London bound next week (Dec 7–15)! 🇬🇧 I’ll be at #BlackHatEU giving my talk on the "Post-NVD Era" (Thurs Dec 11 @ 2:30 PM) and then hitting up #BSidesLDN for the weekend. #Infosec #VulnMgmt #CVE

A professor reached out about my 3-year-old CVElk project—it was broken. Spent some time last night fixing it: 4 live data sources, 300K+ CVEs, modern Python CLI, auto-updates. Always happy to fix old code if it helps! 🙏 github.com/jgamblin/CVElk

2025 CVE Growth Report (Data through Nov 30): ⚠️ Total: 42,697 CVEs (+16.9% YoY) 📅 Daily Avg: 128 📉 November Dip: Monthly volume dropped 25% YoY (3,028 CVEs), the lowest since Jan. We are still on track for a record year, sitting at +6,187 CVEs over 2024.

🚨 BLACK FRIDAY DOORBUSTER 🚨 CVE.ICU just got a MASSIVE upgrade: EPSS, CISA KEV, & Risk Matrix. Our unbeatable price remains: $0.00. No credit card. No sales calls. Just vibes and vulnerabilities. #BlackFriday #CyberSecurity #OpenSource

2025 CVE Stats Update (October 31st, 2025) Total Number of CVEs: 39,681 Average CVEs Per Day: 130.53 Average CVSS Score: 6.61 YOY Growth: 22.42% or +7,267 (32,414 CVEs in 2024)

Forget cryptocurrency—let's talk real cryptography! If you're into ciphers and code-breaking, this special on the hidden messages of Mary, Queen of Scots, is a must-watch. www.pbs.org/video/cracki...

Spent Sunday watching football & analyzing 314,705 CVEs to track update velocity. Key takeaway: Some issues require constant attention—the top CVE, CVE-2023-4255, has been updated 220 times! See the full analysis and charts: rogolabs.github.io/CVE-Updates/

📢 New Open-Source Tool: CNAPulse.org Getting a quick, transparent overview of CNA activity was nearly impossible. It required manual processing of raw CVE data. I built CNAPulse.org to automate and bring transparency to publishing in the CVE ecosystem.

2025 CVE Stats Update (September 30th, 2025) Total Number of CVEs: 35,404 Average CVEs Per Day: 129.68 Average CVSS Score: 6.62 YOY Growth: 22.72% or +6,555 (28,849 CVEs in 2024)

I've added a new page to CVEForecast.org: a CNA Forecast. It's a fun project to track the growth and decline trends. Hopefully, it provides some interesting insights for anyone in the vuln space. Check it out here: cveforecast.org/cna_forecast... #infosec #cybersecurity #vulnerability #cve

The CVE Program is stepping into its Quality Era, and I couldn't be happier. CISA's vision prioritizes trust, quality, and responsiveness in vulnerability management. This is a fantastic step to ensure CVE data remains a public good for everyone www.cisa.gov/sites/defaul...

2025 CVE Stats Update (August 31st, 2025) Total Number of CVEs: 31,077 Average CVEs Per Day: 127.89 Average CVSS Score: 6.63 YOY Growth: 17.81% or +4,699 (26,378 CVEs in 2024)

Here are my slides from #BSidesLV on "The Art of Concealment." TLDR: Many CVEs are published without the four pillars (CWE, CPE, CVSS, Fix) needed for security teams to remediate the vulnerabilities successfully. rogolabs.net/Talks/The%20...

At DEF CON? I'm speaking today at 1PM in the AppSec Village. Stop by to hear me talk about the post NVD era of vulnerability data.

Just announced after my talk: CNAScorecard.org is LIVE! 🚀 Did you know only 2% of CVEs have CPE data and just 4.8% have patch info? This cripples automation & leaves us blind.

2025 CVE Stats Update (July 31st, 2025) Total Number of CVEs: 27,447 Average CVEs Per Day: 129.47 Average CVSS Score: 6.62 YOY Growth: 17.32% or +4,053 (23,394 CVEs in 2024)

Relaunched my open-source project, cve.icu! It's been completely rewritten in pure HTML—making it blazing fast & fully interactive. Designed to cut through the noise of 40k+ new vulns a year. Explore vulnerability data faster. 🚀 cve.icu

Vegas-bound! ✈️ I'm giving two talks next week on CVEs and vulnerability disclosure. First up is @bsideslv.org on Tues, 2:30pm: "The Art of Concealment: CVE's Challenge with Transparency"(thread 👇)

CVEScoreCard v.06 is live. 🤖 My open-source CVE forecast now auto-tunes itself daily, learning from past runs to get more accurate. Today, it's predicting 46,796 CVEs for the year. See the live forecast: cveforecast.org #cybersecurity #cve #opensource #infosec

Inspired by the excellent work from the folks at vuln4cast & @firstdotorg on vulnerability forecasting, I spent the weekend building a little tool. Announcing cveforecast.org! 🚀 A simple site to forecast the growth of CVEs. Hope it's useful to the community!

2025 CVE Stats Update (June 30th, 2025) Total Number of CVEs: 23,668 Average CVEs Per Day: 130.76 Average CVSS Score: 6.59 YOY Growth: 16.22% or +3303 (20365 CVEs in 2024)

An AI BBQ Grill? No thanks. I learned from my grandpa, and his only algorithm was clicking the tongs twice and saying, "Yep, 'bout done." briskitgrills.com/collections/...

I built (vibecoded) a small game to see how fast you can sort 100 team logos. Test your sports knowledge and see how fast you can sort 100 logos! 🏈⚾️🏀 Play it here: jgamblin.github.io/logosort/

Thrilled my talk "The Art of Concealment: CVE's Challenge with Transparency” was accepted at #BSidesLV this summer! Excited to discuss CVE transparency in Vegas. See you there!

2025 CVE Stats Update (May 31st, 2025) Total Number of CVEs: 19998 Average CVEs Per Day: 132.44 Average CVSS Score: 6.59 YOY Growth: 16.04% or +2765 (17233 CVEs in 2024)

Excited to share CVE-MCP, my new project for direct access to official MITRE/CVE Program data! Leverages MCP to bring CVE info into developer workflows. Check it out: github.com/jgamblin/CVE... #CyberSecurity #CVE #OpenSource #MCP #DevTools

2025 CVE Stats Update (May 01, 2025) Total Number of CVEs: 16,053 Average CVEs Per Day: 132.67 Average CVSS Score: 6.89 YOY Growth: 30.45% or +3,747 (12,306 CVEs in 2024)

The LLM Security Leaderboard shows that most models are not ready for prime time. huggingface.co/spaces/stack...

Wrapped up a fantastic workshop today at #Vulncon25! Thanks to everyone who joined. You can find the code and materials here: github.com/jgamblin/Vul...

It has been a little over a year since the start of the NVD slowdown. Currently, 8%, or over 22,000, of all CVEs are awaiting analysis. The slowdown is not evenly distributed; the top 10 CNAs account for 75%, or over 17,000, of all unanalyzed CVEs.

Happy “Let's circle back after the holidays” season to all those who celebrate.

If you rely on NVD data, you should be aware of these changes they are making on Monday. groups.google.com/a/list.nist....

CISA released a report on the Top Routinely Exploited Vulnerabilities in 2023. I found that 34% of the CVEs do not have exploit code in MetaSploit or Nuclei. It is hard to believe that 1/3 of the most routinely exploited CVE did not have well known exploits. gist.github.com/jgamblin/ad1...

Transition to Post-Quantum Cryptography Standards (PDF) csrc.nist.gov/pubs/ir/8547...

A CVE Quality Workgroup Report highlighting CVEs with schema and quality issues. cveproject.github.io/quality-work...

👋