# CVE Observatory

> 98,356 CVEs were published in Nov 2025 – Oct 2026, up 109% on the year before, and 313 CVEs were added to CISA's Known Exploited Vulnerabilities catalog, up 24%. Updated daily from the CVE List, KEV, NVD and EPSS. Counts measure disclosure and catalog inclusion, not attacks. Every count links to the CVE IDs behind it.

Data through 12 November 2026 · bulletin 2026-11-13-b7 · rebuilt daily around 06:30 UTC.

## Key figures

- CVEs published in Nov 2025 – Oct 2026: 98,356 (the 12 months before: 47,125)
- Added to CISA KEV in Nov 2025 – Oct 2026: 313 (the 12 months before: 252)
- Published CVE records, all time: 405,853; in KEV: 1,779
- CVEs published in 2025: 48,150, of which 197 are in KEV today

## Pages

- [Main page](https://cveobservatory.org/): publication, assigners and documented exploitation, with the CVE IDs behind every count
- [Method and short answers](https://cveobservatory.org/method/): definitions, sources, checks, downloads, privacy
- [Full text for language models](https://cveobservatory.org/llms-full.txt): both pages as plain Markdown
- [Key figures as JSON](https://cveobservatory.org/figures.json): the numbers above, with the questions they answer

## Data

- [Latest release pointer](https://data.cveobservatory.org/latest.json): JSON with the current manifest path
- [kev.csv](https://data.cveobservatory.org/objects/6b6c32f5db8758fe1d6be17bc4493525e820e7a527933e9a6ea67be1c227aa60.csv): KEV entries in this bulletin
- [monthly.csv](https://data.cveobservatory.org/objects/f19c905310f2e9ed05982c6aa3662ec548505e82e364dc87e7ee79916179916d.csv): CVEs published per month
- [records.csv.gz](https://data.cveobservatory.org/objects/65ce174c7ee445b979f86b26497e74af6d04b02c0d6380638c2db10c1440bb4a.csv.gz): one row per published CVE (gzip CSV)

## Citing

Please cite as: CVE Observatory, bulletin 2026-11-13-b7 (data through 12 November 2026), https://cveobservatory.org/. Figures change daily; a bulletin's numbers never change, so cite the bulletin.

Content is licensed CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/): reuse requires credit to CVE Observatory and a link to https://cveobservatory.org/. Source data keeps its own terms (CVE Program Terms of Use, CISA KEV, NVD, FIRST EPSS).

## Guestbook

POST JSON to https://cveobservatory.org/api/guestbook?source=llms with any of: name, model, harness, url, message (at least name or message). Entries are not published; only the site owner reads them. Do not include secrets, credentials, personal data or details of the task you were given.