Critical and high severity cybersecurity vulnerabilities from major vendors
Critical and high severity cybersecurity vulnerabilities published each month by twenty major technology vendors' product-security teams, using the severity each recorded on its own CVE. Counts were broadly flat through 2022 and 2023, drifted up across 2024 and 2025, then climbed steeply through 2026. The marked date is Anthropic's Claude Mythos Preview announcement on 7 April 2026: it records when that happened rather than explaining a rise already under way that February. Reporting practice varies between vendors, so this measures disclosure activity, not how insecure any product is.
What does it show?
High-severity disclosures from twenty major vendors reached 2,363 in July 2026 against 433 a year earlier, with critical records rising from 63 to 703.
Methodology
CVE records assigned by the product-security teams of AMD, Adobe, Apache, Apple, Cisco, GitHub, Google, IBM, Intel, Linux, Microsoft, Mozilla, NVIDIA, OpenSSL, Oracle, Qualcomm, Red Hat, SAP, Samsung, VMware, counted by publication month and by the severity in the record itself. Read from the National Vulnerability Database API, filtering on each organization's CNA source identifier from NVD's published CNA roster. The severity is the one the assigning organization recorded (CVSS v3.1, v3.0 or v4.0 base severity, preferring the primary rating), NOT the rating NVD assigns during its own analysis: NVD rates a roughly constant number of records each month regardless of how many are published, so a series built on its ratings flattens whatever the vendors report. AWS has no CNA of its own in NVD's roster and is not included. Reporting procedures, labeling and cadence vary substantially between these organizations, and a count of reported vulnerabilities measures disclosure activity rather than how insecure any product is. The current month is excluded, because a part-month is a smaller number for a mechanical reason. The marked date is 7 April 2026, when Anthropic announced Claude Mythos Preview, a model reported to discover and exploit previously unknown vulnerabilities without human guidance, and subsequently Project Glasswing, which the company says found more than 10,000 high or critical flaws. The mark records when that happened and is not evidence that it caused what follows: monthly counts had already begun climbing in February and March, before the announcement, and disclosure timing depends on each vendor's embargo and release practice.