78,713 CVE-2026 records, searchable in one list

CVE-2026 records by the month each record was published. October 2026 is still in progress. Each page lists its records and the share that carry a detection signal, exploit code or an actionable vendor fix.

Vendor names lead to their pages on cve-security.com, which cover CVEs from every year.

Records

Each row is a CVE-2026 identifier with a published record in the cve-security.com dataset, which reads the CVE Program's records and NVD. The 1,024 identifiers the CVE Program has rejected stay off the list; opening one on cve-security.com shows the rejection.

CVSS

The score is the primary CVSS assessment cve-security.com shows for the CVE. Beneath it sit the scorer (NVD, the CVE Numbering Authority that published the record, or CISA's Authorized Data Publisher enrichment) and the CVSS version. A record without an assessment shows no score.

EPSS

The estimate FIRST.org publishes of the probability that exploitation activity against the CVE is observed in the next 30 days, refreshed daily.

Exploitation

KEV marks a CVE that CISA lists as confirmed exploited. Reported exploited marks a CVE that another tracker reports as exploited while it remains outside CISA KEV, as KEV Watch™ lists it; the CVE page names the tracker and links its report.

Detection

A detection signal is public detection content this dataset holds: a Nuclei template, a Metasploit check module, an Emerging Threats rule or a Snort rule that works over the network. It says the content exists, and a given product or environment may still miss the exploitation.

Exploit code

A Metasploit exploit module, an Exploit-DB entry or a public proof-of-concept repository that this dataset holds. Exploit code shows that an attack can be built and reports no attack on its own.

Vendor fix

An actionable vendor fix is a fixed version or a vendor advisory this dataset holds. The remediation panel on the CVE page says which affected products it covers.

Rankings

The KEV vendor list counts the vendor label CISA gives each KEV entry. The record list counts the vendors named in each record's product data, and the weakness table the CWE classes each record names. Each figure comes from one of these sources, and no figure adds them together.

Data access

Each record's full detail is in the API and nightly download on cve-security.com, which take a free key.

Freshness

The list rebuilds each night from the cve-security.com dataset, which refreshes hourly, so the CVE page carries the current record.