# Unveiling the Landscape of Operating System Vulnerabilities
###### Abstract  
Operating systems play a crucial role in computer systems, serving as the fundamental infrastructure that supports a wide range of applications and services. However, they are also prime targets for malicious actors seeking to exploit vulnerabilities and compromise system security. This is a crucial area that requires active research; however, OS vulnerabilities have not been actively studied in recent years. Therefore, we conduct a comprehensive analysis of OS vulnerabilities, aiming to enhance the understanding of their trends, severity, and common weaknesses. Our research methodology encompasses data preparation, sampling of vulnerable OS categories and versions, and an in-depth analysis of trends, severity levels, and types of OS vulnerabilities. We scrape the high-level data from reliable and recognized sources to generate two refined OS vulnerability datasets: one for OS categories and another for OS versions. Our study reveals the susceptibility of popular operating systems such as Windows, Windows Server, Debian Linux, and Mac OS. Specifically, Windows 10, Windows 11, Android (v11.0, v12.0, v13.0), Windows Server 2012, Debian Linux (v10.0, v11.0), Fedora 37, and HarmonyOS 2, are identified as the most vulnerable OS versions in recent years (2021-2022). Notably, these vulnerabilities exhibit a high severity, with maximum CVSS scores falling into the 7-8 and 9-10 range. Common vulnerability types, including CWE-119, CWE-20, CWE-200, and CWE-787, are prevalent in these OSs and require specific attention from OS vendors. The findings on trends, severity, and types of OS vulnerabilities from this research will serve as a valuable resource for vendors, security professionals, and end-users, empowering them to enhance OS security measures, prioritize vulnerability management efforts, and make informed decisions to mitigate risks associated with these vulnerabilities. operating system; vulnerabilities; security; CVE; NVD +
Footnote †: journal:  
0000-0001-5000-0000-0000-0000-0000-0000-0000-0000-0000-0000-0000-00  
Understanding the landscape of OS vulnerabilities is crucial from multiple perspectives. Firstly, it enables OS vendors to identify and address vulnerabilities within their products, thereby enhancing the security and resilience of their OSs. This research aims to provide OS vendors with valuable insights into the specific vulnerabilities and common weakness patterns prevalent in various OS categories and versions. Secondly, this research serves as a valuable resource for end-users. By comprehending the vulnerabilities present in popular OSs, end-users can adopt appropriate security measures to protect their systems and personal data. Understanding the types and severity of vulnerabilities empowers end-users to make informed decisions when it comes to OS selection, security configurations, and best practices. Additionally, this research contributes to the broader field of cyber-security. By studying OS vulnerabilities, researchers can gain insights into the evolving threat landscape and develop effective strategies to counter emerging risks. It provides an opportunity to identify trends, patterns, and common vulnerability types, which can inform the development of robust security frameworks and defensive mechanisms. In this paper, we first collect entire Common Vulnerabilities and Exposure (CVE) IDs from CVE Mitre. We clean the dataset based on different CVE statuses (reserved, rejected, disputed, etc.). Next, we scrape the data for each CVE ID from the National Vulnerability Database (NVD) website. Specifically, we collect data points such as product type, product name, product versions, vendor name, CVSS scores, and CWE ID. We then extract only those data related to OS vulnerabilities, finally creating two refined datasets, namely OS_CAT and OS_VER, specifically tailored to our research objectives. Using this dataset, we sample highly vulnerable OS categories within the time range from 1999 to 2022.