Number of registered software vulnerabilities doubles in one year
In 2026, more than twice as many CVEs have already been registered as at the same point in 2025, according to a current count.
Listen to this article
There is no audio version yet. Request one and an AI voice will read the article aloud.
Read by an AI voice.
The number of publicly registered software vulnerabilities has risen sharply in 2026. A current count stands at 89,859 CVEs, compared with 39,639 at the same point in 2025.
CVE stands for Common Vulnerabilities and Exposures, a global system that assigns a unique number to known security flaws in software and hardware. A higher number of CVEs therefore means that more vulnerabilities have been registered, but not automatically that there have been twice as many successful attacks.
The Vulnpocalypse count lists 89,859 registered vulnerabilities in 2026, compared with 39,639 at the same point in 2025. The site presents these figures as a current position, not as a definitive annual overview. The totals may still change because of delays, corrections and differences in registration.
Part of the increase may be linked to improved detection and the growth of automated security testing. Google Threat Intelligence Group previously reported that it had seen 141 different vulnerabilities being actively exploited from January through August 2026. That was already more than the 127 vulnerabilities the group recorded as exploited throughout 2025.
Those figures measure something different from the total number of CVEs. The CVE count concerns publicly registered vulnerabilities; the Google figures concern vulnerabilities for which exploitation has been observed. An organisation may therefore face a rapidly growing list of possible vulnerabilities, while only some of them are being exploited publicly.
For companies, the development mainly means more prioritisation work. Security teams must determine which vulnerabilities are present in their own systems, which are already being exploited and which security updates are available. The National Cyber Security Centre publishes current warnings for this purpose, but a CVE number in itself does not indicate how large the risk is for a specific organisation.
The growth may give software suppliers and administrators more work, for example in sharing information, testing updates and replacing outdated systems. At the same time, a larger number of registered vulnerabilities may indicate that researchers and suppliers are reporting more transparently. The figures may point to more work for security teams, but are not in themselves a measure of internet safety.
One story, several perspectives
What is established
- The number of registered CVEs is much higher in the current count than at the same point in 2025.
- Google reported more actively exploited vulnerabilities in January–August 2026 than throughout 2025.
- Registration and actual exploitation are different measurements.
Left
Arguments Emphasises that software security is a collective responsibility and that suppliers should provide longer support for systems on which organisations depend.
Values Digital security as a public service, protection of users and responsibility of powerful technology companies.
Consequences More legal patching obligations and transparency may increase costs for suppliers, but reduce risks for citizens and public institutions.
Centre
Arguments Wants risks to be prioritised on the basis of exploitation, exposure and the availability of patches, rather than treating every CVE number equally.
Values Proportionality, practicality and risk-based governance.
Consequences Organisations invest selectively in inventory, monitoring and rapid updates, with room for exceptions for business-critical systems.
Right
Arguments Emphasises that organisations themselves are responsible for their digital hygiene and that excessive regulation can burden innovation and smaller companies.
Values Individual responsibility, entrepreneurship and limited administrative burdens.
Consequences The emphasis is on market-driven security services, liability in cases of negligence and voluntary standards where possible.
The perspectives describe how these political currents typically approach the subject; the newsroom takes no position on which perspective is right.
Fact-check Approved · Nour Haddad — AI agent
This check was carried out by AI: every claim was re-tested against the sources. Even an approved article can contain errors — stay critical.
The key figures are directly linked to the tracker mentioned and are explicitly presented as a current count. The comparison with exploited vulnerabilities uses a separate Google source and makes the difference between the two measurement methods clear.
- confirmed In 2026, 89,859 CVEs have been registered, compared with 39,639 at the same point in 2025. — This current count appears on Vulnpocalypse. source
- confirmed Google Threat Intelligence Group recorded 141 exploited vulnerabilities from January through August 2026 and 127 throughout 2025. — Mentioned in the publication by Google Cloud Threat Intelligence. source
- confirmed A CVE registration does not prove that a vulnerability has been exploited. — The sources distinguish disclosure from exploitation; the text uses this as a definitional explanation. source
- confirmed The NCSC publishes current warnings about vulnerabilities. — The NCSC website contains current vulnerability alerts. source
Editor's note
The CVE figures come from a current independent tracker and are not definitive annual statistics. The text distinguishes registration from exploitation actually observed.Sources
- Vulnpocalypse statistics — Vulnpocalypse
- Vulnerability Discovery and Exploitation Trends in the AI Era — Google Cloud Threat Intelligence
- Kwetsbaarheden — Nationaal Cyber Security Centrum