Registered CVE vulnerabilities pass 100,000 in 2026, double last year's total

The global registry of disclosed security flaws surpassed 100,000 entries in 2026, reaching 100,222 by November 13 according to VulnCheck, and the count is still rising. That is roughly double the 49,972 recorded in 2025. Industry figures attribute much of the surge to AI-assisted vulnerability hunting, with numbering authorities such as GitHub, Microsoft, the Linux kernel and Patchstack publishing at unprecedented rates. The growing volume is also straining open-source maintainers, as the curl project changed its reporting rules after being flooded with AI-generated reports. Exploitation is also accelerating, with the average time from disclosure to exploitation falling from 120 days in 2025 to 80 days in the first half of 2026.