BlackTreeCVE IntelligenceStructured vendor attributionCISA KEV is confirmed exploitationCVSS is technical severity
CVEs by vendor
Compare the scale and character of disclosures without treating a high CVE count as proof that a vendor is less secure. Product identity comes from retained structured source evidence.
2026 catalogue
Vendor comparison
50 vendors with at least five attributed CVEs. 41,615 records in this comparison.
| Vendor | CVEs | Critical | High | CISA KEV | Avg CVSS |
|---|---|---|---|---|---|
| Linux | 8,263 | 549 | 3,020 | 4 | 7.3 (5,236 scored) |
| Microsoft | 5,588 | 300 | 3,891 | 28 | 7.4 (5,588 scored) |
| 4,735 | 519 | 2,164 | 10 | 7.2 (4,650 scored) | |
| Oracle Corporation | 4,152 | 655 | 2,082 | 0 | 7.3 (4,152 scored) |
| IBM | 1,848 | 236 | 781 | 2 | 7.1 (1,848 scored) |
| Apache Software Foundation | 1,467 | 275 | 623 | 0 | 7.3 (1,407 scored) |
| Red Hat | 1,340 | 57 | 497 | 0 | 6.5 (1,338 scored) |
| Apple | 1,188 | 82 | 407 | 3 | 6.5 (1,188 scored) |
| Adobe | 1,136 | 138 | 517 | 5 | 7.1 (1,134 scored) |
| Mozilla | 969 | 241 | 466 | 0 | 8.0 (929 scored) |
| OpenClaw | 672 | 28 | 290 | 0 | 6.6 (672 scored) |
| Dell | 658 | 40 | 267 | 1 | 6.6 (658 scored) |
| SourceCodester | 444 | 0 | 0 | 0 | 6.1 (444 scored) |
| Hewlett Packard Enterprise (HPE) | 412 | 76 | 211 | 0 | 7.4 (412 scored) |
| NVIDIA | 400 | 14 | 281 | 0 | 7.3 (400 scored) |
| Cisco | 397 | 81 | 137 | 19 | 7.3 (397 scored) |
| code-projects | 357 | 0 | 1 | 0 | 6.2 (357 scored) |
| Drupal | 327 | 15 | 34 | 1 | 5.6 (327 scored) |
| Canonical | 313 | 19 | 19 | 0 | 7.0 (71 scored) |
| itsourcecode | 309 | 0 | 0 | 0 | 5.9 (309 scored) |
| WWBN | 303 | 42 | 109 | 0 | 7.0 (303 scored) |
| Tenda | 300 | 30 | 230 | 0 | 8.4 (300 scored) |
| JetBrains | 258 | 19 | 92 | 1 | 6.3 (258 scored) |
| GitLab | 254 | 9 | 74 | 2 | 5.8 (254 scored) |
| TOTOLINK | 248 | 159 | 32 | 0 | 8.4 (248 scored) |
| Juniper Networks | 245 | 29 | 172 | 0 | 7.8 (245 scored) |
| BSI | 243 | 0 | 0 | 0 | Not scored |
| FreeRDP | 243 | 13 | 133 | 0 | 6.9 (243 scored) |
| MongoDB | 243 | 7 | 131 | 0 | 6.7 (243 scored) |
| SAP SE | 236 | 36 | 50 | 0 | 6.4 (236 scored) |
| ImageMagick | 235 | 1 | 23 | 0 | 5.4 (235 scored) |
| MediaTek, Inc. | 230 | 2 | 54 | 0 | 6.4 (230 scored) |
| ThemeREX | 227 | 67 | 158 | 0 | 8.6 (227 scored) |
| Eclipse Foundation | 225 | 29 | 117 | 0 | 7.5 (225 scored) |
| Fortinet | 223 | 33 | 95 | 9 | 6.8 (223 scored) |
| zephyrproject | 221 | 2 | 69 | 0 | 6.1 (221 scored) |
| frappe | 220 | 8 | 87 | 0 | 6.4 (220 scored) |
| D-Link | 214 | 48 | 87 | 0 | 7.8 (214 scored) |
| siyuan-note | 214 | 59 | 84 | 0 | 7.8 (214 scored) |
| Spring | 206 | 10 | 71 | 0 | 6.3 (206 scored) |
| Gitea | 198 | 32 | 63 | 1 | 6.7 (198 scored) |
| Splunk | 197 | 18 | 63 | 1 | 6.6 (196 scored) |
| Elastic | 196 | 0 | 39 | 0 | 6.2 (196 scored) |
| n8n-io | 193 | 20 | 96 | 0 | 7.1 (193 scored) |
| Mattermost | 184 | 0 | 18 | 0 | 5.2 (184 scored) |
| TP-Link Systems Inc. | 183 | 1 | 118 | 0 | 7.3 (183 scored) |
| misp | 179 | 12 | 58 | 0 | 6.5 (179 scored) |
| MervinPraison | 177 | 47 | 100 | 0 | 8.2 (177 scored) |
| Samsung Mobile | 174 | 3 | 36 | 0 | 6.3 (174 scored) |
| FFmpeg | 171 | 1 | 60 | 0 | 6.5 (171 scored) |
Each CVE is counted once using its structured product-source vendor. Unattributed records and groups with fewer than five CVEs are omitted. CISA KEV counts confirmed exploitation; CVSS averages include only scored records. Disclosure volume is not a vendor safety rating.