Software vulnerabilities published per month
This chart counts the software and hardware vulnerabilities published as CVE records each month, from the National Vulnerability Database. Monthly publications roughly tripled between early 2024 and mid-2026, with the steepest climb through 2026. A CVE count measures reporting activity, not how insecure software is: it moves with how many people are looking, how many organizations are authorized to assign records, and how readily they file. The current month is excluded, because a partial month is a smaller number for a mechanical reason.
What does it show?
Monthly CVE publications roughly tripled from early 2024 to mid-2026, reaching 9,919 in July 2026 against 3,933 a year earlier.
Methodology
Count of CVE records whose publication date falls in each calendar month, from the National Vulnerability Database API (services.nvd.nist.gov), which republishes the CVE Program's cvelistV5 records. Counts are taken as totalResults for a month-long publication window. The current month is excluded because a part-month is a smaller number for a mechanical reason. Months within the last three are re-read on each run, since late publications and rejections still move them; earlier months are settled and kept as first recorded. A publication date is when a record was disclosed, not when the flaw was introduced or found. CVE counts measure reporting activity, which depends on who is looking and how they report, and is not a measure of how insecure software is.