A Year Of CVEs Screensaver
The A Year Of CVEs screensaver shows how many vulnerabilities NVD published each month split by CVSS band, counted directly from NVD and key-less. It’s free, runs in your browser, and ESC exits.
Live preview
Press ESC to leave fullscreen. Settings are saved in your browser only.
How the A Year Of CVEs screensaver works
The saver reads the source described above and draws it on a canvas — no account, no tracking.
How many vulnerabilities NVD published each month split by CVSS band, counted directly from NVD and key-less. Recent months undercount because scoring lags publication, and a spike is as often one vendor filing a backlog as a bad month.
It refreshes on a schedule, so what you see stays current.
Colours and any options can be changed in settings; nothing is stored beyond your own browser.
Counting vulnerabilities by CVSS band
A CVE identifier names a publicly disclosed software vulnerability. The CVE Program is maintained by The MITRE Corporation on behalf of CISA, the US Cybersecurity and Infrastructure Security Agency. The National Vulnerability Database, run by NIST, adds analysis to CVE records, including a severity score under the Common Vulnerability Scoring System. This saver counts how many entries NVD published each month in each score band.
The CVSS v3.1 specification maps scores to qualitative ratings: Low is 0.1 to 3.9, Medium 4.0 to 6.9, High 7.0 to 8.9 and Critical 9.0 to 10.0, with 0.0 rated None. A month's total here is the sum of the scored bands, so entries without a score are not counted. That is why recent months appear lower than they will eventually be: scoring can arrive after publication, and NVD has had enrichment backlogs since early 2024.
Counts reflect the disclosure process as much as the state of software. A month can spike because one vendor or researcher filed many records at once, and a higher count can mean better reporting rather than worse security. Severity is a generic technical score, not the risk to any particular system, so this chart is a statistical overview and not a basis for security decisions.
A worked example
How many vulnerabilities NVD published each month split by CVSS band, counted directly from NVD and key-less. Recent months undercount because scoring lags publication, and a spike is as often one vendor filing a backlog as a bad month.
Settings & tips
- Accent and Background recolour the display.
- Every value on screen comes from the live source — nothing is simulated.
- Press ESC to leave fullscreen.
Frequently asked questions
- Is this real data?
- Yes — it comes from the source named on this page and is refreshed on a schedule.
- Is a key needed?
- No. This source is fully key-less.
- Is it free?
- Yes, and it runs entirely in your browser.
- Why are the latest months lower than older ones?
- Scores can be added after a record is published, so recent entries may not yet fall in any band. Some fill in over the following weeks.
- Does a critical score mean a vulnerability is being exploited?
- No. The score rates technical characteristics of the vulnerability, not whether anyone is exploiting it in practice.