How many CVEs were published in the last 12 months?

98,356 CVE records were first published in Nov 2025 – Oct 2026, up 109% on the 12 months before (47,125). Over the last 90 days the pace was 515 a day.

How many CVEs were published in 2025?

48,150 CVE records were first published in 2025. In 2026, 96,878 were published through 12 November 2026.

How many CVEs are there in total?

405,853 CVE records were in the PUBLISHED state on 12 November 2026. Rejected records are not counted.

How many CVEs are known to be exploited?

1,779 published CVEs are in CISA's Known Exploited Vulnerabilities (KEV) catalog as of 12 November 2026. Treat it as a lower bound: KEV lists exploitation documented to CISA's standard, not all exploitation.

What share of CVEs end up in CISA KEV?

Of the 48,150 CVEs published in 2025, 197 (0.41%) are in KEV today. Recent years look lower partly because listings keep arriving for years after publication.

How many vulnerabilities were added to CISA KEV in the last 12 months?

313 in Nov 2025 – Oct 2026, against 252 in the 12 months before.

Is CVE growth caused by more vulnerabilities?

This data cannot say. More discovery, more reporting and more organizations issuing CVE IDs (412 published in 2026) look the same in publication counts.

Where do these numbers come from?

The CVE List v5 (publication dates and assigners), CISA KEV (documented exploitation), NVD (extra severity scores) and FIRST EPSS (exploitation forecasts). Rebuilt every day; each daily bulletin is frozen, and every count lists the CVE IDs behind it.

Method

Bulletin 2026-11-13-b7 · method/1.1.0 · built 2026-11-13T09:30:06Z

Short answers

data through 12 November 2026

How many CVEs were published in the last 12 months?: 98,356 CVE records were first published in Nov 2025 – Oct 2026, up 109% on the 12 months before (47,125). Over the last 90 days the pace was 515 a day.
How many CVEs were published in 2025?: 48,150 CVE records were first published in 2025. In 2026, 96,878 were published through 12 November 2026.
How many CVEs are there in total?: 405,853 CVE records were in the PUBLISHED state on 12 November 2026. Rejected records are not counted.
How many CVEs are known to be exploited?: 1,779 published CVEs are in CISA's Known Exploited Vulnerabilities (KEV) catalog as of 12 November 2026. Treat it as a lower bound: KEV lists exploitation documented to CISA's standard, not all exploitation.
What share of CVEs end up in CISA KEV?: Of the 48,150 CVEs published in 2025, 197 (0.41%) are in KEV today. Recent years look lower partly because listings keep arriving for years after publication.
How many vulnerabilities were added to CISA KEV in the last 12 months?: 313 in Nov 2025 – Oct 2026, against 252 in the 12 months before.
Is CVE growth caused by more vulnerabilities?: This data cannot say. More discovery, more reporting and more organizations issuing CVE IDs (412 published in 2026) look the same in publication counts.
Where do these numbers come from?: The CVE List v5 (publication dates and assigners), CISA KEV (documented exploitation), NVD (extra severity scores) and FIRST EPSS (exploitation forecasts). Rebuilt every day; each daily bulletin is frozen, and every count lists the CVE IDs behind it.

What is counted

The unit is one distinct CVE ID. Updates, affected products, references and scores never create extra CVEs.
405,853 records are in the PUBLISHED state. 19,170 rejected records are kept for reconciliation and left out of every total. 1,516 published records carry the “disputed” tag, 450 “exclusively-hosted-service” and 1,389 “unsupported-when-assigned”. They are counted like any other published record.
Timelines use the 405,755 published records with a valid first-publication time strictly before the cutoff, 2026-11-13T00:00:00Z (99.976% of published). 98 were published on the build day and wait for the next bulletin. Missing dates: 0. Invalid: 0. Dated in the future: 0.

All times are UTC. Intervals include their start and exclude their end. 2 timestamps had no timezone and were read as UTC; the original strings are kept.
A missing publication date is never filled in from NVD, the year in the ID, the reservation date, an update date or anything else.
History is recalculated from the latest record states, so a corrected date or a later rejection changes today's series. A published bulletin is frozen and keeps its own inputs.
The year in a CVE ID is when the number was reserved. It is reported as a check on late publication and is never used as a date.

Sources in this bulletin

Source	Used for	Version	Checked (UTC)	Records read
CVE List v5	Identifiers, record state, first-publication dates, assigners and record tags. The only publication clock.	deltaLog@2026-11-13T09:28:04.236Z	2026-11-13T09:28:54Z	502
CISA KEV	Catalog membership and the date each entry was added.	2026.11.10	2026-11-13T09:28:56Z	1,779
NVD	Additional CVSS assessments and weaknesses. Enrichment only, never a publication date.	modified@2026-11-13T01:00:03.7699315	2026-11-13T09:28:56Z	15,174
FIRST EPSS	A dated probability of exploitation activity in the next 30 days, with its percentile.	v2026.06.15@2026-11-12T12:00:25Z	2026-11-13T09:28:57Z	405,484

CVE List v5 · CISA KEV · NVD · FIRST EPSS · Two documents define terms used on the main page: the CNA Operational Rules v4.0 (effective 8 August 2024) and CISA's KEV catalog criteria. One external figure is quoted and not computed here: Verizon's 2026 Data Breach Investigations Report.

Exploitation evidence and its limits

“In the catalog” or “listed” means membership of CISA's KEV catalog in the version above. CISA's criteria count attempted as well as successful exploitation, and exclude scanning, security research and proof-of-concept code.
An entry needs a CVE ID and a clear remediation, so the catalog cannot contain exploited flaws that have neither.
The date added is CISA's catalog date at day precision. The interval from publication to listing is not the time to first exploitation. 62 entries are dated before their CVE record was published.

Additions in a period are never divided by publications in that period: the two count different records.
Comparisons across years give each cohort the same follow-up time and leave out any cohort whose window has not closed. They are computed from this catalog snapshot, not from a reconstruction of past catalog states, so removals and corrected dates can restate them.
Not listed means absent from this catalog. It is not evidence that a vulnerability has never been exploited.

Severity and forecasts

CVSS comparisons use one version at a time, v3.1 by default. The CNA's own assessment is used, otherwise one explicitly from NVD. Other providers' assessments are shown in each record but not merged. Several different scores from the chosen source become “Multiple assessments”.
In this bulletin 61.5% of dated records have a single v3.1 score and 11.4% a single v4.0 score. NVD's selective enrichment since April 2026 means a missing NVD score can be policy, not delay.
EPSS scores are from model v2026.06.15, dated 12 November 2026. 405,481 published records have a score and 372 do not; missing means unknown, never zero. The score is that day's forecast, not what was known when a CVE was published.

Wording rules

Growth in publication pace is the percentage change in records per day. Change in the growth rate is the difference between two consecutive growth percentages, in percentage points. “Accelerating” needs both to be positive.
Not available appears whenever a ratio would divide by zero. It is never shown as 0% or infinity.
Not yet comparable marks a cohort whose follow-up window has not finished. The whole cohort is left out.
Nothing here attributes a change to AI, researcher productivity, software quality or attacker capability. These sources cannot support that.

Checks this bulletin passed

A bulletin is published only if every source was checked successfully and the checks below pass. The browser's calculations were also compared with the pipeline's on 1,785 test queries and had to match exactly.

Check	Result	Detail
distinct cve ids	pass	rows=405853 distinct=405853 published=405853
coverage partition	pass	U=405755
metric reconciliation	pass
columns roundtrip	pass
columns universe	pass	405755 vs 405755
export records rows	pass	405853 vs 405853
export monthly sum	pass
kev distinct	pass	0
no quarantine overflow	pass	0 quarantined

Downloads and earlier bulletins

kev.csv 224,038 bytes · sha256 6b6c32f5db8758fe…
monthly.csv 10,645 bytes · sha256 f19c905310f2e9ed…
records.csv.gz 7,584,832 bytes · sha256 65ce174c7ee445b9…
manifest.json the release contract
Every file starts with the bulletin number, cutoff, method version, source versions and the required notices. Each figure on the main page exports its own CSV.

Privacy

No cookies, no local identifiers, no fingerprinting and no third-party scripts. The only thing stored in your browser is your light or dark theme choice.
Each page view sends one anonymous request to this site with the page path and the hostname of the referring site. The server adds it to a daily total. It stores no IP address, user agent or per-visitor record.
Nothing is sent if your browser signals Do Not Track or Global Privacy Control.

Automated readers can leave an optional note in the guestbook. It is self-reported, kept apart from the page-view totals, and visible only to the site owner.
Your selections live in the page address, so a link you share reproduces what you saw. They are not logged.

Terms and notices

CVE. A public identifier, such as CVE-2024-3094, for one publicly disclosed vulnerability. Each ID is counted once here. A record can be disputed, and many vulnerabilities never receive one.
CNA. CVE Numbering Authority: an organization allowed to assign CVE IDs and publish the records. It is the assigner recorded in the source, not necessarily the researcher or the affected vendor.
KEV. CISA's Known Exploited Vulnerabilities catalog. An entry needs a CVE ID, reliable evidence of attempted or successful exploitation, and a clear remediation. It does not count victims, and absence from it is not evidence that a flaw was never exploited.
CVSS. Common Vulnerability Scoring System: a 0 to 10 base score for technical severity, specific to a version (3.1 or 4.0). Severity is not risk.
EPSS. Exploit Prediction Scoring System, by FIRST: an estimated probability that a flaw will see exploitation activity in the next 30 days. A dated forecast, not an observation.

Reuse. The text, charts, exports and releases are licensed CC BY 4.0: reuse them freely, crediting CVE Observatory with a link to https://cveobservatory.org (or to the bulletin you used). The code is Apache 2.0 on GitHub. Source data keeps its own terms, listed here.
CVE records: Copyright (c) MITRE Corporation / CVE Program. Use subject to the CVE Program Terms of Use, https://www.cve.org/legal/termsofuse. CVE is a registered trademark of The MITRE Corporation.
CISA Known Exploited Vulnerabilities catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog
This product uses data from the NVD API but is not endorsed or certified by the NVD. https://nvd.nist.gov
EPSS scores: FIRST, https://www.first.org/epss/. Probability of exploitation activity in the next 30 days; not a measure of observed exploitation.
CVE Observatory is an independent educational project, not affiliated with or endorsed by MITRE, the CVE Program, CISA, NIST or FIRST.
parsers cve-record/1.1, cvss-select/1.0, dates/1.0, csv/1.1, nvd-record/1.0