CYBORA OpenCVE Statistics
A reference view of how many vulnerabilities the world is publishing right now, and how severe they are — inspired by app.opencve.io/statistics.
CVE publication activity
Snapshot captured 2026-07-10 — this is a point-in-time reference, not a live feed; view current figures directly on OpenCVE.
Global CVSS distribution
Every published CVE, grouped by its CVSS score band — the same reference dataset used on the Cyber Malware Map, since it's one global CVE population viewed from two angles.
Which vendors and products carry the most CVEs
These rankings shift too often to snapshot meaningfully on a static page — a vendor can jump the list after a single disclosure batch. For the current, live ranking of top vendors and top products, see OpenCVE directly:
Reading these numbers correctly
A rising CVE count isn't necessarily a sign the world is getting less secure — it's mostly a sign that more software is being written, more researchers are looking for flaws, and disclosure has become the industry norm rather than the exception. What matters far more than the raw volume is where a given vulnerability sits: whether it's in something your organisation actually runs, whether it's being actively exploited (see the CISA KEV catalog on the Cyber Malware Map), and how quickly it can realistically be remediated once found. The CVSS distribution above tells a similar story — most published vulnerabilities cluster in the High and Medium bands, which is exactly why triage matters: a security team that patches everything in score order, ignoring real-world exploitation, will always be behind. CYBORA's Agentic GRC continuously maps this kind of external vulnerability data against your own live systems, so the question stops being "how many CVEs exist today" and becomes the one that actually matters: "which of these apply to us, and what do we do about it first."