Weaknesses by vendor and year

CVE counts by vendor, weakness (CWE) and year of publication, with how many of those CVEs are known to be exploited.

Table: demo.security.vendor_weaknesses
Source: Opteryx view over NVD and CISA KEV
Rows
Updated

Preview

The first ten rows

Live from the table, no sign-in needed.

SELECT vendor, cwe_id, published_year, cves, exploited
  FROM demo.security.vendor_weaknesses
 LIMIT 10

Example questions

Ask it something

Run any of these here, or open it in Studio to change the SQL. Studio is free to start: 100 queries a day.

Which weakness types account for the most exploited CVEs?

SELECT cwe_id, SUM(exploited) AS exploited_cves
  FROM demo.security.vendor_weaknesses
 WHERE cwe_id NOT IN ('NVD-CWE-noinfo', 'NVD-CWE-Other')
 GROUP BY cwe_id
 ORDER BY exploited_cves DESC, cwe_id
 LIMIT 10

Edit in Studio

What are Microsoft's most common weaknesses?

SELECT cwe_id, SUM(cves) AS total_cves
  FROM demo.security.vendor_weaknesses
 WHERE vendor = 'microsoft' AND cwe_id NOT IN ('NVD-CWE-noinfo', 'NVD-CWE-Other')
 GROUP BY cwe_id
 ORDER BY total_cves DESC, cwe_id
 LIMIT 10

Edit in Studio

Schema

Columns

Column	Type
vendor	VARCHAR
cwe_id	VARCHAR
published_year	INT64
cves	INT64
exploited	INT64