Annual recap
App security · 2026
2026 recap indexed by Appaloosa Scout: 6,419 CVEs published during the year on tracked apps, 25 added to the CISA KEV catalog (exploited in the wild), 6 apps affected by at least one KEV.
- CVE indexed this year
- 6,419
- CISA KEV added
- 25
- Tracked apps affected
- 6
Severity distribution
CRITICAL
633
HIGH
3,435
MEDIUM
2,173
LOW
178
Top 10 KEVs of the year
Sorted by CVSS severity. “Apps” counts tracked catalog apps: many KEVs are OS-level and legitimately show 0.
| CVE | Severity | Apps | Added to KEV | Description |
|---|---|---|---|---|
|
CVE-2025-39682
0 apps
|
CRITICAL 9.8 | 0 | 2026-09-18 | In the Linux kernel, the following vulnerability has been resolved: tls: fix handling of zero-length records on the rx_list Each recvmsg(… |
|
CVE-2026-33824
0 apps
|
CRITICAL 9.8 | 0 | 2026-08-18 | Double free in Windows IKE Extension allows an unauthorized attacker to execute code over a network. |
|
CVE-2026-65400
0 apps
|
CRITICAL 9.8 | 0 | 2026-08-18 | An authentication issue was addressed with improved state management. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.7.9, ma… |
|
CVE-2026-50522
0 apps
|
CRITICAL 9.8 | 0 | 2026-07-22 | Deserialization of untrusted data in Microsoft Office SharePoint allows an unauthorized attacker to execute code over a network. |
|
CVE-2026-58644
0 apps
|
CRITICAL 9.8 | 0 | 2026-07-16 | Deserialization of untrusted data in Microsoft Office SharePoint allows an unauthorized attacker to execute code over a network. |
|
CVE-2026-20963
0 apps
|
HIGH 9.8 | 0 | 2026-03-18 | Microsoft SharePoint Remote Code Execution Vulnerability |
|
CVE-2024-43468
0 apps
|
CRITICAL 9.8 | 0 | 2026-02-12 | Microsoft Configuration Manager Remote Code Execution Vulnerability |
|
CVE-2026-55040
0 apps
|
CRITICAL 9.1 | 0 | 2026-08-18 | Weak authentication in Microsoft Office SharePoint allows an unauthorized attacker to bypass a security feature over a network. |
|
CVE-2009-0238
3 apps
|
HIGH 8.8 | 3 | 2026-04-14 | Microsoft Office Excel 2000 SP3, 2002 SP3, 2003 SP3, and 2007 SP1; Excel Viewer 2003 Gold and SP3; Excel Viewer; Compatibility Pack for Wor… |
|
CVE-2026-87491
2 apps
|
HIGH 8.8 | 2 | 2026-09-09 | Out of bounds write in V8 in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to execute arbitrary code inside the sandbox vi… |
Top vendors by KEV this year
- 1 Google LLC 7 KEV · 1 apps
- 2 Microsoft 4 KEV · 1 apps
- 3 Microsoft Office 3 KEV · 1 apps
- 4 Microsoft Corporation 2 KEV · 2 apps
- 5 Adobe 2 KEV · 1 apps
- 6 Adobe Acrobat Reader 2 KEV · 1 apps
Most affected apps
Google Chrome
winget:Google.Chrome
No open vuln.
Chrome
com.google.Chrome
No open vuln.
Office
winget:Microsoft.Office
No open vuln.
Microsoft Office
brew:cask:microsoft-office
No open vuln.
Adobe Acrobat Reader (64-bit)
winget:Adobe.Acrobat.Reader.64-bit
No open vuln.
Adobe Acrobat Reader
brew:cask:adobe-acrobat-reader
No open vuln.
Microsoft PowerPoint
com.microsoft.Powerpoint
No open vuln.
Microsoft Excel
com.microsoft.Excel
No open vuln.
Methodology
KEV: added to the CISA catalog during the year (kev_added_date). CVE: NVD publication date. Apps: those indexed in Scout at query time; the history evolves as new mappings are added.