a poster for every month of cves
cvegen
cvegen paints every cve published in a month into one poster. calm days get slow, level strokes, busy days sweep fast.
september
2026
september 2026 brought 14,934 cves, 3.7 times an average 2025 month.
every one of its 30 days ran above the 2025 average for that weekday.
- on sep 8, the busiest day
- 1,563
- rated critical, cvss 9 or higher
- 1,479
32 already used in real attacks
cisa kev, as of oct 24
- sep 1sonicwall sma1000 appliances, two flaws
- sep 6n-able n-central
- sep 7adobe commerce and magento
- sep 8connectwise screenconnect
- sep 12gitlab community edition and enterprise edition
- sep 16cisco identity services engine
- sep 22arista velocloud orchestrator
how to read it
each poster is four layers. here they are pulled apart, the days at the bottom and the painting on top.
- 04paintingthe finished sheet, 14,934 cves in september 2026
- 03marksextra passes on the busiest days, sep 14 to 17 fold into one
- 02brushone sweep a day, longer past the 2025 weekday average
- 01daysone line per day: dim up to the 2025 average for that weekday, bright beyond it
2026, 86,403 cves so far
what this is
a cve is the public id a software flaw gets when it is disclosed. the list is open to anyone, and it keeps getting longer.
- cves a month in 2025, on average
- 4,013
- cves in september 2026, the most so far
- 14,934
every month is drawn with the same rule and the same scale, so you can put any two posters side by side and compare them. the current month keeps filling in until it closes.