Operating Systems
80,485 CVEs tracked since 1999. In the last 12 months, 18,010, +78% on the 12 before.
Operating Systems by subsector, Oct 2026 so far
- Windows1,22646% · 1 vendor
- Linux distributions1,15243% · 19 vendors
- 4 smaller subsectors289
- Mobile OS103
- macOS, Unix & BSD85
- RTOS & embedded OS74
- Not yet sub-classified27
Month by month
Every monthly snapshot of Operating Systems. A column is the CVEs published that month.
| Month | CVEs |
|---|---|
| 2021-10 | 335 |
| 2021-11 | 308 |
| 2021-12 | 361 |
| 2022-01 | 463 |
| 2022-02 | 402 |
| 2022-03 | 385 |
| 2022-04 | 570 |
| 2022-05 | 293 |
| 2022-06 | 335 |
| 2022-07 | 532 |
| 2022-08 | 493 |
| 2022-09 | 475 |
| 2022-10 | 387 |
| 2022-11 | 394 |
| 2022-12 | 452 |
| 2023-01 | 357 |
| 2023-02 | 380 |
| 2023-03 | 0 |
| 2023-04 | 373 |
| 2023-05 | 332 |
| 2023-06 | 442 |
| 2023-07 | 469 |
| 2023-08 | 493 |
| 2023-09 | 442 |
| 2023-10 | 445 |
| 2023-11 | 398 |
| 2023-12 | 374 |
| 2024-01 | 409 |
| 2024-02 | 703 |
| 2024-03 | 592 |
| 2024-04 | 892 |
| 2024-05 | 1516 |
| 2024-06 | 591 |
| 2024-07 | 903 |
| 2024-08 | 726 |
| 2024-09 | 650 |
| 2024-10 | 891 |
| 2024-11 | 738 |
| 2024-12 | 725 |
| 2025-01 | 795 |
| 2025-02 | 1304 |
| 2025-03 | 623 |
| 2025-04 | 779 |
| 2025-05 | 929 |
| 2025-06 | 734 |
| 2025-07 | 908 |
| 2025-08 | 584 |
| 2025-09 | 1134 |
| 2025-10 | 1116 |
| 2025-11 | 501 |
| 2025-12 | 1379 |
| 2026-01 | 636 |
| 2026-02 | 503 |
| 2026-03 | 598 |
| 2026-04 | 761 |
| 2026-05 | 2693 |
| 2026-06 | 1201 |
| 2026-07 | 1989 |
| 2026-08 | 2693 |
| 2026-09 | 3940 |
| 2026-10 | 2667 |
Vendors
Who shipped the most Operating Systems CVEs in Oct 2026 so far, with their rank across all vendors.
Weaknesses
The weakness classes behind Operating Systems CVEs in Oct 2026 so far.
Latest CVEs
The 15 most recently published vulnerabilities in Operating Systems.
- CVE-2026-115455Gcc: stack overflow in std::bitset on libstdc++6.5
- CVE-2026-114691Gcc: integer wrap in `std5.9
- CVE-2026-114690Gcc: confirmed out-of-bounds read/write in libstdc++ parallel `std6.2
- CVE-2026-118593Kernel: local_bh imbalance in seg6_input_core() drop path (incomplete fix for cve-2026-46099)5.9
- CVE-2026-118952Kroxylicious-authorizer-acl: kroxylicious: acl prefix matching can bypass authorization rules6.5
- CVE-2026-103963Glib-networking: unbounded tls 1.3 session ticket queue growth in glib-networking allows remote denial of service7.5
- CVE-2026-118475Eog: eye of gnome: buffer overrun when parsing malicious png files with non-standard iccp chunk3.6
- CVE-2026-112922Ghostscript: out-of-bounds read in ghostscript shade_next_color via integer overflow of indexed color index in mesh shading3.3
- CVE-2026-91920Undertow: undertow: chunkreader message length permits chunk-size overflow6.5
- CVE-2026-112605This issue was addressed with improved handling of symlinks. This issue is fixed in Xcode 27.2. An app may be able to read arbitrary files.—
- CVE-2026-112602An authorization issue was addressed with improved state management. This issue is fixed in Xcode 27.2. An app may be able to access sensitive user data.—
- CVE-2026-110133Ghostscript: heap buffer overflow in ghostscript truetype outliner due to npointstotal integer underflow during retry rollback5.8
- CVE-2026-92092Openshift-ansible: openshift-ansible: installer container downloads and executes remote inventory script without integrity verification7.4
- CVE-2026-114148ASP.NET Core Elevation of Privilege Vulnerability7.8
- CVE-2026-93009Dnsmasq: dnsmasq: heap out-of-bounds read in dhcpv6 option 39 fqdn decoder4.3
The record
- Busiest month
- Sep 2026, 3,940 CVEs
- Oct 2026 so far
- 2,667 CVEs from 43 vendors
- Deployment
- On-prem, 96%
- Monthly snapshots
- 301 since 1999
Is your business exposed to threats like these?
Discuss a security assessment of your internet-facing systems. Scope, price and timing agreed before testing.
Request an assessment