Current year - Under Construction
Web application vulnerabilities remained the dominant trend, with cross-site issues staying near their historic peak while CSRF and IDOR increased. Linux and kernel vulnerabilities remained exceptionally elevated following the dramatic shift seen in 2024, although both declined from their previous peaks. PHP continued to lead language-related vulnerabilities, while Java and mobile-platform vulnerabilities remained far below their earlier levels. Hardware-layer activity remained elevated, particularly around CPUs and BIOS, though both eased from 2024. AI-related CVEs continued to broaden across technologies associated with ChatGPT, GPT, OpenAI, Gemini, and DeepSeek, suggesting a slowly diversifying but still small emerging attack surface.
A dramatic shift toward Linux and kernel vulnerabilities defined the year, with both reaching by far their highest levels in the analyzed period. Cross-site vulnerabilities also reached a new peak, extending the strong upward trend that began after 2020. Hardware-layer vulnerabilities surged substantially, particularly around CPUs, BIOS, PCI, NVMe, and IOMMU technologies. PHP remained the most affected language, although language-specific vulnerabilities generally represented a smaller share than in earlier years. AI-related CVEs expanded noticeably, with ChatGPT, GPT, OpenAI, Gemini, and other emerging technologies appearing more frequently. Mobile-platform vulnerabilities continued their sharp decline.
Cross-site vulnerabilities surged to a new high, continuing a rapid multi-year increase in web-application security issues. SQL vulnerabilities declined substantially from their 2022 spike, while denial-of-service and network-related vulnerabilities continued their longer-term decline. PHP remained the most affected language, though at a much lower level than earlier years. Mobile-platform vulnerabilities fell sharply, particularly iOS, while IoT mentions nearly disappeared. CVEs involving ChatGPT, GPT, OpenAI, and other emerging AI technologies began appearing, marking an expansion of the AI-related attack surface. WLAN vulnerabilities also increased noticeably.
Web-application vulnerabilities became increasingly dominant, with cross-site vulnerabilities reaching another new high and SQL vulnerabilities surging dramatically. PHP vulnerabilities also rebounded strongly after several years of decline. Machine-learning-related CVEs remained unusually elevated following their emergence the previous year, although most specific AI/ML techniques remained rare. Mobile-platform vulnerabilities continued declining, while GPU vulnerabilities reached a new high. Classified-data references showed an unusual spike, standing far above both earlier and later years.
A substantial emergence of machine-learning-related CVEs marked the largest change of the year, with ML references rising dramatically from their previously negligible levels. Open-source vulnerabilities also surged to an unusual peak. Cross-site vulnerabilities increased sharply, while buffer-overflow vulnerabilities rebounded after several years of decline. Mobile vulnerabilities remained significant, with iOS reaching its highest level in the analyzed period, while Android remained elevated. GPU vulnerabilities continued increasing.
Windows vulnerabilities reached their highest level in the analyzed period, while network and denial-of-service vulnerabilities remained among the most prominent security concerns. Cross-site vulnerabilities began rising again as buffer-overflow vulnerabilities continued their gradual decline. Android remained heavily represented, while iOS continued increasing. PHP vulnerabilities continued their multi-year decline but remained the most affected language. Firmware vulnerabilities remained prominent, while BIOS vulnerabilities increased substantially. AI and machine-learning vulnerabilities remained extremely limited.
IoT vulnerabilities surged to their highest level in the analyzed period, accompanied by a major increase in Android vulnerabilities. Bluetooth, USB, GPU, and several embedded-hardware technologies also became more prominent. PHP remained the most affected language despite declining substantially from the previous year. Denial-of-service, network, cross-site, and buffer-overflow vulnerabilities continued to dominate the broader security landscape. AI and machine-learning vulnerabilities remained extremely rare, with little evidence yet of the growth that would appear in later years.
Web, network, and memory-safety vulnerabilities dominated the landscape, particularly denial-of-service, network, cross-site, buffer-overflow, and SQL issues. PHP was by far the most affected language, while Windows led operating-system vulnerabilities and Android already represented a significant mobile attack surface. Firmware vulnerabilities were also prominent, reflecting established embedded-system security concerns. AI and machine-learning vulnerabilities almost nonexistent.
[{"ChatGPT": 46120},{"Grok" : 42000},{"Co-Pilot": 47800},{"Average": 45306.67}]
Ransomware: 0.00% (14) VPN: 0.32% (922) Mitm: 0.14% (417) Denial-of-Service: 0.37% (1070) CSRF: 1.59% (4637) IDOR: 0.05% (132) Clickjack: 0.07% (192) SSRF: 0.27% (776) Heap Overflow: 0.14% (401) Buffer Overflow: 4.83% (14039) Side-Channel: 0.04% (130) Replay: 0.12% (347) Secure boot: 0.04% (103) Phishing: 0.22% (650) Brute force: 0.15% (433) Hypervisor: 0.08% (230) Kernel: 2.81% (8179) Escalation: 1.65% (4785) Database: 1.36% (3957) Cross-site: 7.81% (22695) Network: 4.03% (11714) SQL: 5.34% (15525)
Ransomware: 0.01% (2) VPN: 0.41% (89) Mitm: 0.12% (27) Denial-of-Service: 0.65% (143) CSRF: 1.94% (426) IDOR: 0.03% (6) Clickjack: 0.04% (9) SSRF: 0.39% (85) Heap Overflow: 0.29% (64) Buffer Overflow: 3.58% (784) Side-Channel: 0.10% (22) Replay: 0.17% (37) Secure boot: 0.06% (13) Phishing: 0.13% (28) Brute force: 0.08% (17) Hypervisor: 0.05% (12) Kernel: 2.70% (592) Escalation: 1.55% (340) Database: 1.01% (221) Cross-site: 3.87% (848) Network: 5.59% (1225) SQL: 3.14% (688)
Ransomware: 0.00% (0) VPN: 0.32% (68) Mitm: 0.17% (37) Denial-of-Service: 0.64% (138) CSRF: 1.56% (337) IDOR: 0.08% (18) Clickjack: 0.07% (15) SSRF: 0.33% (72) Heap Overflow: 0.25% (53) Buffer Overflow: 3.10% (668) Side-Channel: 0.06% (12) Replay: 0.10% (21) Secure boot: 0.07% (15) Phishing: 0.20% (44) Brute force: 0.11% (23) Hypervisor: 0.07% (15) Kernel: 2.52% (543) Escalation: 2.37% (510) Database: 1.54% (333) Cross-site: 3.37% (727) Network: 6.22% (1341) SQL: 3.02% (652)
Ransomware: 0.02% (7) VPN: 0.33% (102) Mitm: 0.09% (27) Denial-of-Service: 0.55% (172) CSRF: 1.25% (393) IDOR: 0.05% (16) Clickjack: 0.04% (12) SSRF: 0.40% (126) Heap Overflow: 0.17% (52) Buffer Overflow: 2.49% (781) Side-Channel: 0.04% (14) Replay: 0.09% (29) Secure boot: 0.07% (23) Phishing: 0.11% (36) Brute force: 0.11% (36) Hypervisor: 0.13% (42) Kernel: 1.60% (500) Escalation: 2.42% (757) Database: 1.08% (338) Cross-site: 3.47% (1088) Network: 5.21% (1634) SQL: 2.79% (875)
Ransomware: 0.00% (1) VPN: 0.29% (89) Mitm: 0.13% (40) Denial-of-Service: 0.75% (230) CSRF: 1.33% (409) IDOR: 0.10% (32) Clickjack: 0.04% (13) SSRF: 0.43% (131) Heap Overflow: 0.14% (44) Buffer Overflow: 3.49% (1072) Side-Channel: 0.06% (17) Replay: 0.10% (31) Secure boot: 0.05% (14) Phishing: 0.13% (40) Brute force: 0.13% (41) Hypervisor: 0.19% (57) Kernel: 2.64% (810) Escalation: 3.00% (922) Database: 1.19% (366) Cross-site: 6.07% (1865) Network: 4.97% (1528) SQL: 3.23% (992)
Ransomware: 0.00% (1) VPN: 0.31% (103) Mitm: 0.08% (27) Denial-of-Service: 0.52% (174) CSRF: 1.97% (659) IDOR: 0.11% (38) Clickjack: 0.04% (13) SSRF: 0.54% (180) Heap Overflow: 0.16% (54) Buffer Overflow: 3.04% (1019) Side-Channel: 0.04% (13) Replay: 0.13% (45) Secure boot: 0.05% (16) Phishing: 0.13% (42) Brute force: 0.15% (49) Hypervisor: 0.04% (12) Kernel: 2.68% (898) Escalation: 3.17% (1061) Database: 1.20% (403) Cross-site: 7.83% (2622) Network: 3.89% (1302) SQL: 5.81% (1944)
Ransomware: 0.01% (2) VPN: 0.32% (106) Mitm: 0.05% (16) Denial-of-Service: 0.44% (145) CSRF: 1.77% (585) IDOR: 0.05% (17) Clickjack: 0.02% (7) SSRF: 0.25% (81) Heap Overflow: 0.05% (16) Buffer Overflow: 2.06% (680) Side-Channel: 0.02% (8) Replay: 0.09% (31) Secure boot: 0.03% (9) Phishing: 0.12% (38) Brute force: 0.18% (59) Hypervisor: 0.02% (5) Kernel: 1.61% (531) Escalation: 2.56% (845) Database: 1.13% (371) Cross-site: 8.90% (2934) Network: 3.12% (1030) SQL: 4.59% (1513)
Machine learning: 0.14% (402) Artificial intelligence: 0.00% (3) chatgpt: 0.00% (5) gpt: 0.01% (34) supervised: 0.00% (3) Recommender: 0.00% (1) Predictor: 0.00% (14) Classifier: 0.00% (12) Clustering: 0.00% (13) PCA: 0.09% (267) SVD: 0.01% (15) Eigen: 0.01% (21) Bayes: 0.00% (2) Regression: 0.04% (127) forecasting: 0.00% (4) natural language: 0.00% (3) deep learning: 0.00% (2) ensemble: 0.00% (2) neural network: 0.00% (3) autonomous: 0.00% (9) computer vision: 0.01% (15) robot: 0.06% (178) watson: 0.01% (22) swarm: 0.00% (11)
Machine learning: 0.01% (3) Artificial intelligence: 0.00% (0) chatgpt: 0.00% (0) gpt: 0.00% (1) supervised: 0.00% (0) Recommender: 0.00% (1) Predictor: 0.01% (2) Classifier: 0.00% (0) Clustering: 0.00% (1) PCA: 0.09% (19) SVD: 0.00% (0) Eigen: 0.00% (0) Bayes: 0.00% (0) Regression: 0.03% (6) forecasting: 0.01% (2) natural language: 0.00% (0) deep learning: 0.00% (0) ensemble: 0.00% (0) neural network: 0.00% (0) autonomous: 0.00% (1) computer vision: 0.00% (0) robot: 0.11% (25) watson: 0.01% (2) swarm: 0.00% (0)
Machine learning: 0.01% (2) Artificial intelligence: 0.00% (0) chatgpt: 0.00% (0) gpt: 0.00% (1) supervised: 0.00% (0) Recommender: 0.00% (0) Predictor: 0.00% (1) Classifier: 0.00% (1) Clustering: 0.01% (2) PCA: 0.10% (22) SVD: 0.00% (0) Eigen: 0.00% (0) Bayes: 0.00% (0) Regression: 0.02% (5) forecasting: 0.00% (0) natural language: 0.00% (0) deep learning: 0.00% (0) ensemble: 0.00% (0) neural network: 0.00% (1) autonomous: 0.00% (0) computer vision: 0.00% (0) robot: 0.09% (19) watson: 0.01% (3) swarm: 0.00% (1)
Machine learning: 0.00% (1) Artificial intelligence: 0.00% (0) chatgpt: 0.00% (0) gpt: 0.01% (2) supervised: 0.00% (1) Recommender: 0.00% (0) Predictor: 0.00% (0) Classifier: 0.00% (1) Clustering: 0.00% (0) PCA: 0.05% (17) SVD: 0.01% (3) Eigen: 0.00% (1) Bayes: 0.00% (0) Regression: 0.03% (8) forecasting: 0.01% (2) natural language: 0.00% (0) deep learning: 0.00% (0) ensemble: 0.00% (0) neural network: 0.00% (0) autonomous: 0.00% (0) computer vision: 0.00% (1) robot: 0.08% (25) watson: 0.01% (3) swarm: 0.01% (3)
Machine learning: 0.66% (203) Artificial intelligence: 0.00% (0) chatgpt: 0.00% (0) gpt: 0.01% (2) supervised: 0.00% (0) Recommender: 0.00% (0) Predictor: 0.00% (0) Classifier: 0.01% (2) Clustering: 0.01% (2) PCA: 0.04% (13) SVD: 0.01% (2) Eigen: 0.04% (11) Bayes: 0.00% (0) Regression: 0.04% (12) forecasting: 0.00% (0) natural language: 0.00% (1) deep learning: 0.00% (0) ensemble: 0.00% (1) neural network: 0.00% (0) autonomous: 0.00% (0) computer vision: 0.00% (1) robot: 0.04% (11) watson: 0.01% (3) swarm: 0.00% (0)
Machine learning: 0.50% (166) Artificial intelligence: 0.00% (0) chatgpt: 0.00% (0) gpt: 0.00% (1) supervised: 0.00% (0) Recommender: 0.00% (0) Predictor: 0.01% (5) Classifier: 0.00% (0) Clustering: 0.00% (1) PCA: 0.05% (17) SVD: 0.00% (0) Eigen: 0.00% (1) Bayes: 0.00% (0) Regression: 0.01% (3) forecasting: 0.00% (0) natural language: 0.00% (0) deep learning: 0.00% (1) ensemble: 0.00% (0) neural network: 0.00% (1) autonomous: 0.00% (1) computer vision: 0.01% (2) robot: 0.11% (37) watson: 0.01% (5) swarm: 0.00% (0)
Machine learning: 0.08% (27) Artificial intelligence: 0.01% (2) chatgpt: 0.02% (5) gpt: 0.03% (11) supervised: 0.00% (1) Recommender: 0.00% (0) Predictor: 0.00% (0) Classifier: 0.01% (3) Clustering: 0.01% (2) PCA: 0.02% (6) SVD: 0.00% (1) Eigen: 0.00% (1) Bayes: 0.00% (0) Regression: 0.03% (11) forecasting: 0.00% (0) natural language: 0.00% (0) deep learning: 0.00% (0) ensemble: 0.00% (1) neural network: 0.00% (1) autonomous: 0.00% (1) computer vision: 0.00% (0) robot: 0.07% (22) watson: 0.01% (4) swarm: 0.01% (4)
x86: 0.18% (520) Amd: 0.11% (313) x64: 0.08% (247) Intel: 0.89% (2594) Arm: 0.31% (903) arm32: 0.00% (0) arm64: 0.01% (16) Powerpc: 0.01% (37) MIPS: 0.01% (26) Riscv: 0.00% (5) Sparc: 0.02% (60) AVR: 0.02% (70)
x86: 0.24% (53) amd: 0.11% (24) x64: 0.19% (41) intel: 1.02% (224) arm: 0.32% (71) arm32: 0.00% (0) arm64: 0.00% (1) powerpc: 0.01% (2) mips: 0.00% (0) riscv: 0.00% (0) sparc: 0.01% (2) avr: 0.04% (9)
x86: 0.17% (36) amd: 0.13% (28) x64: 0.12% (25) intel: 1.77% (382) arm: 0.36% (77) arm32: 0.00% (0) arm64: 0.00% (1) powerpc: 0.03% (6) mips: 0.01% (3) riscv: 0.00% (0) sparc: 0.01% (2) avr: 0.01% (3)
x86: 0.14% (45) amd: 0.22% (69) x64: 0.09% (29) intel: 1.66% (521) arm: 0.33% (103) arm32: 0.00% (0) arm64: 0.00% (1) powerpc: 0.01% (3) mips: 0.00% (1) riscv: 0.00% (1) sparc: 0.00% (1) avr: 0.02% (5)
x86: 0.16% (48) amd: 0.18% (55) x64: 0.07% (21) intel: 0.93% (286) arm: 0.37% (115) arm32: 0.00% (0) arm64: 0.00% (0) powerpc: 0.01% (3) mips: 0.01% (3) riscv: 0.00% (0) sparc: 0.00% (1) avr: 0.03% (10)
x86: 0.08% (28) amd: 0.09% (29) x64: 0.26% (86) intel: 1.18% (396) arm: 0.35% (118) arm32: 0.00% (0) arm64: 0.01% (3) powerpc: 0.00% (1) mips: 0.01% (3) riscv: 0.01% (4) sparc: 0.00% (0) avr: 0.03% (10)
x86: 0.06% (19) amd: 0.06% (19) x64: 0.03% (9) intel: 0.50% (164) arm: 0.32% (106) arm32: 0.00% (0) arm64: 0.00% (1) powerpc: 0.00% (0) mips: 0.00% (0) riscv: 0.00% (0) sparc: 0.00% (1) avr: 0.01% (4)
Windows: 3.85% (11191) MacOs: 0.85% (2483) Linux: 2.44% (7103) iOS: 2.01% (5842) Android: 2.91% (8447) VxWorks: 0.02% (54) QNX: 0.02% (51) LynxOS: 0.00% (0) Zephyr: 0.03% (85)
Windows: 3.53% (774) MacOs: 1.17% (256) Linux: 2.22% (486) iOS: 2.18% (478) Android: 2.09% (459) VxWorks: 0.06% (13) QNX: 0.00% (1) LynxOS: 0.00% (0) Zephyr: 0.01% (3)
Windows: 3.91% (842) MacOs: 1.26% (272) Linux: 1.99% (429) iOS: 2.19% (472) Android: 3.58% (771) Zephyr: 0.01% (3) VxWorks: 0.06% (13) QNX: 0.00% (1) LynxOS: 0.00% (0)
Windows: 3.83% (1199) MacOs: 1.11% (349) Linux: 1.00% (312) iOS: 1.89% (592) Android: 2.25% (705) Zephyr: 0.10% (32) VxWorks: 0.01% (4) QNX: 0.00% (1) LynxOS: 0.00% (0)
Windows: 2.72% (834) MacOs: 1.40% (430) Linux: 1.14% (349) iOS: 2.17% (666) Android: 2.64% (812) Zephyr: 0.07% (20) VxWorks: 0.02% (7) QNX: 0.01% (3) LynxOS: 0.00% (0)
Windows: 2.74% (916) MacOs: 1.18% (394) Linux: 1.43% (478) iOS: 1.84% (616) Android: 2.00% (669) Zephyr: 0.02% (6) VxWorks: 0.01% (2) QNX: 0.00% (1) LynxOS: 0.00% (0)
Windows: 2.15% (709) MacOs: 1.25% (411) Linux: 1.37% (453) iOS: 1.33% (440) Android: 1.43% (473) Zephyr: 0.05% (15) VxWorks: 0.00% (1) QNX: 0.00% (0) LynxOS: 0.00% (0)
Java: 2.90% (8435) Python: 0.28% (804) C++: 0.06% (183) PHP: 9.01% (26198) Javascript: 1.60% (4650) Swift: 0.04% (128) Rust: 1.75% (5101) Nim: 0.21% (609)
Java: 3.59% (787) Python: 0.15% (32) C++: 0.08% (17) PHP: 7.03% (1541) Javascript: 2.24% (492) Swift: 0.03% (6) Rust: 1.92% (421) Nim: 0.10% (22)
Java: 3.24% (699) Python: 0.29% (62) C++: 0.07% (15) PHP: 4.94% (1066) Javascript: 2.16% (466) Swift: 0.04% (9) Rust: 2.04% (440) Nim: 0.16% (35)
Java: 2.43% (762) Python: 0.20% (64) C++: 0.02% (7) PHP: 4.93% (1544) Javascript: 1.43% (447) Swift: 0.04% (14) Rust: 2.19% (687) Nim: 0.18% (56)
Java: 3.28% (1008) Python: 0.29% (90) C++: 0.12% (37) PHP: 3.66% (1124) Javascript: 2.00% (614) Swift: 0.06% (17) Rust: 2.44% (749) Nim: 0.39% (120)
Java: 2.61% (874) Python: 0.46% (154) C++: 0.06% (19) PHP: 5.56% (1862) Javascript: 1.55% (518) Swift: 0.06% (20) Rust: 1.75% (585) Nim: 0.27% (92)
Java: 1.98% (654) Python: 0.34% (111) C++: 0.07% (23) PHP: 4.74% (1563) Javascript: 1.05% (347) Swift: 0.03% (11) Rust: 1.33% (439) Nim: 0.20% (65)