Latest month report · in progress
August 2026
in numbers
Where the vulnerability world moved this month. Headline volume, criticals, KEV velocity and a 12-month sparkline.
Open full report →Projected total
5,531
+42.9% YoY · proj
Critical
269
12.6% of total · so far
KEV added
6
CISA known exploited
vs last month
-46.0%
projected MoM
Last 12 months · volume
projected — month still in progress
Data as of Aug 3, 2026, 05:00 UTCSnapshot v1 Sources CVEList V5+NVD+GHSA+CSAF+FSTEC BDU+CISA KEV+EPSS+Nuclei templates Methodology →
from Sep 23avg ≈ 18.8 / mo
Cover story · KEV velocity
Active exploitation,
month by month.
CISA-confirmed 675 CVEs moved into active exploitation across the visible window.
The peak month was Mar 25 with 32 additions.
Last 3 months are -29% vs the prior 3.
Previous report
What July 2026 is remembered for
Highlights from the last completed month. Click any tile to open the full report.
Top vendor
oracle
1,108 CVEs
oracle coherence (98) · coherence (93) · webcenter content (54)
×13.6
Biggest breakout
oracle
×13.6 vs 12-mo median
1,108 CVEs this period
Top weakness
CWE-284
913 CVEs · CWE-284
KEV velocity
26 new
added to CISA KEV
Detection speed
7.2 days
median to Nuclei template
46% within 7 days
First in top-100
surrealdb
#13 · 57 CVEs
never in top-100 in prior 24 months
First-time on leaderboard
New names in July 2026
Never seen in top-100 for the prior 24 months. Often soft targets — security maturity hasn't caught up to attention.
Detection gap
KEV pressure, no Nuclei coverage
July 2026 · vendors with active exploitation listed by CISA but no public detection template.
- KEV 4microsoft664 CVE
Hot quarter
Biggest growth in 3 months
Jun 26 → Aug 26 vs prior 3
oracle
×10.1
1,351 recentvs 134 prior+1,217
×10.1
google
×2.3
1,634 recentvs 705 prior+929
microsoft
×1.6
962 recentvs 607 prior+355
apache software foundation
×1.9
362 recentvs 193 prior+169
apache
×1.5
285 recentvs 184 prior+101
capgo
×83.0
83 recentvs 0 prior+83
×83.0
redhat
×1.3
340 recentvs 257 prior+83
adobe
×1.4
260 recentvs 191 prior+69
zephyrproject
×58.0
58 recentvs 0 prior+58
×58.0
surrealdb
×57.0
57 recentvs 0 prior+57
×57.0
symfony
×56.0
56 recentvs 0 prior+56
×56.0
hclsoftware
×51.0
51 recentvs 0 prior+51
×51.0
Vendor leaderboard
Most CVEs · last 12 months
- 5,995 CVE208 crit1 KEVpeak #1KEV 1PoC 6
- 2,832 CVE246 crit14 KEVpeak #1KEV 14PoC 14
- 2,461 CVE97 crit7 KEV30 Nucleipeak #1KEV 7Nuclei 30PoC 79
- 2,255 CVE150 crit31 KEV1 Nucleipeak #3KEV 31Nuclei 1PoC 17
- 5npm1,869 CVE130 crit3 KEV23 Nucleipeak #1KEV 3Nuclei 23PoC 133
- 1,653 CVE32 crit1 KEV4 Nucleipeak #3KEV 1Nuclei 4PoC 32
- 1,629 CVE354 crit4 KEV4 Nucleipeak #1KEV 4Nuclei 4PoC 4
- 892 CVE29 crit5 KEV3 Nucleipeak #2KEV 5Nuclei 3PoC 52
- 9go812 CVE76 crit1 KEV12 Nucleipeak #3KEV 1Nuclei 12PoC 71
- 10pypi802 CVE58 crit1 KEV12 Nucleipeak #4KEV 1Nuclei 12PoC 68
- 11apple783 CVE68 crit6 KEVpeak #4KEV 6PoC 2
- 12adobe746 CVE51 crit2 KEV3 Nucleipeak #5KEV 2Nuclei 3
- 736 CVE20 crit1 KEVpeak #4KEV 1PoC 13
- 675 CVE129 crit1 KEV5 Nucleipeak #1KEV 1Nuclei 5PoC 6
- 15ibm629 CVE56 crit1 Nucleipeak #8Nuclei 1
- 597 CVE31 crit1 KEV6 Nucleipeak #5KEV 1Nuclei 6PoC 107
- 17openclaw588 CVE30 critpeak #2PoC 2
- 18apache580 CVE110 crit1 KEV5 Nucleipeak #2KEV 1Nuclei 5PoC 6
- 575 CVE30 crit5 KEV6 Nucleipeak #3KEV 5Nuclei 6PoC 71
- 20ао «ивк»559 CVE35 crit1 KEV1 Nucleipeak #5KEV 1Nuclei 1PoC 33
| # | Vendor | CVEs | Crit | KEV | Nuclei | Peak | Signals | |
|---|---|---|---|---|---|---|---|---|
| 1 | linux | 5,995 | 208 | 1 | · | #1 | KEV 1PoC 6 | |
| 2 | 2,832 | 246 | 14 | · | #1 | KEV 14PoC 14 | ||
| 3 | сообщество свободного программного обеспечения | 2,461 | 97 | 7 | 30 | #1 | KEV 7Nuclei 30PoC 79 | |
| 4 | microsoft | 2,255 | 150 | 31 | 1 | #3 | KEV 31Nuclei 1PoC 17 | |
| 5 | npm | 1,869 | 130 | 3 | 23 | #1 | KEV 3Nuclei 23PoC 133 | |
| 6 | redhat | 1,653 | 32 | 1 | 4 | #3 | KEV 1Nuclei 4PoC 32 | |
| 7 | oracle | 1,629 | 354 | 4 | 4 | #1 | KEV 4Nuclei 4PoC 4 | |
| 8 | ооо «русбитех-астра» | 892 | 29 | 5 | 3 | #2 | KEV 5Nuclei 3PoC 52 | |
| 9 | go | 812 | 76 | 1 | 12 | #3 | KEV 1Nuclei 12PoC 71 | |
| 10 | pypi | 802 | 58 | 1 | 12 | #4 | KEV 1Nuclei 12PoC 68 | |
| 11 | apple | 783 | 68 | 6 | · | #4 | KEV 6PoC 2 | |
| 12 | adobe | 746 | 51 | 2 | 3 | #5 | KEV 2Nuclei 3 | |
| 13 | canonical | 736 | 20 | 1 | · | #4 | KEV 1PoC 13 | |
| 14 | apache software foundation | 675 | 129 | 1 | 5 | #1 | KEV 1Nuclei 5PoC 6 | |
| 15 | ibm | 629 | 56 | · | 1 | #8 | Nuclei 1 | |
| 16 | packagist | 597 | 31 | 1 | 6 | #5 | KEV 1Nuclei 6PoC 107 | |
| 17 | openclaw | 588 | 30 | · | · | #2 | PoC 2 | |
| 18 | apache | 580 | 110 | 1 | 5 | #2 | KEV 1Nuclei 5PoC 6 | |
| 19 | ооо «ред софт» | 575 | 30 | 5 | 6 | #3 | KEV 5Nuclei 6PoC 71 | |
| 20 | ао «ивк» | 559 | 35 | 1 | 1 | #5 | KEV 1Nuclei 1PoC 33 |
Earlier reports
June 2026
8,314
+114.6% YoY
914 critical23 KEV
May 2026
7,365
+68.9% YoY
642 critical21 KEV
April 2026
6,440
— YoY
607 critical31 KEV
March 2026
6,821
— YoY
685 critical26 KEV
February 2026
4,931
— YoY
495 critical28 KEV
January 2026
5,244
— YoY
437 critical17 KEV
December 2025
5,771
— YoY
396 critical20 KEV
November 2025
3,194
— YoY
269 critical11 KEV
October 2025
4,544
— YoY
288 critical31 KEV
September 2025
4,664
— YoY
278 critical16 KEV
August 2025
3,871
+28.0% YoY
343 critical15 KEV
July 2025
4,086
+25.8% YoY
368 critical20 KEV
June 2025
3,875
+16.3% YoY
293 critical20 KEV
May 2025
4,361
-19.5% YoY
376 critical24 KEV
April 2025
4,282
+13.6% YoY
330 critical15 KEV
March 2025
4,251
+26.0% YoY
420 critical32 KEV
February 2025
3,940
+32.1% YoY
253 critical27 KEV
January 2025
4,463
+65.4% YoY
358 critical14 KEV
December 2024
3,514
+26.9% YoY
316 critical16 KEV
November 2024
4,154
+62.3% YoY
348 critical22 KEV
October 2024
3,667
+32.7% YoY
364 critical17 KEV
September 2024
2,594
-9.4% YoY
241 critical25 KEV