About

what this counts, and what it does not

CVEDB counts CVEs. That is the whole product: how many were published this year, how many all time, and how those break down by publisher, product and weakness type. Nothing here is weighted, scored or prioritised by us.

Where the numbers come from

How counting works

Counts that add up

Each CVE is published by exactly one authority and belongs to exactly one year, so yearly and publisher counts sum to the total.

A day's count is the CVEs published that day. Publication is bursty: a single publisher can file thousands at once, so daily figures swing hard.

Counts that do not

A CVE can name many affected products, so product counts sum to far more than the number of CVEs.

A CVE can also hold a CVSS score under several metric versions at once. The total scored figure counts scores, not CVEs, which is why it can exceed the number of CVEs that exist.

Not every CVE carries a weakness type, so those counts cover a subset.

Freshness

The site rebuilds hourly. Its data comes from an upstream mirror of the NVD and CVE Program records, so the site can never be fresher than that feed — both timestamps are shown below and in the header.

Using the data

Every number on this site is read from a JSON file you can fetch directly at cvedb.github.io/data/. No key, no rate limit, no registration. If you want the counts rather than the pages, start there.

Built with

Python builds the data and renders static pages with Jinja. The pages ship no charting library — the charts here are counts, and counts draw fine with SVG and CSS. Hosted on GitHub Pages. Source is on GitHub.