2025 CVE Stats Update (September 30th, 2025) Total Number of CVEs: 35,404 Average CVEs Per Day: 129.68 Average CVSS Score: 6.62 YOY Growth: 22.72% or +6,555 (28,849 CVEs in 2024)

I've added a new page to CVEForecast.org: a CNA Forecast. It's a fun project to track the growth and decline trends. Hopefully, it provides some interesting insights for anyone in the vuln space. Check it out here: cveforecast.org/cna_forecast... #infosec #cybersecurity #vulnerability #cve

The CVE Program is stepping into its Quality Era, and I couldn't be happier. CISA's vision prioritizes trust, quality, and responsiveness in vulnerability management. This is a fantastic step to ensure CVE data remains a public good for everyone www.cisa.gov/sites/defaul...

2025 CVE Stats Update (August 31st, 2025) Total Number of CVEs: 31,077 Average CVEs Per Day: 127.89 Average CVSS Score: 6.63 YOY Growth: 17.81% or +4,699 (26,378 CVEs in 2024)

Here are my slides from #BSidesLV on "The Art of Concealment." TLDR: Many CVEs are published without the four pillars (CWE, CPE, CVSS, Fix) needed for security teams to remediate the vulnerabilities successfully. rogolabs.net/Talks/The%20...

At DEF CON? I'm speaking today at 1PM in the AppSec Village. Stop by to hear me talk about the post NVD era of vulnerability data.

Just announced after my talk: CNAScorecard.org is LIVE! 🚀 Did you know only 2% of CVEs have CPE data and just 4.8% have patch info? This cripples automation & leaves us blind.

2025 CVE Stats Update (July 31st, 2025) Total Number of CVEs: 27,447 Average CVEs Per Day: 129.47 Average CVSS Score: 6.62 YOY Growth: 17.32% or +4,053 (23,394 CVEs in 2024)

Relaunched my open-source project, cve.icu! It's been completely rewritten in pure HTML—making it blazing fast & fully interactive. Designed to cut through the noise of 40k+ new vulns a year. Explore vulnerability data faster. 🚀 cve.icu

Vegas-bound! ✈️ I'm giving two talks next week on CVEs and vulnerability disclosure. First up is @bsideslv.org on Tues, 2:30pm: "The Art of Concealment: CVE's Challenge with Transparency"(thread 👇)

CVEScoreCard v.06 is live. 🤖 My open-source CVE forecast now auto-tunes itself daily, learning from past runs to get more accurate. Today, it's predicting 46,796 CVEs for the year. See the live forecast: cveforecast.org #cybersecurity #cve #opensource #infosec

Inspired by the excellent work from the folks at vuln4cast & @firstdotorg on vulnerability forecasting, I spent the weekend building a little tool. Announcing cveforecast.org! 🚀 A simple site to forecast the growth of CVEs. Hope it's useful to the community!

2025 CVE Stats Update (June 30th, 2025) Total Number of CVEs: 23,668 Average CVEs Per Day: 130.76 Average CVSS Score: 6.59 YOY Growth: 16.22% or +3303 (20365 CVEs in 2024)

An AI BBQ Grill? No thanks. I learned from my grandpa, and his only algorithm was clicking the tongs twice and saying, "Yep, 'bout done." briskitgrills.com/collections/...

I built (vibecoded) a small game to see how fast you can sort 100 team logos. Test your sports knowledge and see how fast you can sort 100 logos! 🏈⚾️🏀 Play it here: jgamblin.github.io/logosort/

Thrilled my talk "The Art of Concealment: CVE's Challenge with Transparency” was accepted at #BSidesLV this summer! Excited to discuss CVE transparency in Vegas. See you there!

2025 CVE Stats Update (May 31st, 2025) Total Number of CVEs: 19998 Average CVEs Per Day: 132.44 Average CVSS Score: 6.59 YOY Growth: 16.04% or +2765 (17233 CVEs in 2024)

Excited to share CVE-MCP, my new project for direct access to official MITRE/CVE Program data! Leverages MCP to bring CVE info into developer workflows. Check it out: github.com/jgamblin/CVE... #CyberSecurity #CVE #OpenSource #MCP #DevTools

2025 CVE Stats Update (May 01, 2025) Total Number of CVEs: 16,053 Average CVEs Per Day: 132.67 Average CVSS Score: 6.89 YOY Growth: 30.45% or +3,747 (12,306 CVEs in 2024)

The LLM Security Leaderboard shows that most models are not ready for prime time. huggingface.co/spaces/stack...

Wrapped up a fantastic workshop today at #Vulncon25! Thanks to everyone who joined. You can find the code and materials here: github.com/jgamblin/Vul...

It has been a little over a year since the start of the NVD slowdown. Currently, 8%, or over 22,000, of all CVEs are awaiting analysis. The slowdown is not evenly distributed; the top 10 CNAs account for 75%, or over 17,000, of all unanalyzed CVEs.

Happy “Let's circle back after the holidays” season to all those who celebrate.

If you rely on NVD data, you should be aware of these changes they are making on Monday. groups.google.com/a/list.nist....

CISA released a report on the Top Routinely Exploited Vulnerabilities in 2023. I found that 34% of the CVEs do not have exploit code in MetaSploit or Nuclei. It is hard to believe that 1/3 of the most routinely exploited CVE did not have well known exploits. gist.github.com/jgamblin/ad1...

Transition to Post-Quantum Cryptography Standards (PDF) csrc.nist.gov/pubs/ir/8547...

A CVE Quality Workgroup Report highlighting CVEs with schema and quality issues. cveproject.github.io/quality-work...

👋