CVE Statistics by Year: 48,152 Vulnerabilities in 2025, and 2026 Is Running Twice as Fast

The short version

48,152 CVEs were published in 2025, 20.5% more than the 39,953 of 2024 and 7.4 times the 6,494 of 2015. That is roughly one new CVE every eleven minutes, around the clock.

2026 is running at more than double that pace. Between 1 January and 15 October 2026, 81,062 CVEs were published. Over exactly the same window of 2025 there were 37,567. That is an increase of 116%, and the year still has two and a half months to go.

The full year-by-year data, with charts, severity mix and issuer breakdown, is on our CVE statistics page. This article walks through what the numbers say.

CVEs published per year, the last ten years

Three phases stand out. Until 2016 the program published a few thousand CVEs a year and the number moved sideways. 2017 more than doubled it in one step, from 6,449 to 14,642, and the curve has climbed every year since. Then 2024 added 11,137 CVEs in a single year, the largest absolute jump on record, and 2025 added another 8,199 on top.

Comparing 2026 fairly

A year-to-date total set beside full years always looks small, so the only honest comparison is the same calendar window. Here is 1 January to 15 October for each of the last seven years:

The 2026 figure is not one bulk upload. Monthly volume has climbed steadily through the year: 4,302 in January, 6,936 in May, 9,770 in July and 14,939 in September, the busiest month ever recorded. The first half of October alone added 8,255.

Where the growth comes from

The short answer is that more organisations now issue CVEs, and a handful of them issue a great many. Seven issuers that published no CVEs at all in 2017 (the Linux kernel, the WordPress security firms Wordfence, Patchstack and WPScan, VulDB, GitHub's advisory database and VulnCheck) produced 55% of all CVEs in 2025, and about 87% of the increase between 2020 and 2025. We break that down in why CVE counts keep climbing.

How exploited are they?

Volume is not risk. CISA's Known Exploited Vulnerabilities catalog added 245 CVEs in 2025, against 48,152 published that year: about one in two hundred. The catalog as a whole lists 1,746 CVEs with evidence of exploitation in the wild. Our guide to the KEV catalog covers how to use it.

How these numbers were counted

• Source: the NVD CVE API, which mirrors every published CVE record, queried on 15 October 2026. Counts are exact totals for each month, not samples.
• Year means publication year. A CVE counts in the year its record went public, not the year in its ID. IDs are often reserved months earlier.
• Rejected CVEs are excluded, and reserved IDs that were never published are not CVEs at all.
• Small drift is normal. Records are occasionally rejected or backfilled later, so a recount can differ by a handful.

The same snapshot drives every chart and table on the CVE statistics page, which also covers severity by year and the issuer breakdown in full.