CVE Statistics by Vendor (2026)
This page tracks how many CVEs each major vendor has accumulated in 2026, broken down by severity, active exploitation, and average CVSS score. Data is pulled directly from our CVE Watchtower database and refreshes automatically as new vulnerabilities are published. Use it to benchmark vendor risk, prioritize your patch queue, or cite in security reports.
Last updated: September 18, 2026 · CVE-2026-* identifiers tracked by CVE Watchtower
| # | Vendor | Share | CVEs | Critical | High | Exploited | Avg CVSS |
|---|---|---|---|---|---|---|---|
| 1 | WordPress ecosystem | 6855 | 660 | 2369 | 10 | 6.7 | |
| 2 | Linux kernel | 5980 | 519 | 2513 | 3 | 7.4 | |
| 3 | Microsoft | 3821 | 272 | 2334 | 27 | 7.4 | |
| 4 | 3210 | 341 | 1190 | 7 | 6.9 | ||
| 5 | Oracle | 2673 | 515 | 1285 | 3 | 7.5 | |
| 6 | IBM | 894 | 125 | 430 | 1 | 7.3 | |
| 7 | Apple | 893 | 74 | 215 | 3 | 6.7 | |
| 8 | Mozilla | 492 | 158 | 168 | 0 | 8.1 | |
| 9 | Adobe | 438 | 55 | 116 | 3 | 6.6 | |
| 10 | Cisco | 330 | 58 | 112 | 15 | 7.1 | |
| 11 | D-Link | 250 | 48 | 116 | 0 | 7.5 | |
| 12 | Samsung | 227 | 0 | 27 | 0 | 6.0 | |
| 13 | GitLab | 175 | 7 | 52 | 1 | 5.9 | |
| 14 | SAP | 160 | 21 | 25 | 0 | 6.1 | |
| 15 | Palo Alto Networks | 79 | 1 | 0 | 2 | 5.1 | |
| 16 | Fortinet | 72 | 11 | 19 | 6 | 6.5 | |
| 17 | Juniper | 66 | 3 | 28 | 0 | 6.9 | |
| 18 | Atlassian | 43 | 5 | 15 | 0 | 7.2 | |
| 19 | Ivanti | 39 | 11 | 22 | 5 | 8.2 | |
| 20 | VMware | 32 | 7 | 15 | 2 | 7.7 |
Frequently Asked Questions
Why does WordPress top the list with nearly 6,500 CVEs?
WordPress core itself is secure. The count reflects the entire WordPress ecosystem — thousands of third-party plugins and themes, many maintained by small teams with limited security resources. With 639 Critical and 2,292 High-severity CVEs in 2026, keeping plugins updated is often more important than patching the WordPress core.
Which vendors have the most actively exploited CVEs?
Look at the Exploited column, not the total count. Microsoft leads with 27 exploited CVEs, followed by Cisco with 13, WordPress ecosystem with 10, and Google with 7. These are confirmed in the CISA KEV catalog, meaning attackers are actively using them. A high total count matters far less than a high exploited count.
Why does Linux kernel rank second with nearly 5,000 CVEs?
The Linux kernel runs billions of devices worldwide, from servers to smartphones. Its codebase is enormous and open, so thousands of researchers audit it continuously. High CVE volume here reflects transparency and active research, not poor security. Notably, only 2 Linux kernel CVEs reached confirmed exploitation in 2026.
Microsoft has fewer CVEs than WordPress but more exploited ones. Why?
Microsoft recorded 3,751 total CVEs versus WordPress’s 6,497 — yet Microsoft has 27 exploited CVEs against WordPress’s 10. Microsoft’s enterprise software is a high-value target, so attackers invest more effort weaponizing its vulnerabilities. This is exactly why total count alone is a poor risk measure.
What does the “Exploited” column actually mean?
It counts how many of a vendor’s 2026 CVEs have been added to the CISA Known Exploited Vulnerabilities (KEV) catalog. Cisco stands out here: despite only 245 total CVEs, 13 are actively exploited — a high exploitation ratio that makes Cisco a priority for defenders running its products.
Which vendors have the highest average severity?
Average CVSS reveals severity concentration. Mozilla and Ivanti both average 8.2 — the highest in the top 20 — reflecting the serious nature of browser and remote-access vulnerabilities. Oracle follows at 7.5. A high average CVSS means that when a CVE does appear, it tends to be severe.
How is vendor attribution determined?
Each CVE’s references are matched against official vendor advisory domains first — for example Cisco PSIRT or Microsoft MSRC — with description keywords as a fallback. One primary vendor is assigned per CVE. For the WordPress ecosystem, we match against wpscan.com, patchstack.com, and wordfence.com, so a plugin vulnerability is grouped under “WordPress ecosystem” rather than the individual developer.