Why CVE Counts Keep Climbing: Seven Issuers Behind 87% of the Growth

More issuers, not just more bugs

A CVE is published by a CNA, a CVE Numbering Authority. CNAs are software vendors, security firms, open-source projects and, as the catch-all for everything else, MITRE. For most of the program's history a few large vendors and MITRE issued most CVEs. That changed between 2020 and 2025.

CVEs published per year rose from 18,322 in 2020 to 48,152 in 2025, an increase of 29,830. Seven issuers that published no CVEs at all in 2017 account for 26,067 of that increase, about 87%. In 2020 they produced 3% of all CVEs. In 2025 they produced 55%.

The Linux kernel

In 2024 the kernel project became its own CNA and began assigning CVEs to the bug fixes it backports to stable kernel branches. Many of those fixes would previously have shipped without a CVE. It published 4,287 CVEs in its first year and is past 7,400 in 2026. For anyone running Linux this is the single largest new source of CVEs, and most of them are low-level fixes whose real-world exploitability varies enormously.

WordPress plugins

Wordfence, Patchstack and WPScan specialise in the WordPress ecosystem, where tens of thousands of plugins are maintained by small teams or single developers. Together they issued 11,053 CVEs in 2025, more than the entire CVE program published in 2016. If you do not run WordPress, most of these will not apply to you, which is a useful reminder that a global count says little about your own exposure.

VulDB, GitHub and VulnCheck

VulDB issues CVEs for a long tail of products whose maintainers are not CNAs themselves: 5,899 in 2025. GitHub assigns CVEs to security advisories in open-source repositories and is the fastest grower of 2026, at 11,630 by mid-October against 2,867 in all of 2025. VulnCheck went from 38 CVEs in 2024 to 1,072 in 2025 and 7,976 so far in 2026.

A note on MITRE

NVD records credit CVEs to the source that submitted them. Before the CVE Services platform rolled out in the early 2020s, many issuers' records reached NVD through MITRE and are credited to it, so MITRE's historical numbers overstate what MITRE assigned itself. That is why our statistics page shows MITRE in the table but leaves it out of the issuer chart.

What this means for defenders

The growth is mostly coverage, and coverage is good: an issue with a CVE can be tracked, scanned for and patched deliberately. But it breaks two habits.

1. A global CVE count is not a risk measure. A year with twice the CVEs is not a year with twice the danger to you. What matters is how many touch the products and versions you actually run.
2. Triage by severity alone no longer scales. With roughly half of scored CVEs rated high or critical, severity cannot set your patch order on its own. Exploitation evidence does that, which we cover in prioritising when CVE volume doubles.

All figures come from the NVD CVE API, counted on 15 October 2026 by each issuer's NVD source identifier. The full tables are on the CVE statistics page.