CVSS 10.0 Vendor Vulnerability Ranking

A composite score from 0 to 100 that combines CVSS 10.0 density (10.0 CVEs as a share of total CVEs), confirmed exploitation rate, CISA KEV catalog presence, recent trend acceleration, and a category multiplier that weights network infrastructure and cloud/virtualization vendors higher because their products sit at the perimeter or hypervisor layer. 75–100 is Very Fragile, 55–74 is Fragile, 35–54 is Moderate, and 0–34 is Resilient.

Cumulative CVE counts are from NIST NVD and MITRE CVE databases. Confirmed exploitation data comes from CISA's Known Exploited Vulnerabilities (KEV) catalog and documented in-the-wild exploitation reports. Data is current through September 2026.

Yes. Two CSV exports are available: a summary ranking with all columns (vendor, founded, HQ, category, products, CVE counts, exploitability, fragility score, notable CVEs) and a yearly breakdown with per-year CVE counts and exploitation data for each vendor.

The fragility score applies a category multiplier of 1.4× for network infrastructure and 1.2× for cloud/virtualization vendors. These products sit at the network perimeter or hypervisor layer where they are directly reachable by attackers, and their compromise often bypasses endpoint security entirely. A CVSS 10.0 in a firewall is not the same operational risk as a CVSS 10.0 in a desktop application.

Total CVE count correlates with codebase size and disclosure transparency more than with risk. The Linux Kernel has ~20,000 CVEs but a fragility score of ~25 because very few are CVSS 10.0 and fewer still are exploited. Fortinet has ~1,200 total CVEs but scores much higher because a disproportionate number hit 10.0 and are actively weaponized.