Every January since 2023 I have published an analysis of the previous year in CVE: how many were published, by whom, scored how, and what moved against the year before.
Each one ships with its dataset and the code that produced it, so you can check the numbers instead of taking them from me.
The dashboards these are built on are on the tools page.
Annual CVE data reviews
- 2025 CVE Data Review (January 2026)
- 2024 CVE Data Review (January 2025)
- 2023 CVE Data Review (January 2024)
- 2022 CVE Data Review (January 2023)
Mid-year and one-offs
Shorter pieces, usually because something in the data moved and would not keep until January.
- CVE Mid-Year 2026 Check-In: Volume Vertical, Exploitation Rare (July 2026)
- A New Era of Transparency for CVE Data Quality (August 2025)
- Celebrating 25 Years of CVEs (October 2024)
- 2023 First Half CVE Data Review (July 2023)
Where it started
The questions that turned into the tools.
- Prioritizing What Matters: Bringing CVE Intelligence to Splunk (April 2026)
- Who Is Going To Enrich CVEs? (May 2024)
- Predicting CVEs in 2024 (January 2024)
- CVE Reference Rot (April 2023)
- Introducing CVE.ICU (December 2021)
- What Day Had The Most CVEs Published? (December 2020)
- CVE Stuffing (December 2020)