Latest month report · in progress
July 2026
in numbers
Where the vulnerability world moved this month. Headline volume, criticals, KEV velocity and a 12-month sparkline.
Open full report →Projected total
0
-100.0% YoY · proj
Critical
0
0.0% of total · so far
KEV added
0
CISA known exploited
vs last month
-100.0%
projected MoM
Last 12 months · volume
projected — month still in progress
Data as of Jul 3, 2026, 05:44 UTCSnapshot v1 Sources CVEList V5+NVD+GHSA+CSAF+FSTEC BDU+CISA KEV+EPSS+Nuclei templates Methodology →
from Jul 23avg ≈ 18.5 / mo
Cover story · KEV velocity
Active exploitation,
month by month.
CISA-confirmed 667 CVEs moved into active exploitation across the visible window.
The peak month was Mar 25 with 32 additions.
Last 3 months are +6% vs the prior 3.
Previous report
What June 2026 is remembered for
Highlights from the last completed month. Click any tile to open the full report.
Top vendor
google
1,094 CVEs
chrome (965) · android (119) · google chrome (43)
×17.1KEV 2
Biggest breakout
google
×17.1 vs 12-mo median
1,094 CVEs this period
Top weakness
XSS
655 CVEs · CWE-79
KEV velocity
23 new
2 ransomware-linked
Detection speed
5.8 days
median to Nuclei template
61% within 7 days
First in top-100
capgo
#13 · 61 CVEs
never in top-100 in prior 24 months
First-time on leaderboard
New names in June 2026
Never seen in top-100 for the prior 24 months. Often soft targets — security maturity hasn't caught up to attention.
Detection gap
KEV pressure, no Nuclei coverage
June 2026 · vendors with active exploitation listed by CISA but no public detection template.
- KEV 2google1,094 CVE
Hot quarter
Biggest growth in 3 months
May 26 → Jul 26 vs prior 3
google
×4.1
1,474 recentvs 360 prior+1,114
×4.1
linux
×2.0
1,542 recentvs 777 prior+765
oracle
×2.7
275 recentvs 102 prior+173
microsoft
×1.3
543 recentvs 408 prior+135
сообщество свободного программного обеспечения
×1.4
321 recentvs 230 prior+91
ооо «русбитех-астра»
×84.0
84 recentvs 0 prior+84
×84.0
apache software foundation
×1.6
208 recentvs 131 prior+77
open-webui
×76.0
76 recentvs 0 prior+76
×76.0
openwebui
×75.0
75 recentvs 0 prior+75
×75.0
edimax
×9.1
73 recentvs 8 prior+65
×9.1
capgo
×61.0
61 recentvs 0 prior+61
×61.0
apache
×1.4
174 recentvs 124 prior+50
Vendor leaderboard
Most CVEs · last 12 months
- 5,298 CVE117 crit1 KEVpeak #1KEV 1PoC 13
- 2,737 CVE107 crit7 KEV34 Nucleipeak #1KEV 7Nuclei 34PoC 105
- 2,343 CVE117 crit14 KEVpeak #1KEV 14PoC 15
- 4npm1,753 CVE139 crit3 KEV28 Nucleipeak #1KEV 3Nuclei 28PoC 145
- 1,682 CVE110 crit27 KEV1 Nucleipeak #3KEV 27Nuclei 1PoC 22
- 1,525 CVE26 crit1 KEV4 Nucleipeak #3KEV 1Nuclei 4PoC 42
- 1,060 CVE32 crit5 KEV3 Nucleipeak #2KEV 5Nuclei 3PoC 71
- 8go848 CVE82 crit1 KEV12 Nucleipeak #3KEV 1Nuclei 12PoC 74
- 9pypi835 CVE67 crit1 KEV12 Nucleipeak #4KEV 1Nuclei 12PoC 77
- 813 CVE39 crit5 KEV6 Nucleipeak #2KEV 5Nuclei 6PoC 95
- 801 CVE20 crit1 KEVpeak #4KEV 1PoC 19
- 12adobe710 CVE31 crit3 KEV3 Nucleipeak #5KEV 3Nuclei 3PoC 1
- 13ао «ивк»662 CVE38 crit1 KEV1 Nucleipeak #5KEV 1Nuclei 1PoC 44
- 14apple625 CVE14 crit7 KEVpeak #4KEV 7PoC 3
- 594 CVE35 crit1 KEV9 Nucleipeak #5KEV 1Nuclei 9PoC 122
- 16openclaw544 CVE30 critpeak #2PoC 2
- 534 CVE1 critpeak #8PoC 336
- 18tenda533 CVE48 critpeak #9PoC 238
- 19ibm527 CVE32 critpeak #8
- 20oracle521 CVE144 crit4 KEV4 Nucleipeak #4KEV 4Nuclei 4PoC 4
| # | Vendor | CVEs | Crit | KEV | Nuclei | Peak | Signals | |
|---|---|---|---|---|---|---|---|---|
| 1 | linux | 5,298 | 117 | 1 | · | #1 | KEV 1PoC 13 | |
| 2 | сообщество свободного программного обеспечения | 2,737 | 107 | 7 | 34 | #1 | KEV 7Nuclei 34PoC 105 | |
| 3 | 2,343 | 117 | 14 | · | #1 | KEV 14PoC 15 | ||
| 4 | npm | 1,753 | 139 | 3 | 28 | #1 | KEV 3Nuclei 28PoC 145 | |
| 5 | microsoft | 1,682 | 110 | 27 | 1 | #3 | KEV 27Nuclei 1PoC 22 | |
| 6 | redhat | 1,525 | 26 | 1 | 4 | #3 | KEV 1Nuclei 4PoC 42 | |
| 7 | ооо «русбитех-астра» | 1,060 | 32 | 5 | 3 | #2 | KEV 5Nuclei 3PoC 71 | |
| 8 | go | 848 | 82 | 1 | 12 | #3 | KEV 1Nuclei 12PoC 74 | |
| 9 | pypi | 835 | 67 | 1 | 12 | #4 | KEV 1Nuclei 12PoC 77 | |
| 10 | ооо «ред софт» | 813 | 39 | 5 | 6 | #2 | KEV 5Nuclei 6PoC 95 | |
| 11 | canonical | 801 | 20 | 1 | · | #4 | KEV 1PoC 19 | |
| 12 | adobe | 710 | 31 | 3 | 3 | #5 | KEV 3Nuclei 3PoC 1 | |
| 13 | ао «ивк» | 662 | 38 | 1 | 1 | #5 | KEV 1Nuclei 1PoC 44 | |
| 14 | apple | 625 | 14 | 7 | · | #4 | KEV 7PoC 3 | |
| 15 | packagist | 594 | 35 | 1 | 9 | #5 | KEV 1Nuclei 9PoC 122 | |
| 16 | openclaw | 544 | 30 | · | · | #2 | PoC 2 | |
| 17 | code-projects | 534 | 1 | · | · | #8 | PoC 336 | |
| 18 | tenda | 533 | 48 | · | · | #9 | PoC 238 | |
| 19 | ibm | 527 | 32 | · | · | #8 | ||
| 20 | oracle | 521 | 144 | 4 | 4 | #4 | KEV 4Nuclei 4PoC 4 |
Earlier reports
May 2026
7,365
+68.9% YoY
642 critical21 KEV
April 2026
6,440
— YoY
607 critical31 KEV
March 2026
6,821
— YoY
685 critical26 KEV
February 2026
4,931
— YoY
495 critical28 KEV
January 2026
5,244
— YoY
437 critical17 KEV
December 2025
5,771
— YoY
396 critical20 KEV
November 2025
3,194
— YoY
269 critical11 KEV
October 2025
4,544
— YoY
288 critical31 KEV
September 2025
4,664
— YoY
278 critical16 KEV
August 2025
3,871
+28.0% YoY
343 critical15 KEV
July 2025
4,086
+25.8% YoY
368 critical20 KEV
June 2025
3,875
+16.3% YoY
293 critical20 KEV
May 2025
4,361
-19.5% YoY
376 critical24 KEV
April 2025
4,282
+13.6% YoY
330 critical15 KEV
March 2025
4,251
+26.0% YoY
420 critical32 KEV
February 2025
3,940
+32.1% YoY
253 critical27 KEV
January 2025
4,463
+65.4% YoY
358 critical14 KEV
December 2024
3,514
+26.9% YoY
316 critical16 KEV
November 2024
4,154
+62.3% YoY
348 critical22 KEV
October 2024
3,667
+32.7% YoY
364 critical17 KEV
September 2024
2,594
-9.4% YoY
241 critical25 KEV
August 2024
3,024
— YoY
331 critical19 KEV