CVE Records by Quarter
How many CVEs, by quarter?
Published CVE Records over time, from the CVE Program's own metrics. Start in quarters to see the shape within each year, then collapse to years to see the long-run growth — and the striking partial 2026.
Loading summary…
Download the JSON data · Source: CVE Program — Metrics (retrieved Nov. 3, 2026)
Published CVE Records Partial — 2026, Q4 TBA (*)
Loading chart…
Hover, focus, or tap a bar for its value.
Annual totals with quarterly breakdown
The chart's year view is the Total column here, computed from the quarters — not a separate dataset. * 2026 is partial (Q1–Q3); Q4 was TBA on the source page.
| Year | Q1 | Q2 | Q3 | Q4 | Total |
|---|
What this is — and what it isn't
These are published CVE Records, not vulnerabilities discovered in that quarter, and not a severity ranking — a quarter with more records is not necessarily a quarter with worse vulnerabilities. The source page describes the table as a point-in-time snapshot taken after each quarter ends: as a year progresses, its earlier quarters are recalculated for status changes (for example, to remove rejected records), with a final reconciliation at year-end, and previous years are not recalculated when a new year starts. So the 2026 figures here may still move.
One value deserves a flag, not an explanation I can't verify: 2026 Q3 (36,962) is roughly triple the typical recent quarter and is what pushes partial 2026 past all of 2025. The source page states no cause for it, so this page claims none — check the source before drawing conclusions from that single quarter.