# 2026 CVE volume, recounted two ways

Markovian Protocol, 30 October 2026. A data note on Jerry Gamblin's 2026 CVE figures: his mid-year check-in ("CVE Mid-Year 2026 Check-In: Volume Vertical, Exploitation Rare", jerrygamblin.com, 1 July 2026) and the monthlyCVEStats README (last updated 1 October 2026).

The data supports both halves of the title. We recounted his figures two ways. The first uses his own basis: NVD records from his public mirror, counted by `published`, rejected records dropped. The second is independent: the CVE Program's cvelistV5 archive, counted by `datePublished`, rejected records dropped. The two agree with each other to within 10 for every row except October to date, and with him to within 40 everywhere except June (and so H1), where his count is short and the volume is higher than he said.

| Figure | Gamblin | NVD, his basis (read 30 Oct) | CVE List (30 Oct) |
|---|---|---|---|
| CVEs, H1 2026 | 35,364 | 35,840 | 35,849 |
| CVEs, H1 2025 | 23,656 | 23,641 | 23,642 |
| Change, H1 on H1 | +49.5% | +51.6% | +51.6% |
| June 2026 | 7,454 | 7,942 | 7,949 |
| September 2026 | 14,943 | 14,933 | 14,934 |
| 2026 through September | 72,812 | 72,800 | 72,801 |
| All of 2025 | — | 48,151 | 48,151 |
| Day 2026 passed all of 2025 | "around August 17" (projected 27 July) | 10 August | 10 August |
| H1 2026 CVEs on CISA KEV | 85 (0.24%) | 86 added by 1 July (0.24%); 109 now (0.30%) | same |
| KEV entries added, H1 2026 / H1 2025 | 146 / 132 | 146 / 132 | — |
| KEV entries added H1 2026, known ransomware use | 17 | 21 now | — |

- **Volume: supported, and slightly understated.** The one real gap is June: 7,942 on his own basis today against 7,454 in the check-in, which is most of the 476 by which H1 is short. NVD stamps 435 records at 23:00 UTC on 30 June, a single batch. We can't tell from outside whether it missed his 1 July snapshot. Recounted, H1 grew 51.6%, not 49.5%. October has 16,316 by the 30th, already the biggest month on record.
- **Worth knowing before someone recounts:** the small differences elsewhere (−15 on H1 2025, −10 on September) are most likely records rejected after he counted. Anyone recounting later will get slightly different numbers. Stating the read date beside each figure closes that off.
- **Exploitation: supported.** 86 of the H1 2026 CVEs were on KEV by 1 July (0.24%, his 85 within one), and 109 are now (0.30%). Still rare. The ransomware count has since moved from 17 to 21; CISA can mark ransomware use after an entry is added.
- **The crossover came a week early.** The README, as of 27 July, projected 2026 would pass all of 2025 around 17 August; it did so on 10 August.

What we did not check: CVSS, CWE, CNA and vendor breakdowns; the NVD mirror's own freshness against NVD's API.

Sources: J. Gamblin, "CVE Mid-Year 2026 Check-In: Volume Vertical, Exploitation Rare", 1 July 2026; jgamblin/monthlyCVEStats README (commit 7c2b9e2, 1 October 2026); NVD records from nvd.handsonhacking.org/nvd.jsonl (read 30 October 2026, 416,844 records); CVEProject/cvelistV5 release cve_2026-10-30_0300Z; CISA KEV catalog version 2026.10.29 (github.com/cisagov/kev-data). The counting script (gamblin_count.py), its output (counts.json) and checksums of every input are in the folder beside this note (cve-volume-2026-10-30/).

Part of the [recounts](https://markovianprotocol.com/measurements/recounts.html#gamblin): this number, recounted each time it is published.