a poster for every month of cves
cvegen
cvegen paints every cve published in a month into one poster. calm days get slow, level strokes, busy days sweep fast.
october
2026
october 2026 brought 17,060 cves, 4.3 times an average 2025 month.
every one of its 31 days ran above the 2025 average for that weekday.
- on oct 13, the busiest day
- 2,291
- rated critical, cvss 9 or higher
- 1,445
20 already used in real attacks
cisa kev, as of oct 31
- oct 1fortinet fortimail
- oct 4ahsaycbs, two flaws
- oct 5atlassian products
- oct 13gitlab community edition and enterprise edition
- oct 14cisco secure email gateway
- oct 15beyondtrust remote support
- oct 22arista velocloud orchestrator
how to read it
each poster is four layers. here they are pulled apart, the days at the bottom and the painting on top.
- 04paintingthe finished sheet, 14,934 cves in september 2026
- 03marksextra passes on the busiest days, sep 14 to 17 fold into one
- 02brushone sweep a day, longer past the 2025 weekday average
- 01daysone line per day: dim up to the 2025 average for that weekday, bright beyond it
2026, 89,862 cves so far
what this is
a cve is the public id a software flaw gets when it is disclosed. the list is open to anyone, and it keeps getting longer.
- cves a month in 2025, on average
- 4,013
- cves in october 2026, the most so far
- 17,060
every month is drawn with the same rule and the same scale, so you can put any two posters side by side and compare them. the current month keeps filling in until it closes.