Cybersecurity statistics,
with the sources attached
Every number on this page is computed directly from the organisation that published it, at the moment this page was built. No vendor surveys, no recycled figures, no statistic whose origin nobody can find.
Last rebuilt August 10, 2026 · sources CISA and NIST
What the numbers actually say
Short enough to quote, sourced enough to defend.
- Roughly 341 new vulnerabilities are published every day. Only about one in 280 is ever confirmed as actually exploited.
- One in five confirmed-exploited vulnerabilities is tied to a ransomware campaign. That is the subset worth losing sleep over.
- Microsoft accounts for 23.0% of everything CISA has confirmed as exploited. Vendor concentration is an exposure decision, not just a procurement one.
- Volume is not the problem. Selection is. The organisations that do well are not the ones patching fastest, they are the ones choosing correctly.
Exploited vulnerabilities added per year
CISA Known Exploited Vulnerabilities catalogue, by the year each entry was added.
| Year | Added | |
|---|---|---|
| 2021 | 311 | |
| 2022 | 555 | |
| 2023 | 187 | |
| 2024 | 186 | |
| 2025 | 245 | |
| 2026 | 178 |
Where exploited vulnerabilities concentrate
Top vendors by number of entries in the exploited catalogue.
| Vendor | Entries | Share |
|---|---|---|
| Microsoft | 382 | 23.0% |
| Cisco | 95 | 5.7% |
| Apple | 93 | 5.6% |
| Adobe | 80 | 4.8% |
| 72 | 4.3% | |
| Oracle | 45 | 2.7% |
| Apache | 40 | 2.4% |
| Ivanti | 35 | 2.1% |
Method
Sources. The CISA Known Exploited Vulnerabilities catalogue, catalogue version 2026.08.10, and the NIST National Vulnerability Database via CVE API 2.0. Both are the originating authority for their figures.
Freshness. This page is rebuilt from the live sources. If a source cannot be reached, the build fails and the page is left alone rather than republished with an updated date and unchanged numbers.
One caveat, stated plainly. The KEV catalogue is cumulative since 2021. NVD counts are period-bound. Where the two are compared, the comparison is restricted to the same calendar year and labelled as such. Most published vulnerability statistics quietly mix the two and produce a number that means nothing.
Reuse. Cite it, quote it, screenshot it. A link back to marklynd.com/stats is appreciated.