{
  "source": {
    "catalogVersion": "2026.11.10",
    "dateReleased": "2026-11-10T19:03:29.8375Z",
    "totalEntries": 1779,
    "nvdMatched": 1779
  },
  "window": {
    "start": "2023-01-01",
    "end": "2026-11-10",
    "entries": 913
  },
  "addedByYear": {
    "2021": 311,
    "2022": 555,
    "2023": 187,
    "2024": 186,
    "2025": 245,
    "2026": 295
  },
  "backlogDays": [
    [
      "2021-11-03",
      287
    ],
    [
      "2022-03-03",
      95
    ],
    [
      "2022-03-25",
      66
    ]
  ],
  "categories": {
    "server": {
      "label": "Enterprise server, web and developer software",
      "n": 386,
      "pct": 42.3
    },
    "os": {
      "label": "Operating systems, mobile and hypervisors",
      "n": 213,
      "pct": 23.3
    },
    "edge": {
      "label": "Network edge and remote access",
      "n": 196,
      "pct": 21.5
    },
    "client": {
      "label": "Browsers and desktop applications",
      "n": 82,
      "pct": 9
    },
    "iot": {
      "label": "IoT, OT and embedded devices",
      "n": 36,
      "pct": 3.9
    }
  },
  "categoryByYear": {
    "2023": {
      "n": 187,
      "edge": 30,
      "edgePct": 16
    },
    "2024": {
      "n": 186,
      "edge": 42,
      "edgePct": 22.6
    },
    "2025": {
      "n": 245,
      "edge": 52,
      "edgePct": 21.2
    },
    "2026": {
      "n": 295,
      "edge": 72,
      "edgePct": 24.4
    }
  },
  "topVendors": [
    {
      "vendor": "Microsoft",
      "n": 143,
      "pct": 15.7
    },
    {
      "vendor": "Apple",
      "n": 47,
      "pct": 5.1
    },
    {
      "vendor": "Cisco",
      "n": 42,
      "pct": 4.6
    },
    {
      "vendor": "Google",
      "n": 33,
      "pct": 3.6
    },
    {
      "vendor": "Ivanti",
      "n": 29,
      "pct": 3.2
    },
    {
      "vendor": "Adobe",
      "n": 24,
      "pct": 2.6
    },
    {
      "vendor": "Linux",
      "n": 23,
      "pct": 2.5
    },
    {
      "vendor": "Fortinet",
      "n": 23,
      "pct": 2.5
    },
    {
      "vendor": "Oracle",
      "n": 17,
      "pct": 1.9
    },
    {
      "vendor": "Apache",
      "n": 16,
      "pct": 1.8
    }
  ],
  "vendorsTotal": 222,
  "topEdgeVendors": [
    [
      "Cisco",
      37
    ],
    [
      "Fortinet",
      20
    ],
    [
      "Ivanti",
      16
    ],
    [
      "Citrix",
      13
    ],
    [
      "Palo Alto Networks",
      12
    ],
    [
      "SonicWall",
      11
    ],
    [
      "Zyxel",
      9
    ],
    [
      "D-Link",
      9
    ]
  ],
  "timingAll": {
    "n": 913,
    "medianDays": 15,
    "atOrBeforePublication": 193,
    "within1to7": 195,
    "within8to30": 113,
    "within31to365": 214,
    "over1Year": 198,
    "over3Years": 123
  },
  "timingNewCves": {
    "n": 739,
    "medianDays": 6,
    "atOrBeforePublication": 193,
    "within1to7": 195,
    "within8to30": 113,
    "within31to365": 200,
    "over1Year": 38,
    "over3Years": 3
  },
  "timingNewByCategory": {
    "edge": {
      "n": 168,
      "medianDays": 5,
      "atOrBeforePublication": 52,
      "within1to7": 45,
      "within8to30": 21,
      "within31to365": 38,
      "over1Year": 12,
      "over3Years": 0
    },
    "iot": {
      "n": 18,
      "medianDays": 48,
      "atOrBeforePublication": 0,
      "within1to7": 5,
      "within8to30": 3,
      "within31to365": 9,
      "over1Year": 1,
      "over3Years": 0
    },
    "os": {
      "n": 176,
      "medianDays": 0,
      "atOrBeforePublication": 93,
      "within1to7": 31,
      "within8to30": 10,
      "within31to365": 36,
      "over1Year": 6,
      "over3Years": 0
    },
    "client": {
      "n": 62,
      "medianDays": 2,
      "atOrBeforePublication": 23,
      "within1to7": 25,
      "within8to30": 8,
      "within31to365": 5,
      "over1Year": 1,
      "over3Years": 0
    },
    "server": {
      "n": 315,
      "medianDays": 16,
      "atOrBeforePublication": 25,
      "within1to7": 89,
      "within8to30": 71,
      "within31to365": 112,
      "over1Year": 18,
      "over3Years": 3
    }
  },
  "families": {
    "injection": {
      "label": "Injection and code execution",
      "n": 191,
      "pct": 20.9
    },
    "memory": {
      "label": "Memory safety",
      "n": 177,
      "pct": 19.4
    },
    "auth": {
      "label": "Authentication and access control",
      "n": 172,
      "pct": 18.8
    },
    "other": {
      "label": "Other specified weakness",
      "n": 168,
      "pct": 18.4
    },
    "file": {
      "label": "Path traversal and file handling",
      "n": 77,
      "pct": 8.4
    },
    "none": {
      "label": "No weakness recorded",
      "n": 64,
      "pct": 7
    },
    "deser": {
      "label": "Unsafe deserialisation",
      "n": 46,
      "pct": 5
    },
    "forgery": {
      "label": "Request forgery (SSRF, CSRF)",
      "n": 18,
      "pct": 2
    }
  },
  "familiesByCategory": {
    "edge": {
      "injection": {
        "n": 62,
        "pct": 31.6
      },
      "auth": {
        "n": 46,
        "pct": 23.5
      },
      "memory": {
        "n": 32,
        "pct": 16.3
      },
      "other": {
        "n": 29,
        "pct": 14.8
      },
      "file": {
        "n": 19,
        "pct": 9.7
      },
      "forgery": {
        "n": 5,
        "pct": 2.6
      },
      "deser": {
        "n": 2,
        "pct": 1
      },
      "none": {
        "n": 1,
        "pct": 0.5
      }
    },
    "os": {
      "memory": {
        "n": 100,
        "pct": 46.9
      },
      "other": {
        "n": 51,
        "pct": 23.9
      },
      "none": {
        "n": 28,
        "pct": 13.1
      },
      "auth": {
        "n": 18,
        "pct": 8.5
      },
      "injection": {
        "n": 7,
        "pct": 3.3
      },
      "file": {
        "n": 7,
        "pct": 3.3
      },
      "deser": {
        "n": 2,
        "pct": 0.9
      }
    },
    "client": {
      "memory": {
        "n": 37,
        "pct": 45.1
      },
      "other": {
        "n": 25,
        "pct": 30.5
      },
      "none": {
        "n": 7,
        "pct": 8.5
      },
      "file": {
        "n": 5,
        "pct": 6.1
      },
      "injection": {
        "n": 4,
        "pct": 4.9
      },
      "auth": {
        "n": 3,
        "pct": 3.7
      },
      "forgery": {
        "n": 1,
        "pct": 1.2
      }
    },
    "server": {
      "injection": {
        "n": 100,
        "pct": 25.9
      },
      "auth": {
        "n": 93,
        "pct": 24.1
      },
      "other": {
        "n": 59,
        "pct": 15.3
      },
      "file": {
        "n": 45,
        "pct": 11.7
      },
      "deser": {
        "n": 42,
        "pct": 10.9
      },
      "none": {
        "n": 27,
        "pct": 7
      },
      "forgery": {
        "n": 12,
        "pct": 3.1
      },
      "memory": {
        "n": 8,
        "pct": 2.1
      }
    }
  },
  "topCwes": [
    [
      "CWE-78",
      64
    ],
    [
      "CWE-416",
      47
    ],
    [
      "CWE-502",
      47
    ],
    [
      "CWE-22",
      40
    ],
    [
      "CWE-94",
      40
    ],
    [
      "CWE-287",
      39
    ],
    [
      "CWE-787",
      37
    ],
    [
      "CWE-306",
      30
    ],
    [
      "CWE-77",
      26
    ],
    [
      "CWE-20",
      25
    ]
  ],
  "ransomware": {
    "windowKnown": 145,
    "byCategory": {
      "edge": {
        "n": 196,
        "known": 42,
        "pct": 21.4
      },
      "iot": {
        "n": 36,
        "known": 1,
        "pct": 2.8
      },
      "os": {
        "n": 213,
        "known": 21,
        "pct": 9.9
      },
      "client": {
        "n": 82,
        "known": 4,
        "pct": 4.9
      },
      "server": {
        "n": 386,
        "known": 77,
        "pct": 19.9
      }
    },
    "byYearAdded": {
      "2021": {
        "n": 311,
        "known": 84,
        "pct": 27
      },
      "2022": {
        "n": 555,
        "known": 132,
        "pct": 23.8
      },
      "2023": {
        "n": 187,
        "known": 43,
        "pct": 23
      },
      "2024": {
        "n": 186,
        "known": 44,
        "pct": 23.7
      },
      "2025": {
        "n": 245,
        "known": 31,
        "pct": 12.7
      },
      "2026": {
        "n": 295,
        "known": 27,
        "pct": 9.2
      }
    }
  },
  "aiTooling": [
    {
      "cve": "CVE-2026-102895",
      "vendor": "GPUStack",
      "product": "GPUStack",
      "dateAdded": "2026-11-09",
      "daysToKev": 5
    },
    {
      "cve": "CVE-2026-59822",
      "vendor": "BerriAI",
      "product": "LiteLLM",
      "dateAdded": "2026-09-02",
      "daysToKev": 56
    },
    {
      "cve": "CVE-2026-64849",
      "vendor": "MLflow",
      "product": "MLflow",
      "dateAdded": "2026-08-19",
      "daysToKev": 2
    },
    {
      "cve": "CVE-2025-62593",
      "vendor": "Ray-Project",
      "product": "Ray",
      "dateAdded": "2026-08-17",
      "daysToKev": 264
    },
    {
      "cve": "CVE-2026-9198",
      "vendor": "IBM",
      "product": "Langflow",
      "dateAdded": "2026-08-04",
      "daysToKev": 18
    },
    {
      "cve": "CVE-2026-0770",
      "vendor": "Langflow",
      "product": "Langflow",
      "dateAdded": "2026-07-21",
      "daysToKev": 179
    },
    {
      "cve": "CVE-2026-55255",
      "vendor": "Langflow",
      "product": "Langflow",
      "dateAdded": "2026-07-07",
      "daysToKev": 14
    },
    {
      "cve": "CVE-2026-42271",
      "vendor": "BerriAI",
      "product": "LiteLLM",
      "dateAdded": "2026-06-08",
      "daysToKev": 31
    },
    {
      "cve": "CVE-2025-34291",
      "vendor": "Langflow",
      "product": "Langflow",
      "dateAdded": "2026-05-21",
      "daysToKev": 167
    },
    {
      "cve": "CVE-2026-42208",
      "vendor": "BerriAI",
      "product": "LiteLLM",
      "dateAdded": "2026-05-08",
      "daysToKev": 0
    },
    {
      "cve": "CVE-2026-39987",
      "vendor": "Marimo",
      "product": "Marimo",
      "dateAdded": "2026-04-23",
      "daysToKev": 14
    },
    {
      "cve": "CVE-2026-33017",
      "vendor": "Langflow",
      "product": "Langflow",
      "dateAdded": "2026-03-25",
      "daysToKev": 5
    },
    {
      "cve": "CVE-2025-68613",
      "vendor": "n8n",
      "product": "n8n",
      "dateAdded": "2026-03-11",
      "daysToKev": 82
    },
    {
      "cve": "CVE-2025-3248",
      "vendor": "Langflow",
      "product": "Langflow",
      "dateAdded": "2025-05-05",
      "daysToKev": 28
    }
  ],
  "fileTransfer": {
    "n": 21,
    "ransomwareKnown": 8
  }
}