Jerry Gamblin
@jgamblin
Bringing clarity to vulnerability intelligence through open-source tools. Founder of RogoLabs | Creator of & .
Everyone says the security world stops for Vegas. Your CVE queue never got the memo.
July 2026 closed with 9,775 published CVEs, up from 3,776 in July 2025 (+158.9%). That puts 2026 at 45,626 CVEs year to date, +66.4% year over year, and 215 CVEs published a day so far this year. July 21 alone accounted for 1,474 of them, 1,097 of which were from Oracle.
CVSS is a severity label the industry treats like a priority list. This year 4,719 CVEs scored CVSS v3 9.0+, and half carry the identical 9.8. Only nine distinct scores exist in that band: no 9.5, no 9.7. What would your tooling sort them on?
By July 16, the 2026 CVE count hit 39,952, the entire 2024 total, with the year barely half over. Each year now clears the two-years-earlier total sooner: mid-November in 2020, mid-August in 2025, mid-July in 2026. The earliest in this series.
CISA added 154 CVEs to its Known Exploited Vulnerabilities list so far in 2026. Over half landed within a month of publication. But 16% were more than three years old when they hit the list.
The bugs you see most are not the bugs that get exploited. I mapped every CVE on CISA's list of exploited vulnerabilities to its corresponding CWE. What attackers actually use: memory corruption and injection. XSS is the most common bug on the internet, and it barely shows up.
Stop triaging by bug class. The 10 most common CWEs and their CVSS scores. But every one of the 10 has vulnerabilities in the same 6.3-7.1 band. The class does not tell you the severity.
A CVSS score is not a fact about a bug. It is an opinion with a decimal point. 13 orgs scored XSS: averages range from 3.4 to 6.7, mostly because VulDB sits at the bottom. The biggest reason is not the metric people argue about (Scope). That one call is worth ~1.4 points, double Scope.
H1 2026: 35,364 CVEs. More than any full year before 2024. One every 7.4 minutes, +49.5% YoY. But only 85 (0.24%) are on CISA's KEV list so far. We're drowning in CVEs while confirmed exploitation stays rare. That gap is the whole game. Review + Code: jerrygamblin.com/2026/07/01/3...
I'm bad at golf. But I'm good at data visualization. So I built this: a self-hosted @Garmin R10 analytics dashboard with club analysis, gapping tables, carry tracking, and AI coaching recommendations. All from your own data. 🔗 github.com/jgamblin/golf
April 2026 CVE Stats: 🚨 5,820 New CVEs (+44% YoY) 📊 175/day avg 📈 YTD: 20,991 (+31% YoY) 🔥 Median CVSS: 7.0 Top CWEs: 1️⃣ XSS (588) 2️⃣ Path Traversal (238) 3️⃣ Missing Auth (235) 4️⃣ SQLi (218) #InfoSec #CyberSecurity #CVE
When the NVD and GitHub disagree on a CVSS score, who do you trust? I’m at #VulnCon and built Vuln Anarchy to visualize the scoring gap. This chart shows nearly 1,500 instances where the math doesn't align. Live Data: rogolabs.github.io/vuln-anarchy/ Repo: github.com/RogoLabs/vul...
Paid $25 on eBay for a 1943 cryptography book. It arrived signed by LTC George R. Eckman, the Executive Officer of the Alsos Mission, the WWII task force that hunted Nazi nuclear scientists across Europe. It's going to the U.S. Army Intelligence Hall of Fame. Some books belong in archives. 🔐
March 2026 was a brutal month for vulnerabilities. 🛡️ Here is the damage: • 6,246 new CVEs (+55.7% Over Last March) • 169 new vulns per day 🤯 • 7.1 median CVSS severity (High) The Top 3 Culprits: 🥇 XSS (730) 🥈 SQLi (325) 🥉 Missing Auth (292) 2026 is already up 27% YoY.
February 2026 CVE Growth Report: YTD (February): ▸ 8,932 total CVEs (+12.4% vs 2025 YTD) ▸ 151 new vulnerabilities per day ▸ +982 more CVEs than 2025 through February February alone: ▸ 4,619 CVEs (+25.7% vs February 2025)
Jan 2026 CVEs: 4,319. While +1.0% YoY looks flat, it's 139 CVEs/day—nearly 7% HIGHER than 2025's average. #cybersecurity #CVE #infosec #RogoLabs
London bound next week (Dec 7–15)! 🇬🇧 I’ll be at #BlackHatEU giving my talk on the "Post-NVD Era" (Thurs Dec 11 @ 2:30 PM) and then hitting up #BSidesLDN for the weekend. #Infosec #VulnMgmt #CVE
A professor reached out about my 3-year-old CVElk project—it was broken. Spent some time last night fixing it: 4 live data sources, 300K+ CVEs, modern Python CLI, auto-updates. Always happy to fix old code if it helps! 🙏 github.com/jgamblin/CVElk
2025 CVE Growth Report (Data through Nov 30): ⚠️ Total: 42,697 CVEs (+16.9% YoY) 📅 Daily Avg: 128 📉 November Dip: Monthly volume dropped 25% YoY (3,028 CVEs), the lowest since Jan. We are still on track for a record year, sitting at +6,187 CVEs over 2024.
🚨 BLACK FRIDAY DOORBUSTER 🚨 CVE.ICU just got a MASSIVE upgrade: EPSS, CISA KEV, & Risk Matrix. Our unbeatable price remains: $0.00. No credit card. No sales calls. Just vibes and vulnerabilities. #BlackFriday #CyberSecurity #OpenSource
2025 CVE Stats Update (October 31st, 2025) Total Number of CVEs: 39,681 Average CVEs Per Day: 130.53 Average CVSS Score: 6.61 YOY Growth: 22.42% or +7,267 (32,414 CVEs in 2024)
Spent Sunday watching football & analyzing 314,705 CVEs to track update velocity. Key takeaway: Some issues require constant attention—the top CVE, CVE-2023-4255, has been updated 220 times! See the full analysis and charts: rogolabs.github.io/CVE-Updates/
2025 CVE Stats Update (September 30th, 2025) Total Number of CVEs: 35,404 Average CVEs Per Day: 129.68 Average CVSS Score: 6.62 YOY Growth: 22.72% or +6,555 (28,849 CVEs in 2024)
2025 CVE Stats Update (August 31st, 2025) Total Number of CVEs: 31,077 Average CVEs Per Day: 127.89 Average CVSS Score: 6.63 YOY Growth: 17.81% or +4,699 (26,378 CVEs in 2024)
At DEF CON? I'm speaking today at 1PM in the AppSec Village. Stop by to hear me talk about the post NVD era of vulnerability data.
2025 CVE Stats Update (July 31st, 2025) Total Number of CVEs: 27,447 Average CVEs Per Day: 129.47 Average CVSS Score: 6.62 YOY Growth: 17.32% or +4,053 (23,394 CVEs in 2024)
2025 CVE Stats Update (June 30th, 2025) Total Number of CVEs: 23,668 Average CVEs Per Day: 130.76 Average CVSS Score: 6.59 YOY Growth: 16.22% or +3303 (20365 CVEs in 2024)
Thrilled my talk "The Art of Concealment: CVE's Challenge with Transparency” was accepted at #BSidesLV this summer! Excited to discuss CVE transparency in Vegas. See you there!