cvegen

september 2026

cves
14,934
against an average 2025 month
3.7×
busiest day
sep 8, 1,563
used in real attacks
32

september 2026 brought 14,934 cves, 3.7 times an average 2025 month.

every one of its 30 days ran above the 2025 average for that weekday.

1,563

on sep 8, the busiest day. microsoft published 965 of them at once.

1,479

rated critical, cvss 9 or higher. 1,035 of them can be hit over the network with no login and nothing for a user to click.

675

in browsers, 15 times their 2025 monthly average. no other kind of software grew as fast.

2,197

came in three single drops: microsoft 965 on sep 8, oracle 634 on sep 15, the linux kernel team 598 on sep 17.

32 already used in real attacks

cisa kev, as of oct 24

  • 4
    plex media server
    sep 23
  • 3
    mikrotik routeros
    sep 5
  • 2
    sonicwall sma1000 appliances
    sep 1
  • 2
    google chromium v8
    sep 3, 9
  • 2
    microsoft windows
    sep 8
  • 2
    check point products
    sep 9, 22
  • 2
    citrix netscaler
    sep 27
  • 2
    zammad
    sep 30
  • 1
    n-able n-central
    sep 6
  • 1
    adobe commerce and magento
    sep 7
and 11 more productsall 32 with cve ids

cisa keeps adding older cves when attacks come to light, so this list can still grow.

how to read it

each poster is four layers. here they are pulled apart, the days at the bottom and the painting on top.

the september 2026 poster pulled apart into its four layers: days, brush, marks and the painting
  1. 04
    painting
    the finished sheet, 14,934 cves in september 2026
  2. 03
    marks
    extra passes on the busiest days, sep 14 to 17 fold into one
  3. 02
    brush
    one sweep a day, longer past the 2025 weekday average
  4. 01
    days
    one line per day: dim up to the 2025 average for that weekday, bright beyond it

this poster

period
september 1 to 30, 2026
cves
14,934
data
cve list v5, cisa kev, drawn 2026-10-24
format
3:4, drawn for 45 × 60 cm
download jpg, 2000 × 2667