Digest

What changed in the corpus, period by period: new CVEs ranked by depth score, KEV additions, EPSS risers, records that moved, and the vendors that had the week. Every period has a permanent URL.

Weekly

Week 39, 2026 (21–27 Sep) · in progress157 new · 14 critical · 0 KEV
A quiet week: only 157 new CVEs against a recent average of about 1,903 so far. Of those, 14 critical and 61 high. 19 arrived with exploitation evidence or public exploit code already attached. Red Hat was the most-affected vendor with 12.
Week 38, 2026 (14–20 Sep)4908 new · 508 critical · 7 KEV
A heavy week: 4,908 new CVEs, well above the recent average of about 1,398. Severity skewed high: 508 critical and 2,064 high, 52% of the total. 625 arrived with exploitation evidence or public exploit code already attached. CISA added 7 CVEs to the Known Exploited Vulnerabilities catalog. 2 CVEs saw exploit probability (EPSS) jump by ten points or more. Linux was the most-affected vendor with 878.
Week 37, 2026 (7–13 Sep)3879 new · 308 critical · 14 KEV
A heavy week: 3,879 new CVEs, well above the recent average of about 1,058. Severity skewed high: 308 critical and 1,751 high, 53% of the total. 464 arrived with exploitation evidence or public exploit code already attached. CISA added 14 CVEs to the Known Exploited Vulnerabilities catalog. Microsoft was the most-affected vendor with 972.
Week 36, 2026 (31 Aug – 6 Sep)1248 new · 145 critical · 8 KEV
A busier-than-usual week with 1,248 new CVEs (recent average about 985). Of those, 145 critical and 470 high. 205 arrived with exploitation evidence or public exploit code already attached. CISA added 8 CVEs to the Known Exploited Vulnerabilities catalog. 3 CVEs saw exploit probability (EPSS) jump by ten points or more. ibm was the most-affected vendor with 48.
Week 35, 2026 (24–30 Aug)958 new · 102 critical · 9 KEV
958 new CVEs this week, in line with the recent average. Of those, 102 critical and 345 high. 41 arrived with exploitation evidence or public exploit code already attached. CISA added 9 CVEs to the Known Exploited Vulnerabilities catalog. 5 CVEs saw exploit probability (EPSS) jump by ten points or more. google was the most-affected vendor with 63.
Week 34, 2026 (17–23 Aug)1319 new · 188 critical · 7 KEV
A busier-than-usual week with 1,319 new CVEs (recent average about 843). Severity skewed high: 188 critical and 483 high, 51% of the total. 66 arrived with exploitation evidence or public exploit code already attached. CISA added 7 CVEs to the Known Exploited Vulnerabilities catalog. 2 CVEs saw exploit probability (EPSS) jump by ten points or more. oracle was the most-affected vendor with 68.
Week 33, 2026 (10–16 Aug)1432 new · 140 critical · 2 KEV
A heavy week: 1,432 new CVEs, well above the recent average of about 759. Severity skewed high: 140 critical and 656 high, 56% of the total. 40 arrived with exploitation evidence or public exploit code already attached. CISA added 2 CVEs to the Known Exploited Vulnerabilities catalog. One CVE saw exploit probability (EPSS) jump by ten points or more. Microsoft was the most-affected vendor with 407.
Week 32, 2026 (3–9 Aug)870 new · 123 critical · 5 KEV
A busier-than-usual week with 870 new CVEs (recent average about 700). Of those, 123 critical and 299 high. 45 arrived with exploitation evidence or public exploit code already attached. CISA added 5 CVEs to the Known Exploited Vulnerabilities catalog. 4 CVEs saw exploit probability (EPSS) jump by ten points or more. Red Hat was the most-affected vendor with 36.
Week 31, 2026 (27 Jul – 2 Aug)611 new · 61 critical · 2 KEV
611 new CVEs this week, in line with the recent average. Of those, 61 critical and 215 high. 34 arrived with exploitation evidence or public exploit code already attached. CISA added 2 CVEs to the Known Exploited Vulnerabilities catalog. 3 CVEs saw exploit probability (EPSS) jump by ten points or more. google was the most-affected vendor with 27.
Week 30, 2026 (20–26 Jul)867 new · 100 critical · 5 KEV
A busier-than-usual week with 867 new CVEs (recent average about 568). Severity skewed high: 100 critical and 374 high, 55% of the total. 23 arrived with exploitation evidence or public exploit code already attached. CISA added 5 CVEs to the Known Exploited Vulnerabilities catalog. 10 CVEs saw exploit probability (EPSS) jump by ten points or more. oracle was the most-affected vendor with 154.
Week 29, 2026 (13–19 Jul)1159 new · 72 critical · 7 KEV
A heavy week: 1,159 new CVEs, well above the recent average of about 450. Severity skewed high: 72 critical and 598 high, 58% of the total. 44 arrived with exploitation evidence or public exploit code already attached. CISA added 7 CVEs to the Known Exploited Vulnerabilities catalog. 3 CVEs saw exploit probability (EPSS) jump by ten points or more. Microsoft was the most-affected vendor with 576.
Week 28, 2026 (6–12 Jul)660 new · 48 critical · 4 KEV
A heavy week: 660 new CVEs, well above the recent average of about 407. Of those, 48 critical and 201 high. 29 arrived with exploitation evidence or public exploit code already attached. CISA added 4 CVEs to the Known Exploited Vulnerabilities catalog. One CVE saw exploit probability (EPSS) jump by ten points or more. Red Hat was the most-affected vendor with 20.
Week 27, 2026 (29 Jun – 5 Jul)574 new · 49 critical · 1 KEV
A busier-than-usual week with 574 new CVEs (recent average about 370). Severity skewed high: 49 critical and 239 high, 50% of the total. 47 arrived with exploitation evidence or public exploit code already attached. CISA added one CVE to the Known Exploited Vulnerabilities catalog. Microsoft was the most-affected vendor with 50.

Daily