How many CVEs are published every day?

The rate is the part that breaks vulnerability programmes. A process designed around a hundred-odd disclosures a day does not survive two hundred and fifty, and the volume is still climbing.

Almost none of that volume is urgent for any given organisation. Most CVEs affect software you do not run, in versions you never deployed, in components an attacker cannot reach. The work is not reading them — it is filtering them.

This is why triage has to be automated on exploitation signals rather than on severity. A human queue that grows by 250 items a day cannot be worked down by adding people to it.