CVE & CVSS

Two systems, doing different jobs

The CVE answers which one are we talking about. The CVSS answers how bad is it. A vulnerability scan, a patch ticket, a CISA Known Exploited Vulnerabilities (KEV) entry, an NVD page — each one cites the CVE and the CVSS together. Learn this vocabulary once and the entire vulnerability-management ecosystem becomes readable.

How we got here

Before 1999, every security vendor had its own internal name for the same bug. A flaw in BIND would be tracked as ISS-4023, BugTraq #1234, Symantec ID 7717, and ASB-99-19 simultaneously — with no reliable way to know they were the same issue. David E. Mann and Steven M. Christey of MITRE proposed a shared, public, neutrally-named index. The first CVE list was released in September 1999 with 321 entries.

How CVSS actually works

CVSS v4.0 organizes a vulnerability's characteristics into four metric groups. Most published scores are Base scores only — the intrinsic properties that don't change between organizations.

• Base — Attack Vector, Attack Complexity, Privileges Required, User Interaction, Scope, and impacts on Confidentiality / Integrity / Availability. The number you usually see.
• Threat (replaced v3.x “Temporal”) — current state of exploit code, patch availability, real-world exploitation maturity.
• Environmental — per-organization adjustments: how important is the affected system to you?
• Supplemental — descriptive metadata (Safety, Automatable, Recovery, etc.). Informational, doesn't change the score.

The severity bands

Try the Base calculator

Adjust the metrics; watch the score and vector string update.

The numbers, 1999 to 2025

Every bar is one calendar year's published CVE total. Hover any bar for the count. Two visible inflections explain most of what you see: NVD methodology changes in 2017, and the Linux Kernel becoming a CVE Numbering Authority in February 2024.

Three things to notice. First, the long climb from a few hundred per year through the mid-2010s reflects the steady professionalization of vulnerability research: more researchers, more bug-bounty programs, more CNAs. Second, the 2017 jump is largely a counting change — NVD started recording vulnerabilities it had previously rolled together. Third, the 2024 jump (+38% year over year) is mostly the Linux Kernel becoming a CNA in February 2024, suddenly publishing CVEs for issues that had previously stayed inside kernel commit messages.

The last six months in detail

December 2025 through May 2026 — the window that ends today. Monthly bars on the same chart would be invisible at this zoom; here they are on their own scale.

FIRST's 2026 forecast median is ~59,427 CVEs for the full year, with a 90% confidence band running from 30,000 to 117,000. The wide band is the key tell: forecasters openly cannot pin down the upper end, because the supply of disclosed vulnerabilities is no longer rate-limited by the number of human researchers in the world.

The Mythos inflection

The CVE program has spent a quarter of a century learning to absorb roughly the output of every security researcher in the world. The defining number above is not "thousands of zero-days." It is "one model, one exercise." Multiply by the number of well-funded research groups, security vendors, nation-state programs, and ordinary criminal enterprises who will rent equivalent capability when it ships, and the disclosure pipeline that produced 48,000 CVEs in 2025 begins to look like a footpath where a highway is needed.

Projecting the load

This isn't a forecast — it's an order-of-magnitude sanity check. Pick how many Mythos-equivalent systems are in operation, how productive each one is in zero-days per day, and how much of that output gets responsibly disclosed (rather than weaponized or hoarded). The output is what the CVE pipeline would have to absorb annually.

Default values (50 systems, 3 zero-days/system/day, 30% disclosed) already produce a number well above today's annual total. The point of this slider is not the precise output; it is that very ordinary assumptions about adoption produce CVE volumes the current system cannot triage, score, distribute, or patch on its existing cadence.

What breaks first

• NVD enrichment. Every CVE published needs a CVSS score, a CPE (affected-product) entry, references, and a CWE classification. NIST's National Vulnerability Database already entered a backlog in early 2024; quintupling input breaks this layer first.
• Patch supply chain. Vendors must read the disclosure, build a fix, test it, release it, and get it deployed. The current rate of patching already lags publication; the gap will widen.
• CVSS as a triage signal. When 60% of a year's CVEs are Critical, "Critical" stops being useful as a prioritization signal. The EPSS (Exploit Prediction Scoring System) and CISA KEV catalog already exist precisely because CVSS-Critical alone became too broad. Both will need to scale or be replaced.
• Human attention. A SOC analyst, a developer, a sysadmin can only context-switch so many times in a day. The bottleneck after a certain volume is not detection but human bandwidth.

What to know walking out of this page

• A CVE ID is just a name; it carries no severity by itself. CVE-2024-3094 tells you which bug; you still have to look up how bad.
• A CVSS score is a Base Score unless explicitly stated otherwise. It is one organization's analyst opinion of intrinsic severity, not an exploitability prediction. Always read the vector string — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H — not just the number.
• The severity bands are None / Low / Medium / High / Critical. Critical means ≥ 9.0.
• Look at the CISA KEV catalog alongside the CVSS score. KEV listings are vulnerabilities under active exploitation. A CVSS 5.6 on the KEV list is a worse problem this week than a CVSS 9.8 that no attacker has bothered with.
• 2026 will publish more CVEs than every year before 2018 combined. The volume is the story.

Further reading

• cve.org — The official program. Browse, search, and check CNA assignments.
• nvd.nist.gov — NIST's National Vulnerability Database. Where the CVSS scores and CPEs get added.
• FIRST CVSS v4.0 specification — the authoritative scoring rules.
• CISA Known Exploited Vulnerabilities Catalog (KEV) — vulnerabilities under active exploitation; required patching for U.S. federal agencies.
• EPSS — Exploit Prediction Scoring System. Probability-of-exploitation companion to CVSS.

References

Every figure on this page traces back to the following publications. Where two sources gave slightly different totals (common for early CVE years), the NVD-published number was used.

Formatted in APA 7 and grouped by topic. Pattern: Author(s). (Year). Title. Publisher. URL. Within each group, entries are alphabetized by first author's last name.

CVE counts and trends

1. CVE Program. (n.d.). Metrics. https://www.cve.org/About/Metrics
2. Gamblin, J. (n.d.). CVE year analysis. CVE.ICU. https://cve.icu/years.html
3. Gamblin, J. (2026, January 1). 2025 CVE data review. https://jerrygamblin.com/2026/01/01/2025-cve-data-review/
4. Infosecurity Magazine. (2026). FIRST forecasts record-breaking 50,000+ CVEs in 2026. https://www.infosecurity-magazine.com/news/first-forecasts-record-50000-cve/
5. National Institute of Standards and Technology. (n.d.). NVD dashboard. National Vulnerability Database. https://nvd.nist.gov/general/nvd-dashboard
6. Stingrai. (2026). Vulnerability statistics 2026. https://www.stingrai.io/blog/vulnerability-statistics-2026

CVSS framework

1. Forum of Incident Response and Security Teams. (n.d.-a). Common Vulnerability Scoring System version 3.1 specification document. https://www.first.org/cvss/v3.1/specification-document
2. Forum of Incident Response and Security Teams. (n.d.-b). Common Vulnerability Scoring System version 4.0 specification document. https://www.first.org/cvss/specification-document
3. National Institute of Standards and Technology. (n.d.). Vulnerability metrics (CVSS). National Vulnerability Database. https://nvd.nist.gov/vuln-metrics/cvss

The Mythos disclosure

1. Bain & Company. (2026). Claude Mythos and the AI cybersecurity wake-up call. https://www.bain.com/insights/claude-mythos-and-ai-cybersecurity-wake-up-call/
2. Cloud Security Alliance. (n.d.). AI vulnerability discovery and containment failures: Claude Mythos. CSA Labs. https://labs.cloudsecurityalliance.org/research/ai-vuln-discovery-containment-claude-mythos-v1-0-csa-styled/
3. Contrast Security. (n.d.). What is Mythos AI? Autonomous exploits and AppSec defense. https://www.contrastsecurity.com/glossary/mythos-ai
4. Data Protection Report. (2026, May). When AI becomes the cyber attacker: Mythos and what comes next. https://www.dataprotectionreport.com/2026/05/when-ai-becomes-the-cyber-attacker-mythos-and-what-comes-next/
5. The Conversation. (2026). Mythos AI is a cybersecurity threat, but it doesn't rewrite the rules of the game. https://theconversation.com/mythos-ai-is-a-cybersecurity-threat-but-it-doesnt-rewrite-the-rules-of-the-game-281268