Village
Log in
A grid of thousands of small teal squares, one for every 10 vulnerabilities published from January through September 2026. Just 18 squares scattered through the grid are crimson, one for every 10 of those vulnerabilities on CISA’s known-exploited list.

Research

Reported software flaws have doubled. Exploited ones haven’t.

Published software vulnerabilities rose 106% from January through September compared with a year earlier. Those with evidence of real attacks rose 34%.

by Village Team

Software makers and security researchers published 106% more vulnerabilities from January through September than a year earlier, after growth of 7% to 37% a year since 2019. Vulnerabilities with evidence of real attacks rose just 34%.

Every time someone finds a security hole in software, from a Chrome bug to a flaw in an open-source library, it gets a public ID called a CVE. Companies use that list to decide what to patch. But only a sliver of those holes are ever used by attackers, and the U.S. government’s cybersecurity agency, CISA, keeps a running list of those. Comparing the two shows whether software is getting more dangerous or just noisier.

The surge began in March

Monthly counts of new CVE records by severity from January 2022 to September 2026. Volume held near 4,000 a month through 2025, began rising in March 2026 and reached 14,939 in September. Critical and High records grew with the total.

  • The surge is still building. September brought nearly four times the 2025 monthly average.
  • The new flaws skew severe. Critical and High CVEs grew faster than the total, up 161%, and now make up more than half of new records.
  • It isn’t a backlog of old IDs. Only 3% of this year’s CVEs were published under identifiers reserved before 2025, down from 8% last year.

The increase spans open source and major vendors

CVEs published January–September 2026 versus 2025 for the eight issuers with the largest increases. Google Chrome published 27 times as many, VulnCheck 17 times, Oracle 13 times, GitHub 5.5 times, Red Hat 4.3 times, Microsoft 3.2 times, WPScan 2.8 times and the Linux kernel 1.9 times. All other issuers combined grew 35%.

Eight organizations supply three-quarters of the increase, and they’re a mix: GitHub, which files CVEs for flaws in open-source packages; VulnCheck, a vulnerability-intelligence firm; and vendors reporting flaws in their own products, from Oracle and Google Chrome to Microsoft. Because the rise spans open-source registries, independent researchers and vendors alike, it isn’t one organization changing how it files. Even the rest of the field grew 35%.

Exploitation is rising more slowly

Three-month averages of new CVEs and of additions to CISA’s known-exploited catalog from January 2024 to September 2026, each indexed to its 2025 monthly average. Both tracked near 100 through 2025. In 2026 published CVEs rose to 307, while exploited additions rose to 163.

  • Confirmed exploitation is growing at a third of the pace. From January through September, CISA added 34% more flaws to its exploited catalog than a year earlier, while new CVEs rose 106%.
  • A smaller share of new flaws gets exploited. Of CVEs published January through May, 0.27% reached CISA’s catalog within 120 days, down from 0.40% a year earlier.
  • The ones that matter are confirmed faster. The median time from publication to listing fell to 15 days from 22.

How we built this

This study draws on a Village monitor that our agent built from NIST’s National Vulnerability Database and CISA’s Known Exploited Vulnerabilities catalog. It refreshes both every day, excludes rejected records and links each exploited flaw to its CVE record.

Counts reflect when CVEs were published and who filed them, not when flaws were found. Severity uses each record’s most recent score. CISA lists flaws once it confirms exploitation, sometimes years after an attack began, so catalog additions track confirmations rather than attacks; the exploited-share figure above follows only CVEs published January through May. Absence from the catalog doesn’t prove a flaw is safe, and the newest CVEs have had less time to be added.

Build your own signals on this data. Define what matters to your research and get alerted when it moves.

Proprietary signals from any source. Build pipelines with Village’s agent that gather data from the websites, APIs and documents your research depends on.

Next Up