Multi-year analysis
Threat observatory
A multi-year read of the vulnerabilities in the apps and OSes Scout tracks (iOS, Android, macOS, Windows). We lead with the share of CVEs actually exploited (CISA KEV), a signal robust to NVD coverage effects, then add volume context and attack vectors.
In 2025, 2,544 vulnerabilities hit the perimeter Scout tracks. 2.5 % of them were exploited in the wild, 1.2 points below 2021: the volume grows while exploitation gets rarer. 79 % of that volume came from the OS, not from apps.
- CVEs published
- 2,544
- KEV share
- 2.5 %
- OS share of volume
- 79 %
published in 2025
-1.2 pts vs 2021
vs apps, same year
Key metric · KEV share
2.5 % of CVEs published in 2025 were added to the CISA KEV catalog (exploited in the wild).
+0.3 pts vs 2024
KEV share is used as the hero metric: unlike raw CVE volume, it does not depend on NVD coverage in any given year. A rise signals more frequent exploitation, not just more publications.
Share of CVEs that became KEV
Percentage of CVEs published in the year that were later added to the catalog of actively exploited vulnerabilities (CISA KEV).
| Year | KEV share |
|---|---|
| 2021 | 3.7% |
| 2022 | 1.9% |
| 2023 | 2.9% |
| 2024 | 2.2% |
| 2025 | 2.5% |
| 2026* | 0.4% |
CVE volume over time
CVEs published per year, split between those linked to a tracked app and those linked to an OS release.
| Year | Tracked apps | OS releases |
|---|---|---|
| 2021 | 544 | 984 |
| 2022 | 532 | 1116 |
| 2023 | 485 | 1194 |
| 2024 | 468 | 1588 |
| 2025 | 531 | 2029 |
| 2026* | 3990 | 2992 |
Tracked apps OS releases
Raw volume is a context indicator, not a risk measure: it also reflects changes in NVD coverage and growth of the Scout catalog. Read it alongside KEV share.
Attack vectors
CVEs broken down by CVSS attack vector: remote (network), adjacent network, local access, or physical access.
| Year | Network (remote) | Adjacent network | Local access | Physical access |
|---|---|---|---|---|
| 2021 | 536 | 9 | 223 | 6 |
| 2022 | 508 | 0 | 73 | 6 |
| 2023 | 485 | 6 | 70 | 2 |
| 2024 | 557 | 6 | 458 | 32 |
| 2025 | 673 | 14 | 635 | 29 |
| 2026* | 4434 | 104 | 1926 | 72 |
Network (remote) Adjacent network Local access Physical access
47% of 2025 CVEs have no CVSS vector recorded (Tier 1 stubs, incomplete NVD) and are excluded from this chart, which shows the mix of known vectors.
Breakdown by platform · 2025
A cross-platform CVE is counted for each platform it affects: this is a breakdown, not a partition.
iOS
387
11 in KEV
Android
515
11 in KEV
macOS
980
15 in KEV
Windows
1,303
36 in KEV
Methodology
- Sources: NVD (NIST) for CVEs and CVSS scoring, CISA KEV for the "actively exploited" status. Scope: apps tracked by Scout (iOS, Android, macOS, Windows) and documented OS releases.
- KEV share: number of CVEs published in the year and present in the CISA KEV catalog, divided by the total number of CVEs published in the year (Scope: Scout).
- Dates: CVEs are counted by NVD publication year; KEV by year added to the CISA catalog. We never count a present "open" status; a time series relies on immutable event dates.
- Limitation (coverage): CVE volume depends on NVD coverage and the size of the Scout catalog, both of which change over time. Raw volume is context, not a risk measure.
- Current year: marked with an asterisk (*) and excluded from year-over-year comparisons: its figures are not yet consolidated.
Data recomputed on 2026-10-10 11:26 UTC.