Security Products
17,560 CVEs tracked since 1999. In the last 12 months, 3,996, +143% on the 12 before.
Security Products by subsector, Oct 2026 so far
- Identity & access13428% · 22 vendors
- Vulnerability scanners12627% · 18 vendors
- Not yet sub-classified111The tagger has not placed these yet
- PKI & crypto398% · 3 vendors
- Secure gateways & VPN368% · 8 vendors
Also: SIEM & SOAR 18, Endpoint, AV & EDR 9.
Month by month
Every monthly snapshot of Security Products. A column is the CVEs published that month.
| Month | CVEs |
|---|---|
| 2021-10 | 50 |
| 2021-11 | 96 |
| 2021-12 | 120 |
| 2022-01 | 75 |
| 2022-02 | 69 |
| 2022-03 | 109 |
| 2022-04 | 80 |
| 2022-05 | 145 |
| 2022-06 | 82 |
| 2022-07 | 78 |
| 2022-08 | 80 |
| 2022-09 | 91 |
| 2022-10 | 130 |
| 2022-11 | 99 |
| 2022-12 | 90 |
| 2023-01 | 99 |
| 2023-02 | 111 |
| 2023-03 | 0 |
| 2023-04 | 94 |
| 2023-05 | 95 |
| 2023-06 | 159 |
| 2023-07 | 70 |
| 2023-08 | 149 |
| 2023-09 | 127 |
| 2023-10 | 166 |
| 2023-11 | 96 |
| 2023-12 | 121 |
| 2024-01 | 129 |
| 2024-02 | 123 |
| 2024-03 | 114 |
| 2024-04 | 121 |
| 2024-05 | 176 |
| 2024-06 | 86 |
| 2024-07 | 101 |
| 2024-08 | 126 |
| 2024-09 | 121 |
| 2024-10 | 165 |
| 2024-11 | 184 |
| 2024-12 | 116 |
| 2025-01 | 197 |
| 2025-02 | 126 |
| 2025-03 | 152 |
| 2025-04 | 99 |
| 2025-05 | 130 |
| 2025-06 | 132 |
| 2025-07 | 152 |
| 2025-08 | 107 |
| 2025-09 | 86 |
| 2025-10 | 235 |
| 2025-11 | 131 |
| 2025-12 | 167 |
| 2026-01 | 149 |
| 2026-02 | 283 |
| 2026-03 | 449 |
| 2026-04 | 423 |
| 2026-05 | 343 |
| 2026-06 | 301 |
| 2026-07 | 336 |
| 2026-08 | 532 |
| 2026-09 | 647 |
| 2026-10 | 473 |
Vendors
Who shipped the most Security Products CVEs in Oct 2026 so far, with their rank across all vendors.
Weaknesses
The weakness classes behind Security Products CVEs in Oct 2026 so far.
Latest CVEs
The 15 most recently published vulnerabilities in Security Products.
- CVE-2026-118194Page and Post Restriction <= 1.6.1 - Unauthenticated Authentication Bypass via REST API Nonce Bypass via Cookie Re-Authentication6.5
- CVE-2026-91920Undertow: undertow: chunkreader message length permits chunk-size overflow6.5
- CVE-2026-118959Keycloak-services: keycloak-services: required actions bypassed via kc_action parameter5.4
- CVE-2026-118947Keycloak-services: keycloak-services: authorization bypass via uma resource registration idor4.3
- CVE-2026-92744Delinea Privilege Manager agent unauthenticated remote code execution vulnerability—
- CVE-2026-45049OpenAM Session Hijacking via CDSSO8.3
- CVE-2026-119317Incorrect Authorization6.5
- CVE-2026-119191Forge: ASN.1 resource exhaustion via BIT STRING decoding in asn1.fromDer7.5
- CVE-2026-119190Forge: X.509 basicConstraints bypass in verifyCertificateChain() via deprecated extension OIDs 2.5.29.10 and 2.5.29.137.4
- CVE-2026-119189Forge: X.509 pathLenConstraint not enforced by verifyCertificateChain() for CA certificates without keyUsage5.9
- CVE-2026-119188Forge: Denial of service in TLS record processing via a record interleaved with a fragmented handshake message7.5
- CVE-2026-119187Forge: Denial of service in TLS record processing via call stack exhaustion7.5
- CVE-2026-119186Forge: AES-GCM authentication bypass via unvalidated tagLength option5.9
- CVE-2026-118782Forge: PKCS#12 MAC forgery and constant-key PBE via zero iteration count7.5
- CVE-2026-118781Forge: Denial of Service via infinite loop in BigInteger.modInverse() with negative input (incomplete fix of CVE-2026-33891)2.9
The record
- Busiest month
- Sep 2026, 647 CVEs
- Oct 2026 so far
- 473 CVEs from 69 vendors
- Deployment
- On-prem, 84%
- Monthly snapshots
- 296 since 1999
Is your business exposed to threats like these?
Discuss a security assessment of your internet-facing systems. Scope, price and timing agreed before testing.
Request an assessment