Operating Systems
77,051 CVEs tracked since 1999. In the last 12 months, 15,204, +57% on the 12 before.
Operating Systems by subsector, Sep 2026 so far
- Linux distributions1,68653% · 14 vendors
- Windows82726% · 2 vendors
- Mobile OS36812% · 6 vendors
- macOS, Unix & BSD2357% · 3 vendors
Also: Not yet sub-classified 41, RTOS & embedded OS 16.
Month by month
Every monthly snapshot of Operating Systems. A column is the CVEs published that month.
| Month | CVEs |
|---|---|
| 2021-09 | 393 |
| 2021-10 | 335 |
| 2021-11 | 308 |
| 2021-12 | 361 |
| 2022-01 | 463 |
| 2022-02 | 402 |
| 2022-03 | 385 |
| 2022-04 | 570 |
| 2022-05 | 293 |
| 2022-06 | 335 |
| 2022-07 | 532 |
| 2022-08 | 493 |
| 2022-09 | 475 |
| 2022-10 | 387 |
| 2022-11 | 394 |
| 2022-12 | 452 |
| 2023-01 | 357 |
| 2023-02 | 380 |
| 2023-03 | 0 |
| 2023-04 | 373 |
| 2023-05 | 332 |
| 2023-06 | 442 |
| 2023-07 | 469 |
| 2023-08 | 493 |
| 2023-09 | 442 |
| 2023-10 | 445 |
| 2023-11 | 398 |
| 2023-12 | 374 |
| 2024-01 | 409 |
| 2024-02 | 703 |
| 2024-03 | 592 |
| 2024-04 | 892 |
| 2024-05 | 1516 |
| 2024-06 | 591 |
| 2024-07 | 903 |
| 2024-08 | 726 |
| 2024-09 | 650 |
| 2024-10 | 891 |
| 2024-11 | 738 |
| 2024-12 | 725 |
| 2025-01 | 795 |
| 2025-02 | 1304 |
| 2025-03 | 623 |
| 2025-04 | 779 |
| 2025-05 | 929 |
| 2025-06 | 734 |
| 2025-07 | 908 |
| 2025-08 | 584 |
| 2025-09 | 1134 |
| 2025-10 | 1116 |
| 2025-11 | 501 |
| 2025-12 | 1379 |
| 2026-01 | 636 |
| 2026-02 | 503 |
| 2026-03 | 598 |
| 2026-04 | 761 |
| 2026-05 | 2693 |
| 2026-06 | 1201 |
| 2026-07 | 1989 |
| 2026-08 | 2693 |
| 2026-09 | 3173 |
Vendors
Who shipped the most Operating Systems CVEs in Sep 2026 so far, with their rank across all vendors.
Weaknesses
The weakness classes behind Operating Systems CVEs in Sep 2026 so far.
Latest CVEs
The 15 most recently published vulnerabilities in Operating Systems.
- CVE-2026-98163cgroup: Avoid iteration of dying tasks with zero refcount—
- CVE-2026-93834Qemu-kvm: 9pfs: use-after-free race in tlcreate/twalk allows vm guest escape8.8
- CVE-2026-98162smb/server: fix tree connection leak in smb2_tree_connect()—
- CVE-2026-98161nvdimm: pmem: keep PREFLUSH before data writes—
- CVE-2026-98160staging: rtl8723bs: fix mismatched free of HalData in rtw_sdio_if1_init()—
- CVE-2026-100079usb: typec: ucsi: unregister debugfs entries on teardown—
- CVE-2026-100078wifi: iwlwifi: mei: pass correct argument to function—
- CVE-2026-100077drm/msm: Recover HW before retire hung submit—
- CVE-2026-100076staging: rtl8723bs: fix xmit_frame/xmit_buf leaks on mgnt-frame error paths—
- CVE-2026-100075RDMA/srpt: Fix srpt_alloc_rw_ctxs() unwind counters9.8
- CVE-2026-100073ext4: fix transaction overflow during writeback—
- CVE-2026-100074bpf: Mark bpf_refcount field as unique—
- CVE-2026-100072ACPI: platform: Use acpi_bus_get_primary_device()—
- CVE-2026-100070netfilter: nf_nat_sip: rewind offset when NAT shrinks the packet—
- CVE-2026-100071net: hsr: free learned nodes on device setup failure—
The record
- Busiest month
- Sep 2026 so far, 3,173 CVEs
- Sep 2026 so far
- 3,173 CVEs from 30 vendors
- Deployment
- On-prem, 98%
- Monthly snapshots
- 300 since 1999
Is your business exposed to threats like these?
Discuss a security assessment of your internet-facing systems. Scope, price and timing agreed before testing.
Request an assessment