---
title: "Published CVEs pass 100,000 this year, double last year’s 49,972"
summary: "Our count of the US National Vulnerability Database to 14 November: 100,440 records, 17,481 of them in October, who numbers the flaws, and why exploited ones did not double."
url: https://www.thetechbag.com/blog/cves-pass-100000-double-last-year
format: Trend
desk: "Security"
area: "Risk & compliance"
region: Global
published: 2026-11-14
facts_checked: 2026-11-14
author: TechBag (The TechBag Journal)
tags: ["CVE count","number of CVEs","CVE 100,000","NVD CVE statistics","National Vulnerability Database","CVE Numbering Authority","CNA","FIRST vulnerability forecast","VulnCheck","known exploited vulnerabilities","CISA KEV","EPSS","AI vulnerability discovery","GitHub Security Advisories","vulnerability prioritisation","patch management","CVE.org"]
cover: https://www.thetechbag.com/blog/covers/cves-pass-100000-double-last-year.png
---

# Published CVEs pass 100,000 this year, double last year’s 49,972

*Our count of the US National Vulnerability Database to 14 November: 100,440 records, 17,481 of them in October, who numbers the flaws, and why exploited ones did not double.*

Trend · Security · Risk & compliance · By TechBag · Published 2026-11-14 · Facts checked 2026-11-14 · Canonical: https://www.thetechbag.com/blog/cves-pass-100000-double-last-year

The short version

1. The US National Vulnerability Database lists 100,440 CVE records published from 1 January to 14 November, twice 2025’s 49,972 with seven weeks of the year left. October alone brought 17,481, more than three times January.[1]
2. The records come from 567 organisations allowed to number flaws, 86 of them added this year. The forecasters at FIRST name AI-assisted bug hunting, a 449% rise in GitHub’s advisories and a 3,119% rise in VulnCheck’s numbering of otherwise unclaimed flaws.[2][5]
3. Exploited flaws did not double. VulnCheck counts 1,363 of this year’s CVEs, about 1.4%, as exploited, and FIRST says the real-world patching burden has not materially increased. Sort by exploitation and exposure, not by the count.[5][6]

A publicly disclosed software flaw usually gets a CVE number, and every scanner, patch report and compliance dashboard counts them. This year the count doubled. We counted the database most tools draw on, year by year from 2016 and month by month this year. What is being counted, who is adding to it, and does twice the number mean twice the risk?[1]

## From about 5,500 a month to 17,481

From January to April NVD added about 5,500 CVE records a month. The pace rose every month from May: 9,919 in July, 15,074 in September and 17,481 in October. The first fourteen days of November brought 8,121 more, which put the year at 100,440.[1] The previous record was 2025’s 49,972.[1]

**Figure: CVE records doubled in a year, the biggest jump since 2017**

*CVE records published in the National Vulnerability Database per year, 2016 to 2026 (2026 to 14 November)*

|  | CVE records |
| --- | --- |
| 2016 | 6,517 |
| 2017 | 18,113 |
| 2018 | 18,154 |
| 2019 | 18,938 |
| 2020 | 19,222 |
| 2021 | 21,950 |
| 2022 | 26,431 |
| 2023 | 30,949 |
| 2024 | 40,704 |
| 2025 | 49,972 |
| 2026 | 1,00,440 |

Source: NIST National Vulnerability Database, CVE API 2.0; TechBag count · as of 14 November 2026 · Includes records later rejected; the method box gives both counts

The doubling holds on the stricter count too. 2,772 of this year’s records have since been rejected, as duplicates or as not being flaws; the 97,668 that stand are about twice 2025’s 48,150 on the same basis. CVE.org, the programme’s own site, counts 48,244 records published in 2025.[1][2] CVE.org’s quarterly table shows the same acceleration: 15,154 records in the first quarter, 20,696 in the second and 36,962 in the third.[2]

**Figure: Monthly CVE records more than tripled between January and October**

*CVE records published in the National Vulnerability Database per month, January to October 2026*

|  | CVE records |
| --- | --- |
| Jan | 5,143 |
| Feb | 4,808 |
| Mar | 6,304 |
| Apr | 5,885 |
| May | 6,985 |
| Jun | 8,001 |
| Jul | 9,919 |
| Aug | 12,719 |
| Sep | 15,074 |
| Oct | 17,481 |

Source: NIST National Vulnerability Database, CVE API 2.0; TechBag count · as of 14 November 2026 · Includes records later rejected; 1 to 14 November: 8,121

## What a CVE record is, and who is writing more of them

A CVE record is one entry in a public list: one identifier for one flaw, with the affected product and versions, the kind of flaw and at least one public reference. It is written by a CVE Numbering Authority, or CNA: a software maker numbering flaws in its own products, a research firm, a bug-bounty platform or a national response team. A CNA first reserves an identifier while a flaw is being fixed, then publishes the record when it is ready to disclose.[3] There are 567 CNAs in 43 countries; 86 joined this year. CNAs now write 95% of records themselves; the programme’s numbering authorities of last resort write the other 5%, against 50% in 2017.[2]

FIRST, the global body of incident-response teams, publishes a yearly forecast of CVE volume. Its mid-year update of 15 June found disclosures running 46.3% above its February forecast and named three drivers: AI-assisted discovery, a 449% year-on-year rise in GitHub Security Advisories, and a 3,119% rise in records from VulnCheck acting as a CNA of last resort, which takes on flaws no other CNA covers. It cites Mozilla, whose CVEs rose 164% in the first quarter, which FIRST attributes to AI-assisted tools run against the Firefox engine.[5]

Josh Bressers, who leads coordinated disclosure at VulnCheck, told The Register that AI-driven bug hunting accounts for most of the volume, and named Microsoft, Oracle, GitHub and VulnCheck among the CNAs publishing in bulk.[6] Microsoft’s own monthly releases went from 71 flaws a year ago to 1,475 in October and 1,095 in November, by [our count of its update files](https://www.thetechbag.com/blog/microsoft-patch-count-71-to-1475-exploited-flat).

TechBag countHow we counted

We asked NVD’s public API for the number of records published in each window of up to 120 days, once with every record and once leaving out rejected ones, and added the windows up. Our standing count for January to September, 72,793, is within 19 of CVE.org’s 72,812.

## Twice the records, not twice the exploited flaws: what to watch

A CVE count measures how many flaws were found and written down, not how many are being used against anyone. VulnCheck says 1,363 of this year’s CVEs, about 1.4%, are in its catalogue of known exploited vulnerabilities.[6] FIRST, filtering for real-world risk with CISA’s exploited-flaw catalogue and EPSS scores above 10%, says the patching burden “has not materially increased”.[5] Our Microsoft count found the same: exploited flaws stayed between 0 and 6 a month while the total rose fifteenfold.

> In 2026, the rain doesn’t stop. The job is no longer counting the drops. It’s knowing which ones will overrun the levee.Jerry Gamblin, co-author of FIRST's forecast, 15 June 2026

So the work is triage. FIRST’s advice is to use exploitability overlays, CISA’s catalogue and EPSS, rather than scale a team with the raw count.[5] That depends on a current list of what software is actually installed, since a flaw in a product nobody runs needs no decision.

**What to watch.**

- **The forecasts.** FIRST’s February median for the year was 59,427, with a 90% range of 30,012 to 117,673; in June it raised it to about 66,000. The count has passed both, and the top of the range is about 17,000 away.[4][5]
- **The pipeline.** CNAs have reserved 105,782 identifiers this year, more than have been published; each reserved one can become a record.[2]
- **CVE.org’s fourth-quarter table,** published after the quarter ends, and its year-end reconciliation, which removes rejected records.[2]

How we did this

Figures as of 14 November 2026, 7:30pm IST

We counted CVE records with the NIST National Vulnerability Database’s CVE API 2.0 on 14 November, by NVD publish date, in windows of at most 120 days, each queried with and without the `noRejected` filter. The headline counts every record NVD lists as published, including the 2,772 of 2026 that have since been rejected, the basis FIRST’s forecast uses; the stricter count, 97,668, leaves them out, like CVE.org’s published-records table (for 2025, 48,150 against CVE.org’s 48,244). The yearly series runs from 2016, the year before the count first jumped. VulnCheck’s 100,222 (at about 4pm UTC on 13 November) and its 1,363 exploited CVEs are as The Register reports them; VulnCheck’s exploited catalogue is its own, not CISA’s. The multiples and the “about 17,000” are our arithmetic.

Spotted an error? Write to us; corrections are published at the foot of the piece.

Sources

1. [NIST National Vulnerability Database, CVE API 2.0 (counts by publish date, with and without noRejected)](https://services.nvd.nist.gov/rest/json/cves/2.0) — queried 14 November 2026
2. [CVE Program, Metrics: published CVE records by quarter, reserved CVE IDs, CNA partners](https://www.cve.org/About/Metrics) — as published on 14 November 2026
3. [CVE Program, Process: the CVE Record lifecycle](https://www.cve.org/About/Process) — as published on 14 November 2026
4. [FIRST, Vulnerability forecast 2026: The Year Ahead](https://www.first.org/blog/20260211-vulnerability-forecast-2026) — 11 February 2026
5. [FIRST, FIRST Mid-Year Vulnerability Forecast Confirms Historic Surge, Projects ~66,000 CVEs in 2026](https://www.first.org/newsroom/releases/20260615) — 15 June 2026
6. [The Register, This year’s bug count just passed 100K](https://www.theregister.com/security/2026/11/13/this-years-bug-count-just-passed-100k/5309882) — 13 November 2026

**Disclosure.** TechBag is a software reseller: it earns when companies buy through it, including from vendors named here. The analysis is TechBag’s own; no vendor paid for or saw this piece before publication. Facts are labelled reported, TechBag count or our view.

**Read this next:** [Six days from patch to exploited: PHP, Node.js, Oracle and the order to fix them](https://www.thetechbag.com/blog/one-week-php-node-java-oracle-critical-patches) — What happens once a flaw is public: every critical fix of 20 to 29 October across PHP, Node.js, Oracle and Java, put in patch order, and six days to exploited.

Go deeper on TechBag

- [Microsoft’s patch count rose from 71 to 1,475 a month; exploited flaws stayed flat](https://www.thetechbag.com/blog/microsoft-patch-count-71-to-1475-exploited-flat) — one CNA’s share of the rise, and the exploited flaws that did not follow
- [Vulnerability management guide](https://www.thetechbag.com/browse/security/vulnerability-management) — tools that rank flaws by exploitation and exposure, not by count
- [Memory-corruption bugs fell from 31% to 14% of exploited flaws](https://www.thetechbag.com/blog/memory-corruption-share-exploited-flaws-falls) — which kinds of flaws reach CISA’s exploited list