The disclosure wave
New public vulnerability records, grouped by publication month.
BlackTreeCVE IntelligenceHistorical perspectiveOfficial publication and KEV datesIncomplete months marked
Security in perspective
Security in motion.
New vulnerabilities keep arriving. Some older ones are still being exploited. See both stories in the data.
Microsoft monthly snapshot
Nov 2026 · Month to dateMicrosoft-assigned CVEs by their first disclosure in the Security Update Guide. MSRC data revised 2026-11-12.
- Microsoft-assigned CVEs
- 1,095 First disclosed this month
- Critical
- 64 Microsoft severity
- Important
- 1,029 Microsoft severity
- Remote code execution
- 296 Single impact
- Elevation of privilege
- 534 Single impact
- Security feature bypass
- 27 Single impact
- In CISA KEV
- 1 Catalogue dated 2026-11-10
- Microsoft reports exploitation
- 1 Status stated for 1,095 CVEs
- Public before the update
- 0 Status stated for 1,095 CVEs
- Peak completed month
- 1,474 Oct 2026
Monthly CVEs by impact
Select a segment to see its CVEs, or select a month for the full list.
- Remote code execution
- Elevation of privilege
- Security feature bypass
- Denial of service
- Information disclosure
- Spoofing
- Tampering
- Multiple impacts
- Other impact
- Unclassified
More vendor snapshots
Saved through .
Apple
- Apple CVEs
- 10 Nov 2026 to date
- iOS and iPadOS only
- 1 Nov 2026 to date
- macOS only
- 0 Nov 2026 to date
- Safari only
- 0 Nov 2026 to date
- Watch, TV and Vision only
- 0 Nov 2026 to date
- Other products only
- 0 Nov 2026 to date
- Multiple families
- 9 Nov 2026 to date
- Last completed month
- 331 Oct 2026
- Last 12 completed months
- 1,660 Sum of monthly counts
- Peak completed month
- 360 Sept 2026
Apple · Monthly CVEs by product family
CVE identifiers listed in Apple security advisories, grouped by the month the update was released.
Select a segment for its CVEs, or select a month for the full list.
- iOS and iPadOS only
- macOS only
- Watch, TV and Vision only
- Other products only
- Multiple families
Red Hat
- Red Hat CVEs
- 1,013 Nov 2026 to date
- Critical
- 7 Nov 2026 to date
- Important
- 495 Nov 2026 to date
- Moderate
- 393 Nov 2026 to date
- Low
- 118 Nov 2026 to date
- Unrated
- 0 Nov 2026 to date
- Vendor-reported exploitation
- Unavailable Full status unavailable
- Last completed month
- 4,146 Oct 2026
- Last 12 completed months
- 23,370 Sum of monthly counts
- Peak completed month
- 4,218 Sept 2026
Red Hat · Monthly CVEs by Red Hat severity
CVE records in Red Hat’s Security Data API, grouped by the month of the published public date.
Select a segment for its CVEs, or select a month for the full list.
- Critical
- Important
- Moderate
- Low
- Unrated
Ubuntu
- Ubuntu notices
- 144 Nov 2026 to date
- Ubuntu 26.04 only
- 10 Nov 2026 to date
- Ubuntu 24.04 only
- 8 Nov 2026 to date
- Ubuntu 22.04 only
- 7 Nov 2026 to date
- Other single release
- 35 Nov 2026 to date
- Multiple releases
- 84 Nov 2026 to date
- Release unspecified
- 0 Nov 2026 to date
- Last completed month
- 119 Oct 2026
- Last 12 completed months
- 1,499 Sum of monthly counts
- Peak completed month
- 207 Sept 2026
Ubuntu · Monthly security notices by release coverage
Published Ubuntu Security Notices (USNs), grouped by their publication month and the Ubuntu releases Canonical lists.
Select a segment for its notices, or select a month for the full list.
- Ubuntu 26.04 only
- Ubuntu 24.04 only
- Ubuntu 22.04 only
- Other single release
- Multiple releases
SAP
- SAP CVEs
- 41 Nov 2026 to date
- Critical
- 10 Nov 2026 to date
- High
- 15 Nov 2026 to date
- Medium
- 15 Nov 2026 to date
- Low
- 1 Nov 2026 to date
- Unrated
- 0 Nov 2026 to date
- Vendor-reported exploitation
- Unavailable Full status unavailable
- Last completed month
- 22 Oct 2026
- Last 12 completed months
- 271 Sum of monthly counts
- Peak completed month
- 42 Aug 2026
SAP · Monthly bulletin CVEs by SAP priority
CVE identifiers listed in SAP’s public Security Patch Day bulletins, grouped by bulletin month.
Select a segment for its CVEs, or select a month for the full list.
- Critical
- High
- Medium
- Low
Android
- Android CVEs
- 215 Nov 2026 to date
- Critical
- 23 Nov 2026 to date
- High
- 192 Nov 2026 to date
- Moderate
- 0 Nov 2026 to date
- Low
- 0 Nov 2026 to date
- Vendor-reported exploitation
- Unavailable Full status unavailable
- Public before the update
- Unavailable Full status unavailable
- Last completed month
- 25 Oct 2026
- Last 12 completed months
- 523 Sum of monthly counts
- Peak completed month
- 172 Sept 2026
Android · Monthly Android bulletin CVEs by severity
CVE identifiers listed in Google’s Android Security Bulletins, grouped by the month the bulletin was published.
Select a segment for its CVEs, or select a month for the full list.
- Critical
- High
- Moderate
Disclosure and exploitation
Two signals. Two stories.
Publication volume and confirmed exploitation answer different questions. The charts share a calendar, but each has its own count scale.
The exploitation signal
Vulnerabilities added to CISA's exploited list, by the date they joined it.
The current month is shown as a hollow point and is never used for a full-month comparison. KEV confirms exploitation in the wild, but it is not a count of incidents or every exploited CVE.
Every year since 1999
Newest first. 2026 is year to date, not a full-year comparison. Earlier counts can change as source records are corrected.
2026 so farAll other bars show complete calendar years
The long tail
Yesterday's flaws, today's concern
Age of CVEs added to KEV from 1 Nov 2025 to 31 Oct 2026.
12%were published at least 3 years before their KEV addition.38 of 313 additions in this period
80%Less than 1 year old251 CVEs
5%1 to under 3 years old16 CVEs
12%3 years old or more38 CVEs
3%Age not established8 CVEs
See the exact monthly and annual figures
Monthly counts
| Month | CVE publications | KEV additions |
|---|---|---|
| Nov 2026 (partial) | 7,467 | 13 |
| Oct 2026 | 17,050 | 36 |
| Sept 2026 | 14,929 | 43 |
| Aug 2026 | 12,257 | 31 |
| Jul 2026 | 9,759 | 26 |
| Jun 2026 | 7,949 | 23 |
| May 2026 | 6,933 | 21 |
| Apr 2026 | 5,813 | 31 |
| Mar 2026 | 6,236 | 26 |
| Feb 2026 | 4,616 | 28 |
| Jan 2026 | 4,302 | 17 |
| Dec 2025 | 5,493 | 20 |
| Nov 2025 | 3,019 | 11 |
| Oct 2025 | 4,274 | 31 |
| Sept 2025 | 4,319 | 16 |
| Aug 2025 | 3,629 | 15 |
| Jul 2025 | 3,774 | 20 |
| Jun 2025 | 3,682 | 20 |
| May 2025 | 3,980 | 24 |
| Apr 2025 | 4,033 | 15 |
| Mar 2025 | 4,001 | 32 |
| Feb 2025 | 3,673 | 27 |
| Jan 2025 | 4,273 | 14 |
| Dec 2024 | 3,433 | 16 |
| Nov 2024 | 4,054 | 22 |
| Oct 2024 | 3,566 | 17 |
| Sept 2024 | 2,514 | 25 |
| Aug 2024 | 2,895 | 19 |
| Jul 2024 | 3,113 | 14 |
| Jun 2024 | 3,080 | 9 |
| May 2024 | 4,991 | 14 |
| Apr 2024 | 3,604 | 10 |
| Mar 2024 | 3,299 | 10 |
| Feb 2024 | 2,784 | 9 |
| Jan 2024 | 2,591 | 21 |
Annual publications
| Year | CVE publications |
|---|---|
| 2026 (year to date) | 97,311 |
| 2025 | 48,150 |
| 2024 | 39,924 |
| 2023 | 28,847 |
| 2022 | 24,999 |
| 2021 | 20,177 |
| 2020 | 18,363 |
| 2019 | 17,308 |
| 2018 | 16,510 |
| 2017 | 14,642 |
| 2016 | 6,457 |
| 2015 | 6,494 |
| 2014 | 7,928 |
| 2013 | 5,187 |
| 2012 | 5,288 |
| 2011 | 4,150 |
| 2010 | 4,639 |
| 2009 | 5,732 |
| 2008 | 5,673 |
| 2007 | 7,211 |
| 2006 | 6,885 |
| 2005 | 6,708 |
| 2004 | 1,612 |
| 2003 | 1,223 |
| 2002 | 1,690 |
| 2001 | 1,323 |
| 2000 | 1,437 |
| 1999 | 320 |
Reading the figures
Useful context, not a fear metric
BlackTree counts official, non-rejected CVE.org records by publication date. KEV counts are non-rejected CVEs currently retained with a CISA Date Added. The age split uses only records with an official publication date no later than KEV addition; the rest are labelled undetermined. Numbers can change after upstream corrections and backfills.
Source checks
CVE.org: ok, last successful refresh 13 Nov 2026
CISA KEV: ok, last successful refresh 13 Nov 2026
CVE.org ↗CISA KEV ↗