Vulnerability landscape by sector
Over the last 12 months, Operating Systems carried 19% of sector-tagged CVEs, and Databases grew fastest, +270% on the year before.
Sectors by CVEs over the last 12 months
- Operating Systems18,010+78%
- Web & CMS Plugins15,077+22%
- Open Source Libraries12,592+145%
- Enterprise Software10,314+67%
- Consumer Software6,933+198%
- Networking & Infrastructure5,567+65%
- Security Products3,996+143%
- Cloud & SaaS3,876+195%
- Databases3,735+270%
- 6 smaller sectors12,967
- Hardware & Firmware2,797+34%
- ICS, OT & IoT2,458+47%
- AI & ML2,257+161%
- Developer Tools & CI/CD2,223+173%
- Communications1,764+155%
- Mobile Apps1,468−29%
A CVE that touches products in several sectors counts in each of them. Critical and CISA KEV counts are held back while the sector snapshots are recounted.
All sectors
- 1Operating SystemsTrack CVEs across operating systems — Linux distributions, Windows, macOS, Android, iOS and BSD.18,010+78%80,485all time
- 2Web & CMS PluginsVulnerabilities in WordPress plugins and themes, CMS cores, e-commerce platforms and site builders.15,077+22%68,828all time
- 3Open Source LibrariesCVEs across npm, PyPI, Maven, Go, RubyGems, Cargo and other package ecosystems.12,592+145%52,679all time
- 4Enterprise SoftwareCVEs in ERP, CRM, HR and finance systems, collaboration suites and ITSM/monitoring.10,314+67%49,623all time
- 5Consumer SoftwareVulnerabilities in browsers, media players, productivity apps, games and utilities.6,933+198%26,786all time
- 6Networking & InfrastructureCVEs in routers, switches, firewalls, VPN gateways, DNS and proxies.5,567+65%29,101all time
- 7Security ProductsCVEs in AV/EDR, SIEM, IAM, vulnerability scanners and PKI.3,996+143%17,560all time
- 8Cloud & SaaSVulnerabilities in cloud platforms, SaaS applications, virtualization and container orchestration.3,876+195%13,315all time
- 9DatabasesCVEs in relational and NoSQL databases, data warehouses, caches and message queues.3,735+270%16,222all time
- 10Hardware & FirmwareCVEs in BIOS/UEFI, CPUs and GPUs, storage, printers and network adapters.2,797+34%15,498all time
- 11ICS, OT & IoTVulnerabilities in industrial control systems, SCADA/PLC, building automation, medical devices and IP cameras.2,458+47%12,805all time
- 12AI & MLCVEs in LLM serving and inference, ML frameworks, vector databases and agent tooling.2,257+161%4,884all time
- 13Developer Tools & CI/CDVulnerabilities in IDEs, CI/CD pipelines, source control and artifact registries.2,223+173%9,073all time
- 14CommunicationsVulnerabilities in email servers and clients, messaging, VoIP and video conferencing.1,764+155%8,541all time
- 15Mobile AppsVulnerabilities in Android and iOS applications and cross-platform mobile frameworks.1,468−29%23,470all time