There were 6,420 excess CVEs recorded through April 2026, representing a 46.3% cumulative drift above the February forecast.

Over 48,000 CVEs were published globally in 2025, an 18% year-on-year increase.

Across all financial services vendors, 50.2% carry high-severity CVEs.

44.3% of critical CVEs received scanner coverage.

54.0% of CVEs published since January 2025 had no detection signature from Tenable, Qualys, or Rapid7.

83.2% of critical vulnerabilities either lacked scanner coverage entirely or had exploits appear before detection ships.

55.7% of critical CVEs never received scanner coverage at all.

62.0% of critical vulnerabilities with known exploits had a working exploit available before scanner detection signatures shipped.

66% of analyzed CVEs had minimal real-world applicability.

206 unique automotive vulnerabilities identified in Q4 2025, a 19% increase over Q3 2025

265 unique automotive-specific vulnerabilities identified in Q1 2026

28% increase in automotive vulnerabilities in Q1 2026 compared to Q4 2025

102% year-on-year increase in automotive vulnerabilities (Q1 2026 vs Q1 2025)

Over 48,000 new CVEs were disclosed in 2025, a 20% year-over-year increase.

23% of CVEs directly impact network devices like VPN appliances, next-generation firewalls (NGFWs), load balancers, routers, and others.

VPN Common Vulnerabilities and Exposures (CVEs) grow 82.5% over the analyzed period.

Wireless CVEs increased from 4 reported CVEs in 2010 to 937 in 2025.

Of the 65 CVEs discussed by the BlackBasta ransomware group, 54 are Known Exploited Vulnerabilities (KEVs).

71% of critical vulnerability alerts in Q3 2025 originated from just four legacy CVEs.

CVEs added to CISA KEV jumped 80% in H1 2025.