CVE Statistics 2026: How Many Vulnerabilities Are Published Each Year, and Why the Count Keeps Climbing

Original analysis of the NIST National Vulnerability Database · Last updated October 2026

CVE statistics tell a simple story with a complicated footnote. The National Vulnerability Database published 49,972 CVEs in 2025, about 2.6 times the 19,222 published in 2020, and 2026 is running 103% ahead of 2025 with 74,838 through September 30, 2026. The footnote is that NIST itself now scores only a small fraction of new CVEs, which makes NVD-based counts of “critical” flaws badly misleading.

How many CVEs are published each year?

*2026 through 2026-10-03. Severity counts use the NVD API filter, which tracks NIST-assigned scores and is understated from 2024 onward; see below.

The peak quarter in this period is 2026 Q3, with 37,712 CVEs. The 2026 increase was not a single bulk release: monthly publications rose every month from April (5,885) through May (6,985), June (8,001), July (9,919), and August (12,719) to September (15,074). In our August sample, the largest single publishing source accounted for about one in eight records.

Why is the count rising?

CVE counts depend on who assigns identifiers. The CVE Program’s published list of CVE Numbering Authorities, the organizations authorized to assign CVE IDs, has 554 entries, and 453 of them are classified as vendors, which assign identifiers to flaws in their own products. A rising count can therefore reflect more disclosure as well as more vulnerabilities, so the CVE total is a measure of disclosure activity as much as of risk.

Why do critical counts fall while totals rise?

Because NIST has stopped scoring most new CVEs itself. Each NVD record can carry a CVSS score from NIST (a “Primary” score) and scores supplied by the organization that published the CVE. We checked a sample of 2,000 CVEs published in the first quarter of 2023 and 2,000 published in August 2026. In 2023, 82% carried a NIST score. In August 2026, 10% did, and the most common NVD status was “Deferred”, meaning NIST has set the record aside without its own analysis.

The effect on severity counts is large. In the August 2026 sample, 30 CVEs were rated Critical by NIST’s own scores, but 280 were rated Critical when scores from the publishing organizations are included. In the 2023 sample the two measures were close (379 and 413). The NVD API’s severity filter returned 403 Critical CVEs for the third quarter of 2026, a count consistent with NIST-assigned scores only.

What should IT teams take from this?

The volume makes patch-everything impossible, and missing severity scores make severity alone an unreliable filter. Many teams pair CVSS with evidence of real-world exploitation, such as the CISA Known Exploited Vulnerabilities catalog, which lists only a small fraction of published CVEs. This is general context, not security advice for any environment.

Frequently asked questions

How many CVEs were published in 2025?

49,972 CVEs were published to the NIST National Vulnerability Database in 2025, by publish date.

How many CVEs have been published in 2026?

74,838 through September 30, 2026, 103% more than in the same period of 2025.

Is the number of vulnerabilities increasing?

Yes. Annual CVE publications rose from 19,222 in 2020 to 49,972 in 2025, about 2.6 times as many.

Why don’t severity counts track the total?

NIST now assigns its own score to few new CVEs. In our samples, 82% of CVEs published in early 2023 carried a NIST score, versus 10% in August 2026; severity filters based on NIST scores therefore undercount.

What is the NVD?

The National Vulnerability Database, run by NIST, is the U.S. government repository of publicly disclosed vulnerabilities, keyed by CVE identifier.

Should every CVE be patched immediately?

No organization can patch everything at once. Many teams combine severity with evidence of exploitation, such as the CISA Known Exploited Vulnerabilities catalog, to set priorities. This is general context, not security advice.

Methodology

References

1. NIST NVD, CVE API 2.0 documentation. Accessed October 2026.
2. NIST National Vulnerability Database. Accessed October 2026.
3. CVE Program, published CNA list (CNAsList.json). Accessed October 2026.