cvegen

may 2026

cves
6,933
against an average 2025 month
1.7×
busiest day
may 27, 714
used in real attacks
22

may 2026 brought 6,933 cves, 1.7 times an average 2025 month.

23 of its 31 days ran above the 2025 average for that weekday.

714

on may 27, the busiest day. the linux kernel team published 275 of them at once.

669

rated critical, cvss 9 or higher. 500 of them can be hit over the network with no login and nothing for a user to click.

440

in browsers, 9.8 times their 2025 monthly average. no other kind of software grew as fast.

696

came in three single drops: the linux kernel team 275 on may 27, the linux kernel team 224 on may 6, the linux kernel team 197 on may 8.

22 already used in real attacks

cisa kev, as of oct 24

  • 3
    ubiquiti unifi os
    may 22
  • 2
    palo alto networks pan-os
    may 6, 13
  • 2
    berriai litellm
    may 8
  • 2
    microsoft defender
    may 20
  • 1
    ivanti endpoint manager mobile
    may 7
  • 1
    tanstack
    may 12
  • 1
    cisco catalyst sd-wan
    may 14
  • 1
    microsoft
    may 14
  • 1
    daemon tools lite
    may 15
  • 1
    drupal core
    may 20
and 7 more productsall 22 with cve ids

cisa keeps adding older cves when attacks come to light, so this list can still grow.

this poster

period
may 1 to 31, 2026
cves
6,933
data
cve list v5, cisa kev, drawn 2026-10-24
format
3:4, drawn for 45 × 60 cm
download jpg, 2000 × 2667