On 19 October 2026, querying the NVD API with the rejected records excluded matched 30,774 records to CVSS 3 critical, 77,038 to high, 84,025 to medium and 3,327 to low. That is 195,164 in total, about half of the 391,324 valid records. Severity bands describe scoring, not risk.
The counts
Each number is the totalResults value from the NVD CVE API 2.0 with noRejected and a cvssV3Severity filter.
| Band | Records | Share of the 195,164 |
|---|---|---|
| Critical | 30,774 | about 16 percent |
| High | 77,038 | about 39 percent |
| Medium | 84,025 | about 43 percent |
| Low | 3,327 | about 2 percent |
For comparison, the same API reported 56,837 valid records with a CVSS 2 severity of high. Older records carry version 2 scores, and not every record carries every version.
What the half that is missing means
About half of valid records do not match any version 3 band in this query. The query cannot tell you why. Plausible reasons include records from before version 3 was in use, records still awaiting analysis, and records whose only score is of another version. Do not guess a cause in a report. If it matters, sample 20 unmatched records and read them.
A related note: a filter for a CVSS 4.0 severity returned only five records in the same session, even though records exist that carry 4.0 metric blocks. Filters may match only some score sources, so check what a filter counts before you publish a number.
Why bands mislead
The FIRST specification says CVSS measures severity, not risk, and that base metrics capture intrinsic characteristics. A critical band says nothing about whether anyone exploits the flaw, or whether you run the code. On 18 October the NVD API reported 1,748 records flagged as known exploited, a far smaller group than the 30,774 critical records. So a critical band is not a proxy for exploitation.
How to use a table like this
- Use it to size a problem, not to rank one.
- Cite the date and the query text.
- Keep rejected records out of any count of real vulnerabilities.
- Pair severity with exploitation and reachability when you rank work. See vulnerability scoring signals compared.
A fair way to describe it in a report
Write: "As of 19 October 2026, the NVD API matched N valid records to the CVSS 3 critical filter." Avoid: "N percent of vulnerabilities are critical." The second sentence claims something the query does not show.
Try it yourself
Click through it at your own pace, or open it full screen.
Look at how exploitability changes the picture beyond the severity label.
Safeguard reachability analysis ranks findings by whether your code reaches the flaw, which a severity band cannot show. Try a free scan.
Quick check
Do critical CVEs make up most of the NVD?
No. In this query critical matched 30,774 of 195,164 records with a version 3 band, about 16 percent.
Is a critical band the same as actively exploited?
No. Exploitation is a separate signal, such as the known exploited flag.
Sources
Last reviewed: 19 October 2026.
