# method

> markdown for agents. every page and download is listed in [llms.txt](https://cvegen.art/llms.txt).

each poster paints one month of published cves. the days run from top to bottom, and a day gets more paint the more cves it brought.

## what goes in

- the cve list: every published cve, counted in the month of its publish date in utc. rejected records are left out.
- the 2025 average: for each weekday, how many cves a 2025 day of that weekday brought on average. every day is measured against it, so a quiet sunday and a busy tuesday are judged fairly.
- who filed it: the kind of software each cve is about, sorted into two groups. it decides which of the month's two inks a stroke gets.

snapshot of the cve list from october 25, 2026. sources and definitions: [data](https://cvegen.art/data.md).

## four layers

every poster is built in four layers, here pulled apart for september 2026. the days at the bottom, the finished painting on top.

- 01 days: one line per day: dim up to the 2025 average for that weekday, bright beyond it
- 02 brush: one sweep a day, longer past the 2025 weekday average
- 03 marks: extra passes on the busiest days, sep 14 to 17 fold into one
- 04 painting: the finished sheet, 14,934 cves in september 2026

## layer by layer

1. days: one line per day, the first day at the top. the dim part of a line reaches the 2025 average for that weekday. anything brighter is the day's excess.
2. brush: each day becomes brush passes. more cves load more ink. the further a day runs above its average, the wider, longer and steeper its strokes.
3. marks: the busiest stretch of the month folds into one sweep, the place the eye lands first. in september it is sep 14 to 17.
4. painting: two inks on paper. the deep ink is the share from open-source packages, enterprise vendors, the linux kernel, browsers and ai software. the pale ink is everything else. the split is our own rule and it is approximate.

## how a day is weighed

a day's excess compares its count with the 2025 average for the same weekday.

big vendors publish in batches. on sep 8 microsoft filed 965 cves at once. so before a day is measured, any single filer's share above 30% of that day is set aside. one bulk drop can't make a day look busy on its own. the full count still goes into the totals.

| 2025 average | cves a day |
| --- | --- |
| monday | 143 |
| tuesday | 227 |
| wednesday | 177 |
| thursday | 172 |
| friday | 135 |
| saturday | 41 |
| sunday | 29 |

## what stays fixed

- same data, same poster: every random choice is seeded by the month, so drawing a month again gives the same picture.
- one scale for all: no month is stretched to fill the sheet. a quiet month stays pale and a heavy one fills up, so posters can be compared side by side.
- colour by calendar: each calendar month has its own pair of inks, the same every year. colour tells you the month, not how bad it was.
- the running month: the current month is redrawn with every new snapshot. once it closes, its poster stops changing.
- not painted: severity. the posters show how many cves came and when. how critical they were is listed on each month's page.

## pages

- [home](https://cvegen.art/index.md): the latest poster and every month
- [method](https://cvegen.art/method.md): how a month of cves becomes a painting
- [data](https://cvegen.art/data.md): sources, definitions and downloads
- [about](https://cvegen.art/about.md): who makes it and how the posters can be used