This year’s bug count just passed 100K
“The thing that almost scares the bejesus out of me is while 100K sounds like a lot, in a couple years we're going to say, remember when it was only 100K?” As of the time of our interview, about 4 pm UTC on Friday, VulnCheck counted 100,222 CVEs, he said.
Key points
- About 1.4 percent (1,363) of the CVEs published this year have been added to VulnCheck’s Known Exploited Vulnerabilities (KEV) catalog.
- This window has closed even further during the second half of the year, which also seems to coincide with the AI-induced vulnpocalypse.
- Microsoft alone added 1,094 security flaws to the total count on Tuesday, following 1,474 vulnerabilities the month before.
“It's telling people to figure out the vulnerabilities that actually affect you, and then put those at the top of the list, instead of just saying we're going to fix all the criticals,” Bressers said.
Additional details
- The number of Common Vulnerabilities and Exposures (CVEs) found and disclosed so far in 2026 surpassed 100,000 on Friday - more than double 2025’s total - and the reason can be summed up in two letters: AI.
- Plus, as other security researchers have documented, the window between the public release of a security patch and attackers developing working exploits – often by reverse engineering the patch while end users are still applying the fix – is rapidly shrinking.
- It'd be hard to say it's not, because we've seen it really ramp up recently.” This influx of software bugs requires a sea change in how the entire industry approaches vulnerability disclosure and patching.
- The CISA BOD helps with that.” What to prioritize in a patchpocalypse The US Cybersecurity and Infrastructure Security Agency (CISA) in June issued a cybersecurity directive that replaces flat-deadline vulnerability management policies.
- Instead of prioritizing patching based solely on CVSS severity scores, the directive instructs organizations to prioritize based on specific risk criteria, including whether the asset is internet-exposed, under active exploitation, and whether an attacker can automate the exploit.
How this summary was made: extractive summary — built from the sources' own reporting. It is drawn only from the reporting of the sources listed below — read the originals for full detail. How we summarize →
Advertisement
Every article behind this summary — 1 article from 1 outlet
Get stories like this in your inbox.
Subscribe — it's freeOne free email at 6am — your topics, deduplicated, five minutes. No account, no paywall.