CVE trendsSeptember 2026
Monthly vulnerability volume, critical severity and known-exploitation activity across every published CVE, not just the ones written up here.
Full September 2026 report →Total CVEs
7,900 ±30.1%
Critical
74
High
323
KEV added
7
Public exploit
5
Month over month
-25.5%
Published per month, last 12
Hover or use ←/→ for a month’s figures
KEV additions
Entries added per month
687 CVEs entered the CISA KEV catalog across these 36 months — peak Mar 25 at 32, average 19.1 a month.
month CISA added the entry, not the CVE's publication month
Last complete month
August 2026
Top vendor
linux
Biggest breakout
×12.2
Top weakness
CWE-284
Added to CISA KEV
30
Break down by
Quarter over quarter
Largest increases over three months
#1 momentum
elastic
×11.2
Prior quarter
10
Current quarter
112
#2 momentum
splunk
×9.2
Prior quarter
12
Current quarter
110
#3 momentum
getgrav
×7.3
Prior quarter
14
Current quarter
102
#4 momentum
oracle
×5.3
Prior quarter
376
Current quarter
1,997
#5 momentum
drupal
×5.1
Prior quarter
14
Current quarter
72
#6 momentum
dokploy
×3.4
Prior quarter
11
Current quarter
37
#7 momentum
zephyrproject
×3.3
Prior quarter
25
Current quarter
82
#8 momentum
progress software
×3.1
Prior quarter
12
Current quarter
37
#9 momentum
coollabsio
×2.9
Prior quarter
12
Current quarter
35
#10 momentum
ibm
×2.8
Prior quarter
172
Current quarter
486
| # | Vendor | ||||||||
|---|---|---|---|---|---|---|---|---|---|
| 1 | linux | 6,709 | 458 | 2 | 0.03% | 69 | #1* | 11 | |
| 2 | 2,565 | 260 | 10 | 0.39% | 59 | #1* | 11 | ||
| 3 | oracle | 2,517 | 498 | 6 | 0.24% | 34 | 4 | #1* | 7 |
| 4 | microsoft | 2,321 | 163 | 29 | 1.25% | 101 | 3 | #2* | 11 |
| 5 | redhat | 1,888 | 223 | 6 | 0.32% | 159 | 23 | #1* | 12 |
| 6 | ibm | 934 | 106 | 1 | 0.11% | 6 | 1 | #4* | 11 |
| 7 | adobe | 803 | 57 | 2 | 0.25% | 4 | 3 | #2* | 11 |
| 8 | apache | 746 | 128 | 2 | 0.27% | 106 | 9 | #5* | 12 |
| 9 | apple | 738 | 66 | 6 | 0.81% | 29 | #1* | 11 | |
| 10 | openclaw | 581 | 27 | 0.00% | 7 | #2* | 6 | ||
| 11 | siemens | 532 | 37 | 6 | 1.13% | 33 | 1 | #4* | 11 |
| 12 | code projects | 503 | 0.00% | 18 | #4* | 11 | |||
| 13 | mozilla | 481 | 155 | 0.00% | 19 | #3* | 12 | ||
| 14 | sourcecodester | 389 | 0.00% | 7 | #7* | 9 | |||
| 15 | tenda | 365 | 23 | 0.00% | 5 | #9* | 10 | ||
| 16 | dell | 349 | 16 | 1 | 0.29% | 1 | #10* | 11 | |
| 17 | itsourcecode | 296 | 0.00% | #8* | 10 | ||||
| 18 | cisco | 258 | 31 | 12 | 4.65% | 16 | 1 | #12* | 11 |
| 19 | nvidia | 258 | 13 | 0.00% | 3 | 1 | #5* | 11 | |
| 20 | gitlab | 214 | 2 | 0.00% | 4 | 1 | #25* | 11 |
One CVE is counted once per vendor it lists, so a CVE naming several is counted by each of them and the column sums to more than the number of CVEs. Only each month's top 100 are stored, so a vendor outside that depth in a given month contributes nothing for it. KEV counts the CVEs published inside this window that are on the CISA KEV catalog today. It is not the number CISA listed during the window — that is the KEV-additions series. A zero count renders as a dot.
Archive
Every month on record
2024
2025
Dec
+60.1%5,495
Nov
-25.5%3,021
Oct
+19.8%4,274
Sep
+71.8%4,319
Aug
+25.3%3,629
Jul
+21.2%3,774
Jun
+19.5%3,682
May
-20.3%3,980
Apr
+11.9%4,033
Mar
+21.6%4,010
Feb
+31.9%3,673
Jan
+64.9%4,273
2026
Sep
-81.7%790
Aug
+192.4%10,611
Jul
+158.6%9,761
Jun
+116%7,952
May
+74.3%6,937
Apr
+44.2%5,814
Mar
+55.5%6,236
Feb
+25.7%4,616
Jan
+0.7%4,305