method
each poster paints one month of published cves. the days run from top to bottom, and a day gets more paint the more cves it brought.
what goes in
- the cve list
- every published cve, counted in the month of its publish date in utc. rejected records are left out.
- the 2025 average
- for each weekday, how many cves a 2025 day of that weekday brought on average. every day is measured against it, so a quiet sunday and a busy tuesday are judged fairly.
- who filed it
- the kind of software each cve is about, sorted into two groups. it decides which of the month's two inks a stroke gets.
snapshot of the cve list from october 25, 2026
sources and definitionsfour layers
every poster is built in four layers, here pulled apart for september 2026. the days at the bottom, the finished painting on top.
- 04paintingthe finished sheet, 14,934 cves in september 2026
- 03marksextra passes on the busiest days, sep 14 to 17 fold into one
- 02brushone sweep a day, longer past the 2025 weekday average
- 01daysone line per day: dim up to the 2025 average for that weekday, bright beyond it
layer by layer
- 01days
- one line per day, the first day at the top. the dim part of a line reaches the 2025 average for that weekday. anything brighter is the day's excess.
- 02brush
- each day becomes brush passes. more cves load more ink. the further a day runs above its average, the wider, longer and steeper its strokes.
- 03marks
- the busiest stretch of the month folds into one sweep, the place the eye lands first. in september it is sep 14 to 17.
- 04painting
- two inks on paper. the deep ink is the share from open-source packages, enterprise vendors, the linux kernel, browsers and ai software. the pale ink is everything else. the split is our own rule and it is approximate.
how a day is weighed
a day's excess compares its count with the 2025 average for the same weekday.
big vendors publish in batches. on sep 8 microsoft filed 965 cves at once. so before a day is measured, any single filer's share above 30% of that day is set aside. one bulk drop can't make a day look busy on its own. the full count still goes into the totals.
| 2025 average | cves a day |
|---|---|
| monday | 143 |
| tuesday | 227 |
| wednesday | 177 |
| thursday | 172 |
| friday | 135 |
| saturday | 41 |
| sunday | 29 |
what stays fixed
- same data, same poster
- every random choice is seeded by the month, so drawing a month again gives the same picture.
- one scale for all
- no month is stretched to fill the sheet. a quiet month stays pale and a heavy one fills up, so posters can be compared side by side.
- colour by calendar
- each calendar month has its own pair of inks, the same every year. colour tells you the month, not how bad it was.
- the running month
- the current month is redrawn with every new snapshot. once it closes, its poster stops changing.
- not painted
- severity. the posters show how many cves came and when. how critical they were is listed on each month's page.