Rankings: All-time CVE charts
How the CVEs on the board score, and why. How the score works.
Chart
Score against CVSS
Each dot is a CVE on the board. CVSS rates how bad a bug could be; the Index adds whether it is exploited, exposed and widely used.
- CVE-2016-5198 Google Chrome prior to 54.0.2840.90 for Linux, and 54.0.284…: score 96, CVSS 8.8, In CISA KEV
- CVE-2025-39682 Linux · :linux_kernel:: score 95, CVSS 9.8, In CISA KEV
- CVE-2026-104935 Ivanti Connect Secure: score 94, CVSS 8.6, In CISA KEV
- CVE-2026-10520 ivanti Sentry: score 94, CVSS 10, In CISA KEV
- CVE-2026-1281 Ivanti Endpoint Manager Mobile: score 94, CVSS 9.8, In CISA KEV
- CVE-2025-59718 Fortinet FortiSwitchManager · Fortinet FortiOS +1: score 94, CVSS 9.1, In CISA KEV
- CVE-2020-0618 Microsoft SQL Server: score 94, CVSS 9.8, In CISA KEV
- CVE-2024-21762 Fortinet FortiOS · Fortinet FortiProxy: score 94, CVSS 9.6, In CISA KEV
- CVE-2023-20198 Cisco IOS XE Software: score 94, CVSS 10, In CISA KEV
- CVE-2024-38475 Apache Software Foundation Apache HTTP Server: score 93, CVSS 9.1, In CISA KEV
- CVE-2020-3566 Cisco IOS XR Software: score 93, CVSS 8.6, In CISA KEV
- CVE-2020-3569 Cisco IOS XR Software: score 93, CVSS 8.6, In CISA KEV
- CVE-2026-63030 WordPress: score 92, CVSS 9.8, In CISA KEV
- CVE-2026-111497 Google Brotli · node +7: score 92, CVSS 9.2, In CISA KEV
- CVE-2026-48710 Kludex starlette · starlette: score 92, CVSS 6.5, In CISA KEV
- CVE-2026-45321 @tanstack arktype-adapter · @tanstack eslint-plugin-rou… +82: score 92, CVSS 9.6, In CISA KEV
- CVE-2025-55182 Meta react-server-dom-webpack · Meta react-server-dom-tu… +4: score 92, CVSS 10, In CISA KEV
- CVE-2025-6558 Google Chrome: score 92, CVSS 8.8, In CISA KEV
- CVE-2024-4947 Google Chrome: score 92, CVSS 9.6, In CISA KEV
- CVE-2024-4671 Google Chrome: score 92, CVSS 9.6, In CISA KEV
- CVE-2023-46805 Ivanti ICS · Ivanti IPS: score 92, CVSS 8.2, In CISA KEV
- CVE-2023-6345 Google Chrome: score 92, CVSS 9.6, In CISA KEV
- CVE-2023-2136 Google Chrome: score 92, CVSS 9.6, In CISA KEV
- CVE-2022-4135 Google Chrome · electron: score 92, CVSS 9.6, In CISA KEV
- CVE-2022-3075 Google Chrome: score 92, CVSS 9.6, In CISA KEV
- CVE-2021-44228 Apache Software Foundation Apache Log4j2 · org.apache.lo… +4: score 92, CVSS 10, In CISA KEV
- CVE-2020-15999 Google Chrome · CefSharp.Common +3: score 92, CVSS 9.6, In CISA KEV
- CVE-2020-16010 Google Chrome: score 92, CVSS 9.6, In CISA KEV
- CVE-2020-16017 Google Chrome · CefSharp.Common +3: score 92, CVSS 9.6, In CISA KEV
- CVE-2021-30633 Google Chrome: score 92, CVSS 9.6, In CISA KEV
- CVE-2021-37973 Google Chrome: score 92, CVSS 9.6, In CISA KEV
- CVE-2021-41773 Apache Software Foundation Apache HTTP Server: score 92, CVSS 7.5, In CISA KEV
- CVE-2026-87491 Google Chrome: score 91, CVSS 8.8, In CISA KEV
- CVE-2026-85046 Google Chrome: score 91, CVSS 8.8, In CISA KEV
- CVE-2026-59822 BerriAI litellm · litellm: score 91, CVSS 8.8, In CISA KEV
- CVE-2025-62593 ray-project ray · ray: score 91, CVSS 9.4, In CISA KEV
- CVE-2026-11645 Google Chrome: score 91, CVSS 8.8, In CISA KEV
- CVE-2026-42208 BerriAI litellm · litellm: score 91, CVSS 9.3, In CISA KEV
- CVE-2026-1340 Ivanti Endpoint Manager Mobile: score 91, CVSS 9.8, In CISA KEV
- CVE-2026-5281 Google Chrome: score 91, CVSS 8.8, In CISA KEV
- CVE-2026-3909 Google Chrome: score 91, CVSS 8.8, In CISA KEV
- CVE-2026-3910 Google Chrome: score 91, CVSS 8.8, In CISA KEV
- CVE-2026-2441 Google Chrome: score 91, CVSS 8.8, In CISA KEV
- CVE-2025-14174 Google Chrome: score 91, CVSS 8.8, In CISA KEV
- CVE-2025-13223 Google Chrome: score 91, CVSS 8.8, In CISA KEV
- CVE-2025-10585 Google Chrome: score 91, CVSS 8.8, In CISA KEV
- CVE-2025-5419 Google Chrome: score 91, CVSS 8.8, In CISA KEV
- CVE-2025-0282 Ivanti Connect Secure · Ivanti Policy Secure +1: score 91, CVSS 9, In CISA KEV
- CVE-2024-13159 Ivanti Endpoint Manager: score 91, CVSS 9.8, In CISA KEV
- CVE-2024-13160 Ivanti Endpoint Manager: score 91, CVSS 9.8, In CISA KEV
- CVE-2024-13161 Ivanti Endpoint Manager: score 91, CVSS 9.8, In CISA KEV
- CVE-2024-55591 Fortinet FortiOS · Fortinet FortiProxy: score 91, CVSS 9.6, In CISA KEV
- CVE-2024-23113 Fortinet FortiSwitchManager · Fortinet FortiOS +2: score 91, CVSS 9.8, In CISA KEV
- CVE-2024-7593 Ivanti vTM: score 91, CVSS 9.8, In CISA KEV
- CVE-2024-7965 Google Chrome: score 91, CVSS 8.8, In CISA KEV
- CVE-2024-7971 Google Chrome: score 91, CVSS 8.8, In CISA KEV
- CVE-2023-4762 Google Chrome: score 91, CVSS 8.8, In CISA KEV
- CVE-2023-35082 Ivanti EPMM: score 91, CVSS 10, In CISA KEV
- CVE-2024-0519 Google Chrome: score 91, CVSS 8.8, In CISA KEV
- CVE-2023-7024 Google Chrome: score 91, CVSS 8.8, In CISA KEV
- CVE-2023-5217 Google Chrome · Google libvpx +1: score 91, CVSS 8.8, In CISA KEV
- CVE-2023-4863 Google Chrome · Google libwebp +13: score 91, CVSS 8.8, In CISA KEV
- CVE-2023-35078 Ivanti Endpoint Manager Mobile: score 91, CVSS 10, In CISA KEV
- CVE-2023-3079 Google Chrome: score 91, CVSS 8.8, In CISA KEV
- CVE-2023-2033 Google Chrome: score 91, CVSS 8.8, In CISA KEV
- CVE-2022-3038 Google Chrome: score 91, CVSS 8.8, In CISA KEV
- CVE-2022-27518 Citrix Gateway, Citrix ADC: score 91, CVSS 9.8, In CISA KEV
- CVE-2022-4262 Google Chrome: score 91, CVSS 8.8, In CISA KEV
- CVE-2022-3723 Google Chrome: score 91, CVSS 8.8, In CISA KEV
- CVE-2022-2294 Google Chrome: score 91, CVSS 8.8, In CISA KEV
- CVE-2022-1364 Google Chrome: score 91, CVSS 8.8, In CISA KEV
- CVE-2022-1096 Google Chrome: score 91, CVSS 8.8, In CISA KEV
- CVE-2017-5030 Google Chrome prior to 57.0.2987.98 for Linux, Windows and…: score 91, CVSS 8.8, In CISA KEV
- CVE-2017-5070 Google Chrome prior to 59.0.3071.86 for Linux, Windows and…: score 91, CVSS 8.8, In CISA KEV
- CVE-2018-17463 Google Chrome: score 91, CVSS 8.8, In CISA KEV
- CVE-2018-17480 Google Chrome: score 91, CVSS 8.8, In CISA KEV
- CVE-2018-6065 Google Chrome: score 91, CVSS 8.8, In CISA KEV
- CVE-2019-13720 Google Chrome: score 91, CVSS 8.8, In CISA KEV
- CVE-2022-0609 Google Chrome · CefSharp.Common +8: score 91, CVSS 8.8, In CISA KEV
- CVE-2021-4102 Google Chrome: score 91, CVSS 8.8, In CISA KEV
- CVE-2020-6572 Google Chrome: score 91, CVSS 8.8, In CISA KEV
- CVE-2021-38003 Google Chrome: score 91, CVSS 8.8, In CISA KEV
- CVE-2020-16009 Google Chrome · CefSharp.Common +3: score 91, CVSS 8.8, In CISA KEV
- CVE-2020-16013 Google Chrome · CefSharp.Common +3: score 91, CVSS 8.8, In CISA KEV
- CVE-2020-6418 Google Chrome: score 91, CVSS 8.8, In CISA KEV
- CVE-2021-21148 Google Chrome: score 91, CVSS 8.8, In CISA KEV
- CVE-2021-21166 Google Chrome: score 91, CVSS 8.8, In CISA KEV
- CVE-2021-21193 Google Chrome: score 91, CVSS 8.8, In CISA KEV
- CVE-2021-21206 Google Chrome: score 91, CVSS 8.8, In CISA KEV
- CVE-2021-21220 Google Chrome: score 91, CVSS 8.8, In CISA KEV
- CVE-2021-21224 Google Chrome: score 91, CVSS 8.8, In CISA KEV
- CVE-2021-30551 Google Chrome: score 91, CVSS 8.8, In CISA KEV
- CVE-2021-30554 Google Chrome: score 91, CVSS 8.8, In CISA KEV
- CVE-2021-30563 Google Chrome: score 91, CVSS 8.8, In CISA KEV
- CVE-2021-30632 Google Chrome: score 91, CVSS 8.8, In CISA KEV
- CVE-2021-37975 Google Chrome: score 91, CVSS 8.8, In CISA KEV
- CVE-2026-64849 mlflow: score 90, CVSS 9.3, In CISA KEV
- CVE-2026-1603 Ivanti Endpoint Manager: score 90, CVSS 8.6, In CISA KEV
- CVE-2026-24858 Fortinet FortiWeb · Fortinet FortiNAC-F +4: score 90, CVSS 9.4, In CISA KEV
- CVE-2025-54313 eslint-config-prettier · eslint-plugin-prettier +4: score 90, CVSS 7.5, In CISA KEV
Chart
What drives the top scores
The top 15 CVEs, with each score split into its parts.
- Google Chrome prior to 54.0.2840.90 for Linux, and 54.0.284…CVE-2016-5198Exploitation 40, Exposure 22, Reach 20, Severity 8.8, No patch 596
- Linux · :linux_kernel:CVE-2025-39682Exploitation 40, Exposure 25, Reach 20, Severity 10, No patch 095
- Ivanti Connect SecureCVE-2026-104935Exploitation 40, Exposure 25, Reach 14, Severity 9.6, No patch 594
- ivanti SentryCVE-2026-10520Exploitation 40, Exposure 25, Reach 14, Severity 10, No patch 594
- Ivanti Endpoint Manager MobileCVE-2026-1281Exploitation 40, Exposure 25, Reach 14, Severity 10, No patch 594
- Fortinet FortiSwitchManager · Fortinet FortiOS +1CVE-2025-59718Exploitation 40, Exposure 25, Reach 14, Severity 10, No patch 594
- Microsoft SQL ServerCVE-2020-0618Exploitation 40, Exposure 22, Reach 17, Severity 9.8, No patch 594
- Fortinet FortiOS · Fortinet FortiProxyCVE-2024-21762Exploitation 40, Exposure 25, Reach 14, Severity 10, No patch 594
- Cisco IOS XE SoftwareCVE-2023-20198Exploitation 40, Exposure 22, Reach 17, Severity 10, No patch 594
- Apache Software Foundation Apache HTTP ServerCVE-2024-38475Exploitation 40, Exposure 22, Reach 17, Severity 9.1, No patch 593
- Cisco IOS XR SoftwareCVE-2020-3566Exploitation 40, Exposure 22, Reach 17, Severity 8.6, No patch 593
- Cisco IOS XR SoftwareCVE-2020-3569Exploitation 40, Exposure 22, Reach 17, Severity 8.6, No patch 593
- WordPressCVE-2026-63030Exploitation 40, Exposure 25, Reach 17, Severity 10, No patch 092
- Google Brotli · node +7CVE-2026-111497Exploitation 40, Exposure 22, Reach 20, Severity 10, No patch 092
- Kludex starlette · starletteCVE-2026-48710Exploitation 40, Exposure 25, Reach 20, Severity 6.5, No patch 092