First

There were 6,420 excess CVEs recorded through April 2026, representing a 46.3% cumulative drift above the February forecast.

EPSS had scores for 329,934 CVEs as of May 1, 2026.

Annual vulnerability disclosures are on pace to approach 70,000 for the first time in history.

GitHub Security Advisory (GHSA) volume increased 449% year-over-year.

VulnCheck CNA-of-Last-Resort activity increased 3,119%.

Mozilla CNA Q1 CVE disclosures spiked 164% due to AI-assisted tooling against the Firefox engine.

The CISA KEV catalog contained 1,587 entries as of May 1, 2026.

Actual CVE disclosures are running 46.3% above projections published four months earlier.

The 2026 projected total of CVE disclosures is approximately 66,000, up from a February median projection of 59,427.