Vulnerabilities went parabolic. Severity scores stopped being a plan.

Every security team knows the firehose. In 2026 it changed shape. On April 7, Anthropic announced Claude Mythos Preview and said the model had already found thousands of high-severity zero-days across every major operating system and browser, disclosed and fixed before the announcement. Nine weeks later the Forum of Incident Response and Security Teams raised its forecast for the year to roughly 66,000 CVEs, up from the 59,427 it had projected in February, and named AI-assisted discovery as the main reason. By mid-October, NVD had already published 80,985 CVEs for 2026, past that full-year forecast with ten weeks to go. Epoch AI, which tracks disclosures from the largest vendors, recorded a June total more than three times the monthly record that stood before that announcement.

Those are other people's numbers. Here are ours. We pulled every record in the National Vulnerability Database, bucketed it by the month it was published, and kept the ones rated High or Critical under the best available CVSS v3 or v4 score. No vendor filter, no sampling, nothing modeled. The method and the source files are listed at the end of this page, and the current month is left out because it is not finished.

What the chart says, and what it does not

The shape is the story. From 2022 through 2025 the industry published about 1,409 high and critical CVEs a month, with noise. The peak so far is Sep 2026: 7,807 in one month, 5.5 times that average. In Sep 2026, the latest full month, that came to roughly 257 a day, every day, before anyone reads a single one.

Three honest caveats, because this chart is easy to over-read. First, a CVE is a disclosure, not an attack; the curve measures how fast flaws are being found and written up, not how insecure any product is. Second, reporting practice moves the line: the Linux kernel became a CVE numbering authority in February 2024 and began assigning identifiers to thousands of backported fixes, and FIRST notes that CVEs from numbering authorities of last resort grew more than thirty-fold year over year. Third, NVD has not finished analyzing every record, so where NVD has no score of its own we count the one the reporting organization supplied. None of that flattens the curve. All of it argues against reading any one point as gospel.

What the chart cannot tell you is the part that matters: how many of these are being used against anyone. For that there is a second series.

CISA's Known Exploited Vulnerabilities catalog lists the flaws with evidence of active exploitation. Over the last twelve months it added 308 entries against 43,403 high and critical CVEs published, about 0.7 percent. Since January 2022, 1,419 catalog additions against 213,105 CVEs of every severity: 0.67 percent. FIRST made the same point in its June update under the headline that exploitable risk is flat even as volume climbs. Google's Threat Intelligence Group counted 90 zero-days exploited in the wild in 2025, up from 78 the year before. The exploited slice is growing. It is still a slice.

Why CVSS triage breaks at this volume

Most vulnerability programs still run on a severity score. A CVSS 9.8 opens a ticket with a short deadline; a 7.2 waits. That worked when the queue was hundreds. At 257 high and critical disclosures a day it produces a backlog nobody can clear and a false sense that the top of the list is the dangerous part. Three things are wrong with the score as a plan.

1. CVSS measures potential, not probability. It describes how bad exploitation could be in the abstract. It says nothing about whether an exploit exists, whether anyone is using it, or whether the vulnerable component is reachable on your network. The FIRST EPSS model exists precisely because the two are different questions.
2. Federal deadlines are not written in CVSS. Binding Operational Directive 22-01 requires agencies to remediate vulnerabilities on CISA's catalog by the due date CISA sets. The directive is about evidence of exploitation, not severity. A program that triages by score is optimizing for a number the directive does not use.
3. Most of the list cannot touch you. A finding on a library you do not run, a port you do not expose, or a host behind a control that already blocks the path is a line in a report, not a risk. But already blocks the path is a claim. Until someone tests it, it is a hope with a screenshot.

So the useful question for every one of those 7,807 monthly disclosures is not how bad. It is: does this touch a system we own, is anyone using it, does the control we are counting on actually hold, and can we prove all three to the person who signs the authorization? That question has a method.

The Ausper ProvenPosture™ method

ProvenPosture™ is Ausper's name for a four-move operating loop. The name is ours; the moves are public, because a defense that only works when nobody else knows it is not a defense. The loop runs continuously. Posture is something you observe, not something you attest once a year.

Then back to Map, because the graph changed while you were closing. The loop is the product. Any single move done once is a project; all four done continuously is a posture you can prove on demand, which is what authorization is turning into.

How Ausper runs it today

The method is only interesting if there is machinery behind it. There is, and it lives in Ausper Labs. Each piece covers a move of the loop; together they are the operating model we are building for mission customers.

Where it is in the field. The operating model is being built in a live enterprise ServiceNow risk and efficiency engagement, where the gap analysis is delivered and implementation is underway, and in the Next-Generation GRC prototype we demonstrate on request. We do not publish customer names or outcome figures until a customer agrees to it, and we will not invent them here. What we will say is what the method changes on day one: the answer to "what does this CVE touch?" moves from a meeting to a query; the evidence an assessor sees stops being a screenshot and becomes the pipeline's own output; and the remediation clock is set by exploitation, which is what the directive measures, not by a score, which it does not.

Why this lives in Ausper Labs

Labs is where Ausper works on what is next and turns it into things that ship: the named frameworks, AccelSecure™, AscendBridge™ and AusperRiskIQ™; the Next-Generation GRC console; the research behind pages like this one; and the emerging-technology work in photonics and quantum. ProvenPosture™ is the operating model that connects the cyber pieces. When one of them changes, the others change with it, and this page is where the evidence gets updated. See everything Labs is working on.

The data behind the charts

Both charts are built from primary sources by a script whose method is fixed and public. Every record in NVD's JSON 2.0 feeds for CVE years 2019 onward, bucketed by the month NVD published it; rejected records excluded; a record counts as High or Critical by its best available CVSS v4.0, v3.1 or v3.0 base severity, NVD's own rating when it has one and otherwise the reporting organization's; High is 7.0 to 8.9 and Critical is 9.0 to 10.0. Catalog additions are CISA's Known Exploited Vulnerabilities entries by the date CISA added them. Data refreshed 2026-10-19; the current month is omitted as incomplete.

Common questions

Sources

Primary sources where they exist, dated. We cite the data we charted and the announcements we quoted, not commentary about them.

1. National Institute of Standards and Technology, National Vulnerability Database, JSON 2.0 data feeds and CVSS severity ratings.
2. Cybersecurity and Infrastructure Security Agency, Known Exploited Vulnerabilities Catalog, and Binding Operational Directive 22-01.
3. Forum of Incident Response and Security Teams, 2026 Vulnerability Forecast update, June 15, 2026, and the Exploit Prediction Scoring System.
4. Epoch AI, Cyber Vulnerabilities data explorer, CVEs from major vendors by severity and publication month.
5. Google Threat Intelligence Group, 2025 zero-day exploitation review.
6. Cloud Security Alliance, research note on the economics of autonomous vulnerability discovery.
7. Anthropic, Project Glasswing, announcing Claude Mythos Preview, April 7, 2026.

Related reading