Vulnerability intelligence · 2026 measurement note
How many CVEs are published per hour in 2026?
The honest answer depends on what is being counted. CVE Records are published—not necessarily discovered—at a rate that now makes raw volume unusable as a priority queue.
Live NVD snapshot through September 20, 2026: 70,379 publications · 267.60 per day · 11.15 per hour · 0.186 per minute · about one every 5 minutes 23 seconds.
The defensible headline
More than eleven NVD CVE publications per hour—without pretending publication equals discovery.
Live NVD year to date
70,379 records
Measured from 2026-01-01 00:00:00 UTC through 2026-09-20 23:59:59 UTC using the official NVD CVE API 2.0 publication-date filter.
Hourly rate
11.15 per hour
That is an average across 263 complete UTC days. Publications arrive in bursts; this is not a prediction of the next hour.
Minute conversion
0.186 per minute
Another way to say it: one NVD publication every 5.38 minutes, or approximately 5 minutes 23 seconds.
Completed-quarter benchmark
The CVE Program’s reconciled metrics tell a second, equally important story.
The official CVE Program metrics page reports 15,176 published CVE Records in Q1 2026 and 20,709 in Q2. Those completed-quarter totals are a point-in-time record set and can differ from a later NVD query because records are updated, rejected, synchronized, and reconciled over time.
Q1 2026
15,176 records
168.62 per day
7.03 per hour
0.117 per minute
one every 8 minutes 32 seconds
Q2 2026
20,709 records
227.57 per day
9.48 per hour
0.158 per minute
one every 6 minutes 20 seconds
First half of 2026
35,885 records
198.26 per day
8.26 per hour
0.138 per minute
one every 7 minutes 16 seconds
What the number means
Four terms that should not be collapsed into one.
Discovery
A weakness is found. The date may remain private while a vendor validates and fixes it, and some discoveries never receive a CVE ID.
Reservation
A CVE Numbering Authority reserves an identifier. A reserved ID is not yet a published vulnerability record.
Publication
A CNA publishes a CVE Record with a description and references. The CVE year in the identifier is not a reliable discovery date.
Enrichment
NVD, vendors, CISA, and other authorized publishers may add scoring, product, exploitation, or remediation context after publication.
Operational use
Count for capacity planning. Prioritize with evidence.
Match the asset
Confirm product, version, deployment mode, component, reachability, privilege, data, and compensating controls. A matching product name is not proof of exposure.
Elevate exploitation
Use CISA’s Known Exploited Vulnerabilities catalog as an authoritative signal that exploitation has been observed. KEV inclusion is not proof that a CVE was a zero-day.
Verify closure
Record the vendor action, change ticket, deployment result, version or configuration evidence, retest, exceptions, owners, and expiration dates.
CVSS severity remains useful, but a queue ordered only by base score ignores exposure, exploitation, business impact, defensive coverage, and the certainty of the evidence.
Method and sources
A reproducible snapshot, not a permanent claim.
- Snapshot time: query responses generated 2026-09-21; reporting window ends at the last complete UTC day, 2026-09-20.
- NVD query: official CVE API 2.0, split into date ranges within the API limit and summed from
totalResults. - Completed-quarter figures: official CVE Program Metrics page, Q1 and Q2 2026.
- Interpretation: publication throughput, not the unknowable global rate of private vulnerability discovery.
NVD CVE API 2.0 documentation →
Independent use of public resources
Identification does not imply affiliation.
Kythos AI uses public CVE, NVD, CISA KEV, and MITRE ATT&CK resources for identification, research, and defensive mapping. Kythos AI is not sponsored, endorsed, certified, or affiliated with CISA, NIST, MITRE, the CVE Program, or vendors whose records appear in those sources. CVE and ATT&CK references identify community resources; they do not transfer authorization or establish product exposure.