"Are we covered for this one?" is the first question after a CVE is assigned to the CISA KEV list. 60% of cases, there is no public rule to detect it. 329 of 554 KEV CVEs published since Aug 2023 have no open rule carrying the CVE ID. Apple has none.

A $69 badge, seven days of BSides/Black Hat/DEF CON, 10,501 radios heard. 673 open networks, and someone beaconing 77 fake APs across all 13 channels. Also: counting addresses is not counting devices. Took me four rewrites to learn that. jerrygamblin.com/2026/08/10/1...

Everyone says the security world stops for Vegas. Your CVE queue never got the memo.

July 2026 closed with 9,775 published CVEs, up from 3,776 in July 2025 (+158.9%). That puts 2026 at 45,626 CVEs year to date, +66.4% year over year, and 215 CVEs published a day so far this year. July 21 alone accounted for 1,474 of them, 1,097 of which were from Oracle.

CVSS is a severity label the industry treats like a priority list. This year 4,719 CVEs scored CVSS v3 9.0+, and half carry the identical 9.8. Only nine distinct scores exist in that band: no 9.5, no 9.7. What would your tooling sort them on?

Heading to Vegas for Summer Camp with a new title (Head of Research @ Empirical Security), a CVE panel at BSidesLV, a Black Hat luncheon, and a list of the 18 CVE/vuln/exploitation talks I would clear my calendar for across all three cons. jerrygamblin.com/2026/07/22/h...

By July 16, the 2026 CVE count hit 39,952, the entire 2024 total, with the year barely half over. Each year now clears the two-years-earlier total sooner: mid-November in 2020, mid-August in 2025, mid-July in 2026. The earliest in this series.

CISA added 154 CVEs to its Known Exploited Vulnerabilities list so far in 2026. Over half landed within a month of publication. But 16% were more than three years old when they hit the list.

The bugs you see most are not the bugs that get exploited. I mapped every CVE on CISA's list of exploited vulnerabilities to its corresponding CWE. What attackers actually use: memory corruption and injection. XSS is the most common bug on the internet, and it barely shows up.

Stop triaging by bug class. The 10 most common CWEs and their CVSS scores. But every one of the 10 has vulnerabilities in the same 6.3-7.1 band. The class does not tell you the severity.

A CVSS score is not a fact about a bug. It is an opinion with a decimal point. 13 orgs scored XSS: averages range from 3.4 to 6.7, mostly because VulDB sits at the bottom. The biggest reason is not the metric people argue about (Scope). That one call is worth ~1.4 points, double Scope.

For years, MITRE, the nonprofit that runs the CVE program, was its #1 issuer almost every month. Not anymore. GitHub has been #1 every month of 2026. MITRE has slid to about #7.

H1 2026: 35,364 CVEs. More than any full year before 2024. One every 7.4 minutes, +49.5% YoY. But only 85 (0.24%) are on CISA's KEV list so far. We're drowning in CVEs while confirmed exploitation stays rare. That gap is the whole game. Review + Code: jerrygamblin.com/2026/07/01/3...

Launching LycosAI today. The wilderness is encroaching. We are holding the line. Deploying autonomous wolf packs at prefecture scale to secure the rural perimeter where legacy systems have failed. lycosai.com

I'm bad at golf. But I'm good at data visualization. So I built this: a self-hosted @Garmin R10 analytics dashboard with club analysis, gapping tables, carry tracking, and AI coaching recommendations. All from your own data. 🔗 github.com/jgamblin/golf

April 2026 CVE Stats: 🚨 5,820 New CVEs (+44% YoY) 📊 175/day avg 📈 YTD: 20,991 (+31% YoY) 🔥 Median CVSS: 7.0 Top CWEs: 1️⃣ XSS (588) 2️⃣ Path Traversal (238) 3️⃣ Missing Auth (235) 4️⃣ SQLi (218) #InfoSec #CyberSecurity #CVE

Version 2 of my CVE Intelligence TA for Splunk is live on Splunkbase. I’ve added EPSS probability, CISA KEV status, and SSVC data to the baseline for 327k+ vulnerabilities. Zero-config and pre-joined lookups for faster triage. Full details and download: jerrygamblin.com/2026/04/18/p...

When the NVD and GitHub disagree on a CVSS score, who do you trust? I’m at #VulnCon and built Vuln Anarchy to visualize the scoring gap. This chart shows nearly 1,500 instances where the math doesn't align. Live Data: rogolabs.github.io/vuln-anarchy/ Repo: github.com/RogoLabs/vul...

Paid $25 on eBay for a 1943 cryptography book. It arrived signed by LTC George R. Eckman, the Executive Officer of the Alsos Mission, the WWII task force that hunted Nazi nuclear scientists across Europe. It's going to the U.S. Army Intelligence Hall of Fame. Some books belong in archives. 🔐

I heard you like CVEs, so I reported CVEs in your CVE filing software. I reported and fixed CVE-2026-35466 & CVE-2026-35467 in CVEClient. github.com/CERTCC/cveCl...

GitHub - CERTCC/cveClient: A client and library to cve-services 2.x to provide CVE management for CNA and CERTs

A client and library to cve-services 2.x to provide CVE management for CNA and CERTs - CERTCC/cveClient

github.com

March 2026 was a brutal month for vulnerabilities. 🛡️ Here is the damage: • 6,246 new CVEs (+55.7% Over Last March) • 169 new vulns per day 🤯 • 7.1 median CVSS severity (High) The Top 3 Culprits: 🥇 XSS (730) 🥈 SQLi (325) 🥉 Missing Auth (292) 2026 is already up 27% YoY.

The "Zero Day Clock" is a masterclass in bad data science. 📉 Ignoring right-censoring and selection bias forces a "collapse" that doesn't exist. It mistakes NVD backlog for attacker velocity. Data audit & technical receipts here: gist.github.com/jgamblin/91f... #RSAC2026 #Infosec #CyberSecurity

A Critical Audit of the "Zero Day Clock" Methodology

A Critical Audit of the "Zero Day Clock" Methodology - zeroday.md

gist.github.com

February 2026 CVE Growth Report: YTD (February): ▸ 8,932 total CVEs (+12.4% vs 2025 YTD) ▸ 151 new vulnerabilities per day ▸ +982 more CVEs than 2025 through February February alone: ▸ 4,619 CVEs (+25.7% vs February 2025)

The CVE Board January minutes read like a gossip mag for vuln geeks. Good: The March "funding cliff" is a myth. Bad: Mystery draft legislation. Drama: A Board With No Term Limits Votes For Member 23. Full gossip here: www.mail-archive.com/cve-editoria...

The @openclaw project has exploded this month. 🛡️ Since I've given it deep local access, I’m tracking its security in real-time. 📈 92 Advisories 🚨 55 High/Critical 🔄 Hourly V5 sync Link: github.com/jgamblin/Ope... Plot twist: I had OpenClaw build the tracker for me. 🤖

GitHub - jgamblin/OpenClawCVEs: Tracking OpenClaw CVEs

Tracking OpenClaw CVEs. Contribute to jgamblin/OpenClawCVEs development by creating an account on GitHub.

github.com

Vulnerability intel shouldn’t be a luxury. Next week at BSidesGalway, I’m launching VulnRadar: ✅ 100% Open Source ✅ Runs on free GitHub services ✅ NO API keys to manage Good intel is a community necessity. Let’s make it the standard. #BSidesGalway #CyberSecurity #OSS

Jan 2026 CVEs: 4,319. While +1.0% YoY looks flat, it's 139 CVEs/day—nearly 7% HIGHER than 2025's average. #cybersecurity #CVE #infosec #RogoLabs

I built Ghost CVEs this weekend to catch bugs that are public in code commits but invisible in the official registries. See what I found so far 👇 github.com/RogoLabs/Gho... #ThreatIntel #OpenSource #GhostCVEs

It’s official: 48,185 CVEs were published in 2025 (+21% YoY). 🚨 The landscape has shifted. WordPress security firms are now out-publishing Big Tech, and "Patch Tuesday" is now "Patch Every Day." See the full data review: jerrygamblin.com/2026/01/01/2...

London bound next week (Dec 7–15)! 🇬🇧 I’ll be at #BlackHatEU giving my talk on the "Post-NVD Era" (Thurs Dec 11 @ 2:30 PM) and then hitting up #BSidesLDN for the weekend. #Infosec #VulnMgmt #CVE