CVE trendsSeptember 2026
Monthly vulnerability volume, critical severity and known-exploitation activity across every published CVE, not just the ones written up here.
Full September 2026 report →Total CVEs
12,439 ±9.2%
Critical
532
High
2,505
KEV added
22
Public exploit
86
Month over month
+17%
Published per month, last 12
Hover or use ←/→ for a month’s figures
KEV additions
Entries added per month
703 CVEs entered the CISA KEV catalog across these 36 months — peak Mar 25 at 32, average 19.5 a month.
month CISA added the entry, not the CVE's publication month
Last complete month
August 2026
Top vendor
linux
Biggest breakout
×12.2
Top weakness
CWE-284
Added to CISA KEV
31
Break down by
Quarter over quarter
Largest increases over three months
#1 momentum
elastic
×11.9
Prior quarter
10
Current quarter
119
#2 momentum
splunk
×9.2
Prior quarter
12
Current quarter
110
#3 momentum
getgrav
×8.2
Prior quarter
14
Current quarter
115
#4 momentum
oracle
×5.3
Prior quarter
376
Current quarter
1,997
#5 momentum
drupal
×5.1
Prior quarter
14
Current quarter
72
#6 momentum
mongodb
×3.9
Prior quarter
28
Current quarter
109
#7 momentum
microsoft
×3.7
Prior quarter
575
Current quarter
2,118
#8 momentum
ibm
×3.5
Prior quarter
172
Current quarter
607
#9 momentum
dokploy
×3.4
Prior quarter
11
Current quarter
37
#10 momentum
zephyrproject
×3.3
Prior quarter
25
Current quarter
82
| # | Vendor | ||||||||
|---|---|---|---|---|---|---|---|---|---|
| 1 | linux | 7,342 | 531 | 2 | 0.03% | 74 | #1* | 12 | |
| 2 | microsoft | 3,298 | 207 | 31 | 0.94% | 104 | 3 | #1* | 12 |
| 3 | 2,886 | 300 | 12 | 0.42% | 63 | #1* | 11 | ||
| 4 | oracle | 2,517 | 498 | 6 | 0.24% | 34 | 4 | #1* | 7 |
| 5 | redhat | 1,943 | 225 | 6 | 0.31% | 170 | 23 | #1* | 12 |
| 6 | ibm | 1,055 | 116 | 1 | 0.09% | 8 | 1 | #4* | 12 |
| 7 | adobe | 973 | 64 | 3 | 0.31% | 5 | 3 | #2* | 12 |
| 8 | apache | 777 | 141 | 2 | 0.26% | 108 | 9 | #5* | 12 |
| 9 | apple | 738 | 66 | 6 | 0.81% | 33 | #1* | 11 | |
| 10 | siemens | 624 | 46 | 7 | 1.12% | 39 | 2 | #4* | 12 |
| 11 | openclaw | 581 | 27 | 0.00% | 8 | #2* | 6 | ||
| 12 | code projects | 522 | 0.00% | 18 | #4* | 12 | |||
| 13 | mozilla | 482 | 165 | 0.00% | 20 | #6* | 12 | ||
| 14 | dell | 470 | 23 | 1 | 0.21% | 1 | #5* | 11 | |
| 15 | sourcecodester | 422 | 0.00% | 7 | #7* | 10 | |||
| 16 | tenda | 379 | 31 | 0.00% | 5 | #9* | 11 | ||
| 17 | itsourcecode | 324 | 0.00% | #8* | 11 | ||||
| 18 | nvidia | 260 | 13 | 0.00% | 4 | 1 | #11* | 11 | |
| 19 | cisco | 259 | 31 | 13 | 5.02% | 17 | 1 | #12* | 11 |
| 20 | wwbn | 253 | 22 | 0.00% | 2 | 1 | #8* | 6 |
One CVE is counted once per vendor it lists, so a CVE naming several is counted by each of them and the column sums to more than the number of CVEs. Only each month's top 100 are stored, so a vendor outside that depth in a given month contributes nothing for it. KEV counts the CVEs published inside this window that are on the CISA KEV catalog today. It is not the number CISA listed during the window — that is the KEV-additions series. A zero count renders as a dot.
Archive
Every month on record
2024
2025
Dec
+60.1%5,495
Nov
-25.5%3,021
Oct
+19.8%4,274
Sep
+71.8%4,319
Aug
+25.3%3,629
Jul
+21.2%3,774
Jun
+19.5%3,682
May
-20.3%3,980
Apr
+11.9%4,033
Mar
+21.6%4,010
Feb
+31.9%3,673
Jan
+64.9%4,273
2026
Sep
+34.4%5,805
Aug
+193%10,633
Jul
+158.6%9,761
Jun
+116%7,952
May
+74.3%6,937
Apr
+44.2%5,814
Mar
+55.5%6,236
Feb
+25.7%4,616
Jan
+0.7%4,305