To view older blog posts, please visit the archives section.

What is this?

If you’ve known me for a while, you know that I love numbers. And gosh I love weather forecasting. Isn’t it absolutely amazing that we’re able to predict weather? This, and the current state of CVE publishing, got me thinking over the last couple of weeks. What if we could do a vulnerability forecast? Why, you might ask? Just because I’m a curious nerd of course!

This is the first of a forecasting series. I’ll try to publish one forecast before the 10th of each month, then add an update once the month is over to see how accurate, or inaccurate, the forecast turned out to be. This should be fun!

Data analysis method

For this first one, I’ve decided to base my analysis on the first 7 days of each month over the last 12 months. I will then calculate, for each month, the percentage of the monthly total represented by the first 7 days and extract the following data points:

• First 7 days percentage mean for the last 12 months;

• First 7 days percentage median for the last 12 months;

• Standard deviation within the first 7 days percentage for the last 12 months;

From there, I will use the available data to calculate the following:

• Projection for the current month based on the mean;

• Projection for the current month based on the median;

• Projection for the current month based on a linear regression;

• Projection range based on the historical mean first-seven-day share ±1 standard deviation.

And that’s it! Nothing more complicated than this for now. 

The data

The following graphic shows the relationship between the first 7 days of each month and the total monthly CVE publication volume between August 2025 and July 2026.

The following graphic shows the percentage of monthly CVE publication that was made within the first 7 days of each month between August 2025 and July 2026.

From this data, we can extract the following:

• First 7 days percentage mean for the last 12 months = 20.88%;

• First 7 days percentage median for the last 12 months = 21.29%;

• Standard deviation within the first 7 days percentage for the last 12 months = 4.27 percentage points.

And from this, taking into account the 1906 CVEs published in the first 7 days of August 2026, I predict the following for the month of August 2026:

• Based on the mean, there should be 9125 CVEs published;

• Based on the median, there should be 8953 CVEs published;

• Based on linear regression, there should be 9201 CVEs published;

This means that, if August follows a publication pattern reasonably close to the short historical period used here, we should see a modest decrease in CVE publication volume compared with July. However, as July demonstrated, there is still plenty of room for August to become another record-breaking month. Using the historical mean first-seven-day share ±1 standard deviation produces a projection range of approximately 7575 to 11472 CVEs.

Interestingly, August's first seven days saw more CVEs than July's, yet all three central models still project a lower monthly total. Historical variation remains wide enough, however, that a new record is still entirely possible. 

As with any forecast, the future will tell us how well this simple model performs.

End of month results

August 2026 has not come to an end yet! Come back later to see the result!