CVE statisticsVulnerabilities, exploitation and fixes: the numbers in our database

Every number on this page is recalculated daily from the Noroxi CVE database. Sources are the CVE List, NVD, CISA KEV, FIRST EPSS and wordpress.org; percentages are rounded down.

Measured: November 12, 2026

Cite as: Noroxi, "CVE statistics", November 12, 2026, https://noroxi.com/en/cve/statistics. License CC BY 4.0.

Volume

The database holds 409,664 published CVE and GHSA records. 97,895 were published in 2026 so far and 48,605 in 2025.

Published records: 409,664
2026 (so far): 97,895
2025: 48,605

Exploitation

CISA added 320 vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog in the last 12 months. Half of them were added within 10 days of the record being published.
38 of the vulnerabilities added to KEV in the last 12 months (11%) were more than 3 years old when added.
4,437 records have a weaponized exploit (a Metasploit module or a KEV entry) and 34,251 have a public proof of concept.
3% of the 105,069 records published in the last 12 months (3,729) have exploit code or a KEV entry.

Exploited this week

Added to KEV (last 12 months): 320
Median publish → KEV: 10 days
Older than 3 years when added: 38 · 11%
Weaponized exploit: 4,437
Public PoC: 34,251
Last 12 months' records with an exploit or KEV: 3,729 · 3%

Severity is not exploitation

11% of KEV vulnerabilities (205) are scored below CVSS 7. A team that prioritizes by CVSS alone misses them.
Of the 11,206 records scored CVSS 9 or higher in the last 12 months, only 10% (1,168) have exploit code or a KEV entry.
17,541 records have an EPSS score of 10% or more (probability of exploitation in the next 30 days, FIRST). 87% of them are more than 3 years old.

In KEV with CVSS below 7: 205 · 11%
CVSS 9+ records with an exploit or KEV: 1,168 · 10%
EPSS 10% and above: 17,541
Of those, older than 3 years: 87%

Fixes and scores

53% of the 105,069 records published in the last 12 months have fix data (a fixed version or a vendor advisory).
For 23% of the 64,920 records scored by both NVD and the issuing CNA (15,116), the two scores differ by 2 points or more.

With fix information (last 12 months): 53%
NVD vs CNA gap of 2 points or more: 15,116 · 23%

WordPress

We track 14,379 WordPress plugins and 1,569 themes with at least one known vulnerability (39,326 records).
6,211 of these plugins (43%) are closed on wordpress.org: no updates will come, so they need to be removed or replaced.
931 plugins have a vulnerability that is not fixed in the latest release (no official patch).
48% of WordPress vulnerability records (19,211) can be exploited without logging in.

List of closed plugins

Plugins with a known issue: 14,379
Themes with a known issue: 1,569
WordPress records: 39,326
Closed plugins: 6,211 · 43%
Plugins without a patch: 931
Records needing no login: 19,211 · 48%

Türkiye national advisories

8,326 national security notices from Türkiye's Cyber Security Directorate reference 50,215 CVE records.

National advisories

National notices: 8,326
CVE records cited: 50,215

Scan data

Rates from scans run with our free tools (for example the share of sites without DMARC) are published only once a check has been measured on at least 100 different domains. That threshold has not been reached yet; we do not generalise from small samples.

Method

Records come daily from the CVE List (cvelistV5), NVD and the GitHub Advisory Database (GHSA); only PUBLISHED records are counted.
KEV status and date added come from the CISA catalog; EPSS from FIRST's daily file; weaponized means a Metasploit module or KEV entry, PoC means a public exploit repository entry (no links are given).
"Last 12 months" is the 365 days before the measurement time, with UTC day boundaries. Percentages are rounded down; no rate is given when the base is below 30.
WordPress figures come from component mapping (plugin/theme ↔ record) and wordpress.org status; an unpatched vulnerability is counted only when the record's affected range ends at the latest wordpress.org release.

Scoring and prioritization method

Sources and download

Raw data: open data dump (CC BY 4.0)