--- title: CVE Tracker | daily.dev description: A live dashboard tracks the total number of published CVE records, rebuilt daily from the official CVE list. It shows 394,368 CVEs total as of 2026-10-22. The... canonical: https://daily.dev/posts/cve-tracker-meburfq75 twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: CVE Tracker | daily.dev og:description: A live dashboard tracks the total number of published CVE records, rebuilt daily from the official CVE list. It shows 394,368 CVEs total as of 2026-10-22. The... og:url: https://daily.dev/posts/cve-tracker-meburfq75 og:image: https://api.daily.dev/og/posts/MebuRfQ75.png og:image:alt: CVE Tracker og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # CVE Tracker **[Hacker News](https://daily.dev/sources/hn)** · 1 min read · 43 upvotes · 3 comments ## Summary A live dashboard tracks the total number of published CVE records, rebuilt daily from the official CVE list. It shows 394,368 CVEs total as of 2026-10-22. The current month has 12,688 CVEs, with a monthly projection of about 17,350 and a yearly projection of about 103,854. It also charts daily CVE counts over the last 90 days. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### How many CVEs have been published in total? A live tracker counting published CVE records from the official CVE list reports 394,368 CVEs total as of an update dated 2026-10-22. The current month alone had 12,688 CVEs recorded, with a monthly projection of about 17,350 and a yearly projection of roughly 103,854. _Security teams gauging vulnerability volume can follow CVE trend data like this on daily.dev._ ## Community take How the wider developer community reacted, aggregated from 2 discussions and 56 comments across hackernews (as of 2026-10-24). **TL;DR:** Discussion centers less on the tracker itself and more on why CVE counts have exploded, with many arguing the rise reflects process/policy changes (new CNAs like Linux kernel and GitHub, AI-assisted bug hunting, looser CVE assignment criteria) rather than software actually getting less secure. **Sentiment:** 10% positive · 45% mixed · 45% skeptical **The case for** - The site prompted useful tangential discussion about CVE assignment process changes (e.g. Linux kernel and GitHub becoming CNAs in 2024). - Some see AI as genuinely useful for finding real vulnerabilities, including novel ones not in training data. - A few requested features (log scale, severity filter, alternate visualizations) and the maker responded constructively. **The pushback** - Many argue the raw CVE count is misleading/"fake" because assignment criteria have loosened dramatically (e.g. Linux kernel now assigns CVEs liberally since 2024). - Several say CVE/CVSS/CPE as a system is outdated and overly US-centric, especially after funding threats to MITRE. - One maintainer describes frustration with low-quality, AI-assisted CVE filings for trivial or non-issues. - Complaints that the log-scale toggle freezes the site. - Some dismiss the project itself as an AI-generated ('slop') site given its code style. **By community** - hackernews (mixed): Conversation splits between genuine interest in the data/visualization and skepticism that the rising CVE numbers reflect real security decline versus process and policy changes. **Hottest debate:** Whether the sharp rise in CVE counts reflects a real security crisis or is largely an artifact of changed assignment practices (new CNAs, AI-assisted reporting, lower filing bars). **Open questions** - Will the CVE backlog and triage capacity keep pace with the rising volume of filings? - Is this an exponential 'new normal' or will the rate plateau once low-hanging-fruit vulnerabilities are exhausted? - How should CVE scoring account for AI-assisted discovery and context-dependent severity? **Highlights** > I remember a comment somewhere, where employees of a company, would open a CVE for a piece that they use in their job, to force an upgrade of said software since normal update request has been denied despite having business reasons to do so. So, the number doesn't matter. Also, the linux kernel assigns CVE for anything that can be though as a vulnerability: > Note, due to the layer at which the Linux kernel is in a system, almost any bug might be exploitable to compromise the security of the kernel, but the possibility of exploitation is often not evident when the bug is fixed. Because of this, the CVE assignment team is overly cautious and assign CVE numbers to any bugfix that they identify. This explains the seemingly large number of CVEs that are issued by the Linux kernel team In other words, the number is fake > — [braiamp on hackernews · 2 comments](https://news.ycombinator.com/item?id=50216600) > Yes, and all of that changed in 2024 so fairly recently: http://www.kroah.com/log/blog/2024/02/13/linux-is-a-cna/ > — [philips on hackernews](https://news.ycombinator.com/item?id=50217776) > It has hit the point where I’ve told people reporting bugs with my software that I won’t acknowledge the bug unless they provide a patch to mitigate the issue. A lot of these bug reports are incorrectly filed. Let’s look at one issue, which I am sure was found with AI assistance: CVE-2026-40719 Here’s the issue: An IP authorized to perform recursive queries can cause the DNS server to be non-responsive if it sends hundreds of specially crafted packets a minute (this can be changed to millions of packets a minute if one sets a parameter in the configuration file). Normal service is restored within a minute of the attack being stopped. The workaround would require me to essentially rewrite the recursive part of the DNS server. Since the DNS server, like any server in a LAN, is already vulnerable to a flooding attack, this is just a flooding attack with extra steps. I told the guy that was interesting, I’m not being paid enough to rewrite the DNS server to be immune to the attack, and people shouldn’t be using its recursion (it has very limited IPv6 support, for starters), and if they do use its recursion, only authorized IPs (e.g. 127.0.0.1 or 192.168.1.0/24) should be allowed to perform recursion. It wasn’t a serious enough attack to merit a patch, and anyway the guy reporting the bug didn’t even have the decent courtesy to give me a patch. The guy responded by filing for a CVE report, incorrectly calling it a “high impact” bug, and I had to make a “patch” which simply disables recursion: https://samboy.github.io/MaraDNS/patches/MaraDNS-CVE-2026-40... Point being, a lot of these CVE reports out there which supposedly are high impact bugs are trivial things like “someone can overload a server for about one minute if they send hundreds to thousands of specially crafted DOS packets”. (Today, I got an issue which, as far as I can tell, looks to be a Linux kernel issue and not an issue with my code. I told him to show me how he would patch my code to “fix” the issue, but so far have gotten nothing but crickets) > — [strenholme on hackernews · 1 comments](https://news.ycombinator.com/item?id=50216897) > Not the topic (the site is interesting), but a tangential rant. I think the whole CVE/CVSS system is completely outdated, and it doesn't reflect the reality of software making for a while now (years). Also. for years, major software providers have been fighting to control their own release logs and security vulnerabilities. Recently, NIST stopped actually analyzing CVE's (one can relate to that), and the fact is that the system only makes sense as 1) vuln database; 2) in the context of responsible discosure; Responsible disclosure is from a non-AI era, where the time between a finding and a release woulds be measured in months, not weeks. Also, from a time where the probability of another human to stumble on that specific vulnerability was quite low. Pre-AI times. Also, in April 2025 MITRE announced that fundings to the CVE/CWE program would expire, and it took a couple of days for the Trump administration to backpedal from that. We need a global system, not an american one - and clearly, americans should not be in charge of these global programs, as there is no way to isolate the world from their local politics. Their programs, their funding, nothing against it. I just think we, collectively, should have something a bit more robust, and while at it, do it on a quite more modern basis (EU CRA is actually a good start, as it includes SBOM and mandatory reporting). CVE, CVSS, CPE seem all designed by comittee; CVSS and CPE are a flagrant case of that (try to apply CPE versioning to your own software, you'll get it); Its "what we have now" - there are alternatives, afaik but not that mainstream. > — [aforwardslash on hackernews · 1 comments](https://news.ycombinator.com/item?id=50217130) > Looks like an exponential curve, the inflection point doesn’t seem to line up with either the introduction of AI, or AI’s inflection point. Yes, yes, lower your prompt box, Software Development Has Changed Forever In The AI Era, but this is just “CVEs got Goodharted”. > — [fwlr on hackernews](https://news.ycombinator.com/item?id=50217517) **Source threads** - [hackernews](https://news.ycombinator.com/item?id=50215530) · 115 points · 56 comments - [hackernews](https://news.ycombinator.com/item?id=50203359) · 1 points · 0 comments ## Community discussion Top comments from developers on daily.dev. **@akkitto** · 9 upvotes > Shigure mode is the most useful one. 👍 **@ristotoldsep** · 0 upvotes > Useful tracker, terrifying graph. thanks for sharing! ## Similar posts on daily.dev - [CVE Volume Surges Past 48,000 in 2025 as WordPress Plugin Ec...](https://daily.dev/posts/cve-volume-surges-past-48-000-in-2025-as-wordpress-plugin-ec--hslhlzl9c) · Socket · 0 upvotes · 0 comments - [The CVE spike across major software companies is a remediation problem](https://daily.dev/posts/the-cve-spike-across-major-software-companies-is-a-remediation-problem-eirfbzfqc) · Aikido Security · 0 upvotes · 0 comments - [November CVEs Fell 25% YoY, Driven by Slowdowns at Major CNA...](https://daily.dev/posts/november-cves-fell-25-yoy-driven-by-slowdowns-at-major-cna--og1jf6p4g) · Socket · 0 upvotes · 0 comments - [The Linux Kernel Is Approaching 2,000 CVEs Per Release](https://daily.dev/posts/the-linux-kernel-is-approaching-2-000-cves-per-release-vzorlgrlg) · Phoronix · 0 upvotes · 0 comments - [The Vulnerability Curve Bent With the AI Curve — ProjectDiscovery Blog](https://daily.dev/posts/the-vulnerability-curve-bent-with-the-ai-curve-projectdiscovery-blog-6crwmllob) · ProjectDiscovery Blog · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security) [View this post on daily.dev](https://daily.dev/posts/cve-tracker-meburfq75) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"CVE Tracker","url":"https://daily.dev/posts/cve-tracker-meburfq75","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/cve-tracker-meburfq75"},"datePublished":"2026-10-23T23:00:25.487Z","dateModified":"2026-10-24T03:16:33.022Z","description":"A live dashboard tracks the total number of published CVE records, rebuilt daily from the official CVE list. It shows 394,368 CVEs total as of 2026-10-22. The...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/bc842e44c25111fea0276c56d1c41b7f?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/bc842e44c25111fea0276c56d1c41b7f?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Hacker News","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Hacker News","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/hn","url":"https://daily.dev/sources/hn"},"commentCount":3,"discussionUrl":"https://daily.dev/posts/cve-tracker-meburfq75","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":43},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":3}],"keywords":"security","timeRequired":"PT1M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Hacker News","item":"https://daily.dev/sources/hn"},{"@type":"ListItem","position":3,"name":"CVE Tracker"}]} {"@context":"https://schema.org","@type":"WebPage","@id":"https://daily.dev/posts/cve-tracker-meburfq75","comment":[{"@type":"Comment","text":"Shigure mode is the most useful one. 👍","datePublished":"2026-10-25T10:24:27.711Z","url":"https://daily.dev/posts/MebuRfQ75#c-2fJggTR9n","author":{"@type":"Person","name":"Daniel","url":"https://daily.dev/akkitto","image":"https://media.daily.dev/image/upload/s--FtwJqX4c--/f_auto/v1754900041/avatars/avatar_29TCpY2hJR72V3BlxPXzX?_a=BAMClqZW0"},"interactionStatistic":{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":9}},{"@type":"Comment","text":"Useful tracker, terrifying graph. thanks for sharing!","datePublished":"2026-10-27T13:43:35.426Z","url":"https://daily.dev/posts/MebuRfQ75#c-UX3ulWrQK","author":{"@type":"Person","name":"Risto Tõldsep","url":"https://daily.dev/ristotoldsep","image":"https://lh3.googleusercontent.com/a/ACg8ocLDWc6mZn0JwNmXXw6WY0L_HJ6pegzRttooC5VgtXESHSj3MNYx=s96-c"}}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/cve-tracker-meburfq75#faq","mainEntity":[{"@type":"Question","name":"How many CVEs have been published in total?","acceptedAnswer":{"@type":"Answer","text":"A live tracker counting published CVE records from the official CVE list reports 394,368 CVEs total as of an update dated 2026-10-22. The current month alone had 12,688 CVEs recorded, with a monthly projection of about 17,350 and a yearly projection of roughly 103,854. Security teams gauging vulnerability volume can follow CVE trend data like this on daily.dev."}}]} ```