CVE 2026 Half-Year Forecast Update

In February 2026, FIRST.org published its annual vulnerability forecast predicting roughly 43,757 CVEs would be published this year. Four months later, that number is already wrong by a wide margin. Actual publications are running 46% above the forecast, and the gap is widening.

This is not because software suddenly became less secure. The overshoot is almost entirely explained by two organizations dramatically scaling their CVE assignment operations: GitHub Security Advisories (GHSA) and VulnCheck. Together they added over 4,300 CVEs that the February model never anticipated.

The deeper question is whether this volume surge matters for defenders. Our analysis of CISA KEV and EPSS data shows that it largely does not. Less than 1% of the new volume from these CNAs meets a reasonable threshold for immediate action. Volume is not burden.

This page presents the full data, the revised forecast, and an exploitability overlay that separates signal from noise. All code and data are available in the GitHub repository.

The chart below shows every CVE published between January 1 and April 30, 2026. The raw daily counts (light line) are noisy due to weekend dips and batch-publication spikes, so the bold line shows a 7-day moving average to reveal the true trend. Three days stand out as statistical outliers, each driven by coordinated batch publications from multiple CNAs.

The divergence did not appear all at once. January came in 28% above forecast, which could have been normal variance. But the gap widened to 62% in March before stabilizing at 59% in April. This acceleration pattern points to a structural shift rather than random noise. The February model was trained on 2024 to 2025 behavior, and it simply could not account for the CNA operational expansions that began in late 2025.

Two CNAs account for most of the overshoot. GitHub Security Advisories (GHSA, published under the CNA shortName "GitHub_M") grew from 785 CVEs in Jan to Apr 2025 to 4,313 in the same period this year, a 449% increase. This reflects an expanded curation team and a deliberate campaign to backfill CVE IDs for advisories that previously existed only as GHSA identifiers. VulnCheck, operating as a CNA of Last Resort that assigns IDs to vulnerabilities no other CNA has claimed, scaled from 26 CVEs to 837 (+3,119%).

On the decline side, Patchstack dropped 43% and MITRE fell 29%. But the net math is clear: the growers outweigh the shrinkers by a wide margin.

We retrained an ExponentialSmoothing model on the full daily time series from January 2020 through April 30, 2026 and projected forward through December. The revised model projects 65,632 total CVEs for 2026, compared to FIRST.org's original 43,757. That is a 50% upward revision.

A few caveats are important. This model assumes the current publication regime persists. If GHSA's backfill campaign saturates or VulnCheck's pipeline plateaus, actual volumes could come in materially lower. The monthly projections below reflect an ExponentialSmoothing model (AutoARIMA was unavailable on the analysis platform); real months will be more volatile.

If the revised projection holds, 2026 will see the fastest growth in CVE publication history. The ecosystem crossed 1,000 published CVEs per week for the first time in March 2026 and has not dropped below that pace since. For context: in 2020, the full year produced 14,287 CVEs. We are now on track to exceed that in a single quarter.

The headline numbers are alarming, but they raise an important follow-up question: does this volume growth actually translate into more work for defenders? To find out, we enriched every CVE published by GitHub_M and VulnCheck with two exploitability signals. A CVE is classified as "Actionable" if it appears in the CISA Known Exploited Vulnerabilities (KEV) catalog or has an EPSS score above 10%. We then trained separate AutoARIMA models on the total volume and the actionable subset, forecasting both through December 2026.

The answer is clear: the growth is almost entirely non-actionable.

The February 2026 forecast no longer reflects current CNA dynamics and requires revision. It was calibrated against 2024 to 2025 behavior that has since been superseded by structural shifts in how CVEs are assigned. Here is what practitioners should take away:

Plan for 5,800 to 6,200 new CVEs per month for the remainder of 2026, but recognize that raw volume alone is a poor proxy for risk. Prioritization should lean heavily on exploitability signals (EPSS scores, CISA KEV membership) and affected-product relevance rather than CVE count.

Filter by CNA source when triaging. A GHSA advisory for a transitive npm dependency carries different operational urgency than a Chrome or Linux kernel CVE. Not all CVEs deserve the same SLA.

Monitor NVD enrichment lag. Teams relying on NVD-enriched data should verify whether NVD analysis throughput is keeping pace with this publication volume. Enrichment lag creates blind spots where CVEs exist in the catalog but lack CVSS scores or CPE data.

This is not a vulnerability explosion. The underlying rate of software defects has not increased 46% in four months. The CVE catalog is expanding its coverage, particularly for open-source library vulnerabilities that previously went untracked or existed only in platform-specific databases. Whether this represents the CVE system catching up to reality or a dilution of signal quality is a matter of ongoing debate within the CNA community.

This analysis uses the datePublished field from CVE V5 JSON records in the cvelistV5 repository, which reflects when a CVE was published to the catalog rather than when the vulnerability was discovered or disclosed. Some of the observed growth, particularly from GHSA and VulnCheck, includes backfill of previously known vulnerabilities now receiving CVE IDs for the first time. The true rate of newly discovered vulnerabilities is growing more slowly than these publication counts suggest.

The forecast model is ExponentialSmoothing (via Darts) trained on daily CVE counts from January 1, 2020 through April 30, 2026. AutoARIMA was the intended model but is unavailable on Python 3.14 (no statsforecast wheel). The exploitability overlay uses CISA KEV (1,587 entries, filtered to ≤ May 1 2026) and EPSS scores (329,934 CVEs scored) from the May 1, 2026 daily snapshot.

All source code, data processing scripts, and analysis are available at github.com/jgamblin/FirstForecast.