8% | 1.0% | 1.2% | 0.9% | 0.5% | 0.3% | 0.6% | 0.7% | 0.2% |
| 2024 | 38,133 | 21% | 19% | 12% | 6.7% | 7.0% | 3.6% | 4.0% | 5.0% | 4.2% | 4.1% | 2.1% | 3.6% | 1.1% | 1.6% | 1.3% | 1.0% | 0.8% | 0.3% | 0.6% | 0.4% | 0.2% |
| 2025 | 45,311 | 17% | 19% | 12% | 7.8% | 8.8% | 2.9% | 4.5% | 4.9% | 4.0% | 4.3% | 2.3% | 4.2% | 1.1% | 1.5% | 1.7% | 1.2% | 0.9% | 0.3% | 0.7% | 0.6% | 0.3% |
| 2026 | 91,892 | 19% | 9.4% | 17% | 7.2% | 4.8% | 4.7% | 6.1% | 5.3% | 4.5% | 5.8% | 3.0% | 1.3% | 1.6% | 1.7% | 1.9% | 2.3% | 2.5% | 0.3% | 1.0% | 0.5% | 0.4% |
Data as of 2026-11-14. CVE List through 2026-11-14 · EPSS of 2026-11-14 · CISA KEV checked 2026-11-14. Sources: the CVE List, CISA KEV, EPSS, NVD, nuclei templates and public bug bounty data. Use this via MCP