To view older blog posts, please visit the archives section.

One quick post!

While I am usually trying to aim for deeper analysis and thoughts sharing, this post will stay very short. I still decided to write the post as I believe the data is of interest and should be shared.

Where are we from a volume perspective?

As became tradition this year, both September and October have consecutively set new records on the publication side of things. In fact, a look at historical CVE data shows that October (17 052 published CVEs) actually came very close in surpassing the total CVE volume published in 2019 (17 308 published CVEs). Here are the graphics:

What about the KEV?

Well, there is progression there as well... As the graphic below shows, September 2026 has seen a frightening 26 CVEs added to the KEV within 5 days of being published. Extending this to 30 days following publication, the number jumps to 32. September really did see a jump in actively exploited vulnerabilities. While October was calmer in proportion, exploitation within 5 days was still higher than usual. Again, like I said 2 months ago, active exploitation is gaining momentum. However, this momentum is not always proportionate to the publication volume. The graphic below shows KEV addition volume by length of time following a CVE being published. October only shows 5 days after publication since not enough time has passed to show the full month at the time of this publication.

That's it

Well, that's it for today! Let's not lose hope. I still believe that, at some point, these trends will be going down. The real question is when...