The global CVE dataset — and why it's rising
Every CVE published, 2016 to 2026, from CVE.org / NVD cross-checked against Jerry Gamblin's annual reviews. Publication has gone near-vertical since 2023 — but the honest read is that the vulnerability-counting pipeline changed more than the vulnerability landscape did.
Annual CVE publication, 2016–2026
A decade of disclosure. 2026 = H1 actuals (35,364), annualized ~59k–72k depending on method. Solid bars rest on more than one source; outlined bars (2016–2021) on a single renderable source; the hatched bar is the first half of 2026, with a tick where 2025 stood at the same point.
The dataset, year by year
| Year | CVEs published | YoY growth | Note |
|---|---|---|---|
| 2016 | 6,449 | — | single-source year |
| 2017 | 14,643 | +127.1% | Step-change: CNA program expansion |
| 2018 | 16,510 | +12.8% | single-source year |
| 2019 | 17,305 | +4.8% | single-source year |
| 2020 | 18,323 | +5.9% | single-source year |
| 2021 | 20,153 | +10% | single-source year |
| 2022 | 25,084 | +24.5% | — |
| 2023 | 28,902 | +15.2% | — |
| 2024 | 39,962 | +38.3% | First ~40K record year |
| 2025 | 48,185 | +20.6% | New record; 308,920 cumulative since 1999 |
| 2026* | 35,364 | — | H1 only · annualized ~71k |
Three things inflate the count before AI enters the picture
More issuers, mechanically
NIST reports CVE submissions rose 263% from 2020 to 2025, and the number of CNAs (organizations allowed to assign CVEs) grew from 435 in January 2025 to 559 by October 2026, by CVE.org’s own count. More issuers means more IDs, independent of how many bugs exist. The 2017 jump, when the count more than doubled, was an earlier version of the same effect.
The Hacker News / NIST, Apr 2026; CVE.org CNA countThe Linux-kernel firehose
The Linux kernel became a CNA in Feb 2024 and immediately became the single largest publisher — 4,325 CVEs in 2024, 10.8% of the entire year — by assigning IDs to routine bug fixes. That's a policy change, not a security regression.
Stingrai vulnerability stats 2026The 'WordPress effect'
Patchstack alone published 7,007 CVEs in 2025 — more than Microsoft or Google — with Wordfence adding 3,451. Third-party plugin ecosystems, not core operating systems, now drive raw volume.
Jerry Gamblin 2025 reviewAnd the data got less usable as it got bigger
On Feb 12, 2024, NIST's National Vulnerability Database began falling behind on enriching new CVEs — the CVSS severity scores, product mappings, and weakness classifications that let anyone prioritize. On April 15, 2026, citing a 263% rise in submissions from 2020 to 2025, NIST stopped scheduling enrichment for most new CVEs, prioritizing KEV entries, software the federal government uses, and EO 14028 'critical software'.
So the record CVE counts coincide with rationed enrichment of the data needed to act on them. Any analysis that reads the rising line as "the world is getting more dangerous, and AI is why" is skipping this. VulnCheck / NIST NVD updates, 2024–2026
Microsoft's monthly releases, as ZDI counts them, tell the same story — and 2026 broke the pattern
Before 2026, no Patch Tuesday month exceeded 177 CVEs. In 2026, Jun 2026 (208), Jul 2026 (621), Aug 2026 (398), Sep 2026 (972) and Oct 2026 (1,415) did, with Oct 2026's 1,415 the largest on record. A record month or two isn't a trend, and the cause (AI-assisted research, more tooling, a reporting change) isn't separable from the public data. The full month-by-month dataset — every count, zero-day, and category split — is its own page.