VULNpocalypse

Day 210 of the Vulnpocalypse

AI finds bugs faster than anyone can fix them. Here is what to patch.

Since Claude Mythos Preview on 7 April 2026, CVE volume has more than doubled. Vulnpocalypse tracks every major exploited bug, supply-chain attack and breach, scores them live, and tells developers what to do.

See the timeline VEDAS vs EPSS
New CVEs published per monthGrey: before day zero. Blue: the Vulnpocalypse.
THE VULNPOCALYPSE2026-04-07: MythosMythos2026-10-21: PHP2ShellPHP2ShellNew CVEs published per month020KNew CVEs published per month, 2024-07: 3,113New CVEs published per month, 2024-08: 2,896New CVEs published per month, 2024-09: 2,514New CVEs published per month, 2024-10: 3,564New CVEs published per month, 2024-11: 4,056New CVEs published per month, 2024-12: 3,431New CVEs published per month, 2025-01: 4,275New CVEs published per month, 2025-02: 3,673New CVEs published per month, 2025-03: 3,998New CVEs published per month, 2025-04: 4,034New CVEs published per month, 2025-05: 3,980New CVEs published per month, 2025-06: 3,681New CVEs published per month, 2025-07: 3,776New CVEs published per month, 2025-08: 3,628New CVEs published per month, 2025-09: 4,321New CVEs published per month, 2025-10: 4,273New CVEs published per month, 2025-11: 3,021New CVEs published per month, 2025-12: 5,491New CVEs published per month, 2026-01: 4,302New CVEs published per month, 2026-02: 4,616New CVEs published per month, 2026-03: 6,234New CVEs published per month, 2026-04: 5,810New CVEs published per month, 2026-05: 6,936New CVEs published per month, 2026-06: 7,942New CVEs published per month, 2026-07: 9,770New CVEs published per month, 2026-08: 12,256New CVEs published per month, 2026-09: 14,933New CVEs published per month, 2026-10: 17,060New CVEs published per month, 2026-11: 71 (month so far)17.1K20242025Jul2026Jul
THE VULNPOCALYPSE2026-04-07: MythosMythos2026-10-21: PHP2ShellPHP2ShellNew CVEs published per month020KNew CVEs published per month, 2025-09: 4,321New CVEs published per month, 2025-10: 4,273New CVEs published per month, 2025-11: 3,021New CVEs published per month, 2025-12: 5,491New CVEs published per month, 2026-01: 4,302New CVEs published per month, 2026-02: 4,616New CVEs published per month, 2026-03: 6,234New CVEs published per month, 2026-04: 5,810New CVEs published per month, 2026-05: 6,936New CVEs published per month, 2026-06: 7,942New CVEs published per month, 2026-07: 9,770New CVEs published per month, 2026-08: 12,256New CVEs published per month, 2026-09: 14,933New CVEs published per month, 2026-10: 17,060New CVEs published per month, 2026-11: 71 (month so far)17.1K20252026Jul
Full timeline with exploitation and the word’s rise

Vulnerability pressure

All data

New bugs

CVEs published, last three months against the same months a year earlier.

362%

OF LAST YEAR DOUBLE

44,249 CVEs in Aug to Oct 2026, against 12,222 a year earlier.

Exploitation

Bugs added to CISA’s exploited list, last three months against the same months a year earlier.

177%

OF LAST YEAR UP

110 bugs in Aug to Oct 2026, against 62 a year earlier.

Zero-day exploitation

Exploited bugs listed on or before the day their CVE was published, last three months against the same months a year earlier.

220%

OF LAST YEAR DOUBLE

22 bugs in Aug to Oct 2026, against 10 a year earlier.

The score that sees attacks coming

How we tested it

VEDAS

90%

of the bugs attackers went on to use were already in the top 35% of CVEs by VEDAS, before CISA confirmed the attacks.

EPSS

53%

for the top 35% by EPSS, the industry’s standard exploit forecast. Same patching effort, 37 points fewer attacks covered.

Latest advisories

All 393

Getting more dangerous right now

All movers

Biggest rises in attack forecast since the last update (2026-11-01).

CVERiseChance of attack (EPSS)On CISA KEVDetection rule
CVE-2026-110447+0.620.73YesNone yet
CVE-2025-58434+0.260.76NoNuclei · Suricata
CVE-2026-102489+0.210.22YesNone yet
CVE-2023-31719+0.180.44NoNone yet
CVE-2021-3128+0.140.16NoNone yet

Explore

ExplainerWhat is the Vulnpocalypse?The word, the debate, and five habits for developers. Early warningWatchlistBugs with strong exploit evidence the standard forecast still rates low. ExploitedCISA KEV 2026Every bug attackers were confirmed using this year. Help wantedDetection gapsExploited bugs with no free detection rule yet.