CVE Statistics 2026: NVD Counts, Severity and Top Vendors

The National Vulnerability Database published 72,811 non-rejected CVE records between January 1 and September 30, 2026. The count comes from quarterly queries of NIST’s NVD API. Measured against 2025, those CVE statistics show the nine-month total already past the 48,152 records NVD lists for all of 2025, and it sits above FIRST’s revised projection of approximately 66,000 CVEs for the full year.

Volume is outrunning analysis. NVD logged 36,970 records in the third quarter of 2026 alone, yet only 8.4% of them carry a CVSS v3 severity, down from 37.3% a year earlier. The figures below track volume, severity, vendors, weaknesses, exploitation and forecasts, with each count tied to the body that published it.

Key Takeaways

• NVD recorded 51.2% more CVEs in the first nine months of 2026 than in all of 2025, with the third quarter alone at 36,970.
• NIST says CVE submissions grew 263% between 2020 and 2025, which is why it began prioritizing enrichment for KEV-listed, federal, and critical software CVEs starting on April 15, 2026.
• Critical and high-severity CVEs together totaled 18,987 in 2025, or 39.4% of the year’s published CVEs in Jerry Gamblin’s count.
• Only 0.19% of Q3 2026 CVEs now sit in CISA’s KEV catalog, against 0.36% of Q3 2025 CVEs, even as total volume more than tripled.
• Linux led all vendors with 5,687 CVEs in 2025, more than 4.5 times Microsoft’s total.
• Patchstack, a WordPress plugin security firm, assigned 7,007 CVEs in 2025, making it the most active CVE Numbering Authority.
• 31% of breaches in Verizon’s 2026 DBIR start with software vulnerabilities, ahead of stolen passwords.

Editor’s Choice

• Published CVE Records in 2025: 48,244, per the CVE Program.
• NVD records, Q1 to Q3 2026: 72,811.
• CISA KEV catalog size: 1,734 entries in catalog version 2026.10.04.
• Zero-days exploited in 2025: 90, as tracked by Google Threat Intelligence Group.
• CNA partners: 554 CNAs from 43 countries.
• Microsoft CVEs in September 2026: 999 in one monthly release.

CVE Statistics by Year: Total CVEs Published

• The CVE Program published 48,244 CVE Records in 2025, up from 40,077 in 2024, a 20.4% increase.
• Annual volume has climbed every year since 2016, when the program published 6,457 records.
• The first two quarters of 2026 already account for 35,872 published records, 51.3% above the 23,710 published in the first half of 2025.
• Jerry Gamblin’s annual review counts 48,185 CVEs published in 2025, a 20.6% increase from 2024’s 39,962, with all statistics excluding rejected CVEs.
• Summing NVD’s four 2025 quarters gives 48,152 non-rejected records, a third count within 92 records of the CVE Program’s total.

Source: CVE Program Metrics, 2016 to 2025

The three 2025 totals differ because each counts at a different moment and with a different rule. The CVE Program snapshots each quarter and reconciles at year-end, NVD reports records live with rejected entries filtered out, and Gamblin’s review counts the year with rejected CVEs excluded.

About This Data

Compiled from 41 sources: 27 NVD API queries, 8 government and CVE Program pages, 1 vendor release note (Microsoft), 4 industry reports (FIRST, Verizon and Google) and 1 independent analysis of the CVE List. Data runs from 2016 to October 4, 2026, with quarterly NVD counts covering January 2025 to September 2026. Only official records, vendor advisories, and named research are qualified. Figures are reviewed on a rolling basis and updated when sources publish new editions.

Don’t chase tech news. We track it for you.

One weekly briefing with the launches, AI developments, and breaches that matter. No filler.

Email address

Subscribe Now

Read by pros at Fortinet, TSMC, Barclays, and Deloitte.

How many CVEs are there?

The total number of CVEs since 1999 stands at 308,920, excluding rejected CVEs, according to Jerry Gamblin’s annual review. That figure covers the end of 2025, so the 2026 records counted below come on top of it.

What does CVE stand for?

CVE stands for Common Vulnerabilities and Exposures, a program whose mission is to identify, define, and catalog publicly disclosed cybersecurity vulnerabilities. There is one CVE Record for each vulnerability in the catalog, which lets defenders confirm they are discussing the same flaw.

CVEs Published per Quarter in 2025 and 2026

• NVD’s third-quarter 2026 count reached 36,970 records, a 215.3% jump over the same quarter of 2025.
• That pace works out to about 402 new CVEs per day across the 92 days of July, August and September.
• The second quarter of 2026 added 20,689 records, and the first quarter added 15,152.
• The CVE Program’s own count for the first quarter of 2026 is 15,163, and 20,709 for the second, close to NVD’s figures.
• Every 2025 quarter landed between 11,695 (Q2) and 12,786 (Q4) in NVD.
• Tuesday produced 11,754 CVEs in 2025, driven largely by the Patch Tuesday release cadence, while weekends averaged only 1,796.
• The busiest single day of 2025 was February 26, when 793 CVEs were published.

The curve was flat through 2025 and bent sharply in 2026, with the third quarter alone outpacing every full half-year in the CVE Program’s table, including the first half of 2026.

Recent Developments

• October 4, 2026: CISA released KEV catalog version 2026.10.04 with 1,734 entries, including a Citrix NetScaler flaw, CVE-2026-88779.
• September 30, 2026: CISA added one vulnerability to the KEV catalog, CVE-2026-76504 in Cisco Catalyst SD-WAN Manager.
• September 25, 2026: CISA added two KEV entries, CVE-2026-65660 in Microsoft SharePoint and CVE-2026-67279 in MikroTik RouterOS.
• September 2026: Microsoft’s security release listed 999 Microsoft CVEs, with CVE-2026-85880 and CVE-2026-81963 marked Exploitation Detected.
• July 1 to September 30, 2026: NVD recorded 36,970 non-rejected CVEs, the largest quarterly total in the series above.
• Q3 2026: 69 CVEs published in the quarter already carry a KEV listing.

NVD 2025 CVE Severity Distribution

• Medium-severity flaws made up 53.0% of 2025 CVEs at 25,551 records, the largest share.
• High-severity CVEs numbered 15,003, or 31.1%.
• Critical CVEs reached 3,984, or 8.3% of the year.
• Low-severity CVEs totaled 1,557, or 3.2%.
• The average CVSS score for 2025 was 6.60, and 91.3% of CVEs carried a CVSS score.

The quarterly series counts records that carry a CVSS v3 Critical score in NVD, and it fell through 2026 even as total volume rose.

Source: NIST National Vulnerability Database CVE API 2.0, queried October 5, 2026

What is a high severity CVE?

Under CVSS v3.x and v4.0, a High rating covers base scores from 7.0 to 8.9, while Medium spans 4.0 to 6.9. CVSS v2.0 used a wider High band of 7.0 to 10.0, so older records can read as High where newer scoring would say Critical.

CVSS Scoring Gaps After NIST’s Enrichment Change

• NIST enriched nearly 42,000 CVEs in 2025, 45% more than any prior year.
• Submissions during the first three months of 2026 ran nearly one-third higher than the same period of 2025, according to NIST.
• CVEs outside NIST’s priority criteria are now labeled Lowest Priority, not scheduled for immediate enrichment.
• In Q3 2026, 3,120 of 36,970 NVD records carried a CVSS v3 severity of any level.
• In Q3 2025, 4,377 of 11,725 records carried one.
• High-severity v3 ratings in Q3 2026 totaled 1,274, close to the 1,321 in Q3 2025, while medium ratings fell from 2,049 to 1,361.

Why it matters: NIST now prioritizes enrichment for KEV-listed CVEs, CVEs for software used within the federal government and CVEs for critical software. With only 8.4% of third-quarter 2026 records carrying an NVD CVSS v3 severity, scanners reading NVD alone will show most new CVEs without a CVSS v3 severity, even where a v4.0 score exists.

Defenders who sort by NVD severity should expect blanks, and the CNA’s own score in the CVE Record is the practical substitute. NIST lists its full priority criteria in the NVD operations update.

CVE Count by Vendor and Product

• Linux topped the 2025 vendor ranking with 5,687 CVEs, equal to 11.8% of all 2025 CVEs.
• Microsoft ranked second with 1,255 CVEs and Adobe third with 829.
• Code-Projects placed fourth with 730, just ahead of Apple at 727.
• Among individual products, Linux Kernel ranked first with 3,649 CVEs.
• Windows 10 followed with 623 CVEs and Android with 509.
• Only 57.6% of 2025 CVEs carried CPE product identifiers, which limits how precisely any vendor ranking can be built.

Linux also issues CVEs as its own CNA (see the CNA ranking below), so its lead measures disclosure practice as much as exposure. Readers tracking the operating system itself can compare these counts with Linux usage statistics to weigh exposure against installed base.

Products With the Most CVEs

Most Common CWE Weakness Types

• Cross-site scripting (CWE-79) was the most common weakness in 2025 with 8,207 CVEs.
• Injection (CWE-74) ranked second at 2,564, and missing authorization (CWE-862) third at 2,224.
• Cross-site request forgery (CWE-352) accounted for 1,894 CVEs, and SQL injection (CWE-89) for 1,706.
• 17.0% of all 2025 CVEs were cross-site scripting flaws.
• 92.3% of 2025 CVEs carried a CWE classification.

CVE Numbering Authorities by Volume

• Patchstack assigned 7,007 CVEs in 2025, followed by VulDB at 5,902 and Linux at 5,686.
• In total, 365 unique CNAs assigned CVEs in 2025.
• The CVE Program counts 554 CNAs from 43 countries, including 3 CNAs of Last Resort.
• CNAs of Last Resort published 6% of CVE Records in 2026, down from 50% in 2017.
• The program added 72 CNA partners in 2026 through September.

Source: Jerry Gamblin, 2025 CVE Data Review, January 2026

By the numbers: Patchstack alone assigned 7,007 CVEs, vastly outnumbering traditional giants like Microsoft or Google, equal to 14.5% of everything published in 2025. Patchstack and Wordfence, organizations dedicated to WordPress plugin security, are now top drivers of CVE volume, a shift Jerry Gamblin calls the WordPress Effect.

Known Exploited Vulnerabilities Statistics

• CISA’s KEV catalog held 1,734 entries as of October 4, 2026.
• NVD flags 197 CVEs published in 2025 as KEV-listed, and 176 from the first three quarters of 2026.
• 69 CVEs published in Q3 2026 already carry a KEV listing, the highest quarterly count in the series.
• CISA’s four-CVE batch in late September covered Check Point, Arista VeloCloud Orchestrator and F5 BIG-IP APM flaws.
• FIRST found that when filtered for CISA KEV entries or EPSS scores above 10%, the patching burden has not materially increased.

The exploited count grew far more slowly than total volume, which supports FIRST’s point that the flood of new CVEs is mostly noise for patch planning. The live CISA KEV tracker follows each new addition and its federal due date.

Key finding: Exploitation now opens more breaches than stolen credentials. Verizon’s Data Breach Investigations Report found that 31% of breaches now start with software vulnerabilities, beating stolen passwords as the top way attackers get in. That finding puts KEV-listed flaws at the front of any patch queue.

The broader cybersecurity attack data shows how often those entry points turn into incidents.

Zero-Day Vulnerabilities Exploited per Year

• Google Threat Intelligence Group tracked 90 zero-days exploited in the wild in 2025, below the record 100 of 2023 and above 78 in 2024.
• 43 zero-days, or 48%, hit enterprise software and appliances in 2025, up from 36 (46%) in 2024.
• Security and networking products accounted for about half (21) of the enterprise zero-days.
• Operating systems were the most exploited category at 44% (39) of all zero-days.
• Mobile zero-days rose to 15 in 2025 from the 9 identified in 2024.
• GTIG attributed 9 zero-days to confirmed or likely financially motivated groups.

CVE Forecasts for 2026 Versus Actual Volume

• FIRST’s February 2026 forecast set a median of approximately 59,427 CVEs for 2026, with a 90% confidence interval from 30,012 to 117,673.
• By June 15, 2026, actual disclosures were running 46.3% above those projections, with 6,420 excess CVEs recorded through April 2026.
• FIRST cited a 449% year-over-year surge in GitHub Security Advisory volume and a 3,119% increase in VulnCheck CNA-of-Last-Resort activity.
• NVD’s count through September already exceeds the revised projection by about 6,811 records.

Source: FIRST 2026 Vulnerability Forecast (February 2026) and Mid-Year Update (June 2026)

FIRST lists AI-assisted vulnerability discovery among three structural drivers of the increase, the same pressure tracked in AI code vulnerability data. At the third-quarter pace, the full-year NVD total will land well above both central forecasts, though the forecasters’ own error bars are wide.

Microsoft Patch Tuesday CVE Volume

• Microsoft’s September 2026 release consists of 999 Microsoft CVEs.
• Windows accounted for 714 of the vulnerabilities addressed, Office for 122 and SQL for 61.
• 71.5% of the release’s CVEs were Windows flaws.
• CVE-2026-85880 in Windows ALPC and CVE-2026-81963 in the Windows Update Stack were marked Exploitation Detected.

Monthly totals vary widely, and Microsoft’s monthly patch volume shows how September compares with earlier releases.

The takeaway: A single Microsoft monthly release lists 999 Microsoft CVEs, with Windows at 714. Tuesday remains the king of disclosure, with 11,754 CVEs in 2025, so monthly patch triage is now a ranking exercise rather than a review of every advisory.

Reserved and Rejected CVE IDs

• CNAs reserved 70,729 CVE IDs in 2025, up from 52,316 in 2024.
• Reservations for 2026 already total 54,694.
• 22,485 more IDs were reserved than published in 2025.
• 1,787 CVEs were rejected in 2025, a 3.58% rejection rate.
• Rejected CVEs across all years total 16,357.

What does a CVE score of 10 signify?

A CVSS score of 10.0 sits at the top of the Critical band, which runs from 9.0 to 10.0 under CVSS v3.x and v4.0. It marks the most severe rating CVSS can assign; exploitation status is a separate signal.

Exploitation status comes from sources such as CISA’s KEV catalog, which adds a CVE based on evidence of active exploitation. A perfect score with no KEV listing and a lower-scored CVE already in KEV call for different urgency.

Conclusion

NVD’s 72,811 records through September already sit above FIRST’s revised projection for the full year, while only 8.4% of the newest records carry an NVD CVSS v3 severity. Volume is no longer the useful signal; exploitation is. Teams that triage from KEV listings, CNA scores, and vendor advisories will cope better than teams waiting on NVD enrichment.

The fourth-quarter count and NIST’s next update on its enrichment backlog are the two numbers to watch next. Wider context on threats and defenses sits in our cybersecurity statistics roundup.