# cvegen.art: a poster for every month of cves

> markdown for agents. every page and download is listed in [llms.txt](https://cvegen.art/llms.txt).

cvegen paints every cve published in a month into one poster. calm days get slow, level strokes, busy days sweep fast.

![drybrush poster for september 2026, painted from 14,934 published cves](https://media.cvegen.art/posters/2026-09/1280.jpg?v=60337f4b03)

## september 2026

september 2026 brought 14,934 cves, 3.7 times an average 2025 month. every one of its 30 days ran above the 2025 average for that weekday.

| fact | value |
| --- | --- |
| on sep 8, the busiest day | 1,563 |
| rated critical, cvss 9 or higher | 1,479 |
| already used in real attacks | 32 |

### 32 already used in real attacks

cisa kev, as of oct 24.

- sep 1, sonicwall sma1000 appliances, two flaws
- sep 6, n-able n-central
- sep 7, adobe commerce and magento
- sep 8, connectwise screenconnect
- sep 12, gitlab community edition and enterprise edition
- sep 16, cisco identity services engine
- sep 22, arista velocloud orchestrator

the full list with cve ids is on the [september 2026](https://cvegen.art/2026/09.md) page.

## how to read it

each poster is four layers. here they are pulled apart, the days at the bottom and the painting on top. the diagram shows september 2026.

- 01 days: one line per day: dim up to the 2025 average for that weekday, bright beyond it
- 02 brush: one sweep a day, longer past the 2025 weekday average
- 03 marks: extra passes on the busiest days, sep 14 to 17 fold into one
- 04 painting: the finished sheet, 14,934 cves in september 2026

## every month

### 2026, 86,403 cves so far

- [october 2026](https://cvegen.art/2026/10.md): 13,601 cves so far
- [september 2026](https://cvegen.art/2026/09.md): 14,934 cves
- [august 2026](https://cvegen.art/2026/08.md): 12,260 cves
- [july 2026](https://cvegen.art/2026/07.md): 9,759 cves
- [june 2026](https://cvegen.art/2026/06.md): 7,949 cves
- [may 2026](https://cvegen.art/2026/05.md): 6,933 cves
- [april 2026](https://cvegen.art/2026/04.md): 5,813 cves
- [march 2026](https://cvegen.art/2026/03.md): 6,236 cves
- [february 2026](https://cvegen.art/2026/02.md): 4,616 cves
- [january 2026](https://cvegen.art/2026/01.md): 4,302 cves

### 2025, 48,151 cves

- [december 2025](https://cvegen.art/2025/12.md): 5,493 cves
- [november 2025](https://cvegen.art/2025/11.md): 3,020 cves
- [october 2025](https://cvegen.art/2025/10.md): 4,274 cves
- [september 2025](https://cvegen.art/2025/09.md): 4,319 cves
- [august 2025](https://cvegen.art/2025/08.md): 3,629 cves
- [july 2025](https://cvegen.art/2025/07.md): 3,774 cves
- [june 2025](https://cvegen.art/2025/06.md): 3,682 cves
- [may 2025](https://cvegen.art/2025/05.md): 3,980 cves
- [april 2025](https://cvegen.art/2025/04.md): 4,033 cves
- [march 2025](https://cvegen.art/2025/03.md): 4,001 cves
- [february 2025](https://cvegen.art/2025/02.md): 3,673 cves
- [january 2025](https://cvegen.art/2025/01.md): 4,273 cves

## what this is

a cve is the public id a software flaw gets when it is disclosed. the list is open to anyone, and it keeps getting longer.

- 4,013 cves a month in 2025, on average
- 14,934 cves in september 2026, the most so far

every month is drawn with the same rule and the same scale, so you can put any two posters side by side and compare them. the current month keeps filling in until it closes.

## pages

- [home](https://cvegen.art/index.md): the latest poster and every month
- [method](https://cvegen.art/method.md): how a month of cves becomes a painting
- [data](https://cvegen.art/data.md): sources, definitions and downloads
- [about](https://cvegen.art/about.md): who makes it and how the posters can be used