Latest month report · in progress
June 2026
in numbers
Where the vulnerability world moved this month. Headline volume, criticals, KEV velocity and a 12-month sparkline.
Open full report →Projected total
2,703
-30.2% YoY · proj
Critical
38
4.7% of total · so far
KEV added
4
CISA known exploited
vs last month
-62.7%
projected MoM
Last 12 months · volume
projected — month still in progress
Data as of Jun 8, 2026, 05:00 UTCSnapshot v1 Sources NVD+CISA KEV+EPSS+Nuclei templates Methodology →
from Jul 23avg ≈ 18.0 / mo
Cover story · KEV velocity
Active exploitation,
month by month.
CISA-confirmed 648 CVEs moved into active exploitation across the visible window.
The peak month was Mar 25 with 32 additions.
Last 3 months are -21% vs the prior 3.
Previous report
What May 2026 is remembered for
Highlights from the last completed month. Click any tile to open the full report.
Top vendor
linux
1,034 CVEs
linux (1034) · linux kernel (573)
Biggest breakout
google
×8.8 vs 12-mo median
381 CVEs this period
Top weakness
XSS
596 CVEs · CWE-79
KEV velocity
21 new
2 ransomware-linked
Detection speed
9.4 days
median to Nuclei template
45% within 7 days
First in top-100
concrete cms
#18 · 44 CVEs
never in top-100 in prior 24 months
First-time on leaderboard
New names in May 2026
Never seen in top-100 for the prior 24 months. Often soft targets — security maturity hasn't caught up to attention.
Hot quarter
Biggest growth in 3 months
Apr 26 → Jun 26 vs prior 3
linux
×2.2
1,446 recentvs 644 prior+802
google
×2.3
589 recentvs 251 prior+338
apache software foundation
×3.0
204 recentvs 67 prior+137
×3.0
apache
×3.1
194 recentvs 62 prior+132
×3.1
totolink
×3.1
144 recentvs 47 prior+97
×3.1
oracle
×2.1
132 recentvs 64 prior+68
oracle corporation
×2.0
134 recentvs 66 prior+68
microsoft
×1.2
356 recentvs 290 prior+66
open-webui
×59.0
59 recentvs 0 prior+59
×59.0
openwebui
×59.0
59 recentvs 0 prior+59
×59.0
mervinpraison
×53.0
53 recentvs 0 prior+53
×53.0
praison
×53.0
53 recentvs 0 prior+53
×53.0
Vendor leaderboard
Most CVEs · last 12 months
- 5,224 CVE77 crit2 KEVpeak #1KEV 2PoC 14
- 2,959 CVE96 crit6 KEV28 Nucleipeak #1KEV 6Nuclei 28PoC 131
- 3npm1,724 CVE143 crit4 KEV30 Nucleipeak #1KEV 4Nuclei 30PoC 152
- 1,348 CVE40 crit8 KEV3 Nucleipeak #2KEV 8Nuclei 3PoC 82
- 1,328 CVE12 crit2 Nucleipeak #3Nuclei 2PoC 43
- 1,325 CVE87 crit25 KEV4 Nucleipeak #3KEV 25Nuclei 4PoC 21
- 1,286 CVE57 crit12 KEVpeak #1KEV 12PoC 14
- 1,180 CVE41 crit8 KEV8 Nucleipeak #2KEV 8Nuclei 8PoC 110
- 1,178 CVE43 crit27 KEV4 Nucleipeak #5KEV 27Nuclei 4PoC 25
- 10go847 CVE89 crit1 KEV13 Nucleipeak #3KEV 1Nuclei 13PoC 78
- 833 CVE9 critpeak #4PoC 19
- 12pypi785 CVE72 crit1 KEV13 Nucleipeak #4KEV 1Nuclei 13PoC 95
- 13ао «ивк»783 CVE43 crit3 KEV1 Nucleipeak #6KEV 3Nuclei 1PoC 51
- 680 CVE1 critpeak #10PoC 490
- 15apple656 CVE38 crit10 KEVpeak #4KEV 10PoC 3
- 656 CVE7 crit3 KEVpeak #7KEV 3PoC 40
- 17adobe629 CVE21 crit3 KEV4 Nucleipeak #7KEV 3Nuclei 4PoC 1
- 594 CVE40 crit2 KEV11 Nucleipeak #5KEV 2Nuclei 11PoC 131
- 19tenda579 CVE47 critpeak #11PoC 292
- 552 CVE18 crit2 KEV3 Nucleipeak #6KEV 2Nuclei 3PoC 1
| # | Vendor | CVEs | Crit | KEV | Nuclei | Peak | Signals | |
|---|---|---|---|---|---|---|---|---|
| 1 | linux | 5,224 | 77 | 2 | · | #1 | KEV 2PoC 14 | |
| 2 | сообщество свободного программного обеспечения | 2,959 | 96 | 6 | 28 | #1 | KEV 6Nuclei 28PoC 131 | |
| 3 | npm | 1,724 | 143 | 4 | 30 | #1 | KEV 4Nuclei 30PoC 152 | |
| 4 | ооо «русбитех-астра» | 1,348 | 40 | 8 | 3 | #2 | KEV 8Nuclei 3PoC 82 | |
| 5 | red hat inc. | 1,328 | 12 | · | 2 | #3 | Nuclei 2PoC 43 | |
| 6 | microsoft | 1,325 | 87 | 25 | 4 | #3 | KEV 25Nuclei 4PoC 21 | |
| 7 | 1,286 | 57 | 12 | · | #1 | KEV 12PoC 14 | ||
| 8 | ооо «ред софт» | 1,180 | 41 | 8 | 8 | #2 | KEV 8Nuclei 8PoC 110 | |
| 9 | microsoft corp | 1,178 | 43 | 27 | 4 | #5 | KEV 27Nuclei 4PoC 25 | |
| 10 | go | 847 | 89 | 1 | 13 | #3 | KEV 1Nuclei 13PoC 78 | |
| 11 | canonical ltd. | 833 | 9 | · | · | #4 | PoC 19 | |
| 12 | pypi | 785 | 72 | 1 | 13 | #4 | KEV 1Nuclei 13PoC 95 | |
| 13 | ао «ивк» | 783 | 43 | 3 | 1 | #6 | KEV 3Nuclei 1PoC 51 | |
| 14 | code-projects | 680 | 1 | · | · | #10 | PoC 490 | |
| 15 | apple | 656 | 38 | 10 | · | #4 | KEV 10PoC 3 | |
| 16 | ао «сбертех» | 656 | 7 | 3 | · | #7 | KEV 3PoC 40 | |
| 17 | adobe | 629 | 21 | 3 | 4 | #7 | KEV 3Nuclei 4PoC 1 | |
| 18 | packagist | 594 | 40 | 2 | 11 | #5 | KEV 2Nuclei 11PoC 131 | |
| 19 | tenda | 579 | 47 | · | · | #11 | PoC 292 | |
| 20 | adobe systems inc. | 552 | 18 | 2 | 3 | #6 | KEV 2Nuclei 3PoC 1 |
Earlier reports
April 2026
6,439
— YoY
607 critical31 KEV
March 2026
6,821
— YoY
684 critical26 KEV
February 2026
4,931
— YoY
495 critical28 KEV
January 2026
5,245
— YoY
437 critical17 KEV
December 2025
5,771
— YoY
398 critical20 KEV
November 2025
3,194
— YoY
269 critical11 KEV
October 2025
4,544
— YoY
288 critical31 KEV
September 2025
4,664
— YoY
278 critical16 KEV
August 2025
3,871
+28.0% YoY
343 critical15 KEV
July 2025
4,086
+25.8% YoY
368 critical20 KEV
June 2025
3,875
+16.3% YoY
293 critical20 KEV
May 2025
4,361
-19.5% YoY
376 critical24 KEV
April 2025
4,282
+13.6% YoY
330 critical15 KEV
March 2025
4,251
+26.0% YoY
420 critical32 KEV
February 2025
3,940
+32.1% YoY
253 critical27 KEV
January 2025
4,463
+65.4% YoY
358 critical14 KEV
December 2024
3,514
+26.9% YoY
316 critical16 KEV
November 2024
4,154
+62.3% YoY
348 critical22 KEV
October 2024
3,667
+32.7% YoY
364 critical17 KEV
September 2024
2,594
-9.4% YoY
241 critical25 KEV
August 2024
3,024
— YoY
331 critical19 KEV
July 2024
3,248
— YoY
275 critical14 KEV