Standard
Global standard for cataloging cybersecurity vulnerabilities, assigning unique CVE IDs through CNAs and enriched by Authorized Data Publishers.
VulnCheck counted Chrome CVEs up 563% and GitHub-issued CVEs up 476% year to date in a May 14, 2026 post. It calls the rise consistent with AI-assisted bug finding, but whether the volume lasts is unknown, so exploitation data still sets patch order.
Reality
In a post on aminrj.com, an OWASP working-group member says CVEs fit only two of six places where AI agent and MCP flaws live. Over-broad permissions, shared service accounts and confused-deputy designs sit in the other four, where a scanner has nothing to flag.
Reality
vLLM published more than 30 security advisories on GitHub between 12 September and 9 October, most without a CVE ID, a dev.to author reports. The author's five OSV.dev lookups came back empty, so a clean scanner run says little about any server below 0.31.0.
Reality
CISA has rewired the Known Exploited Vulnerabilities catalog to a binding directive issued June 10, 2026. The inclusion criteria are unchanged; the deadlines and the paperwork copying them are not.
Reality
Disclosure volume is climbing faster than the process around it. CISA's answer is a framework that describes what a good CVE record is and how the program should be judged on producing one.
Perspective Coverage
3 publishersReality
Chainguard says its Athena coalition will start releasing about 50 findings on September 28, with affected version ranges attached. A scanner needs those ranges before it can flag a pinned old release.
Reality
The directive issued June 10, 2026 keeps the KEV catalog's three inclusion criteria and folds federal remediation deadlines into a wider patching timeline. Any policy that cites BOD 22-01 now names a superseded authority.
Reality
cPanel says every supported build of cPanel and WHM is affected by CVE-2026-67401, and its September 8 advisory arrived without a severity score or any interim step for hosts that cannot take the upgrade yet.
Reality
cPanel shipped fixes for CVE-2026-65643 on August 27 across four build branches. Administrators checking their own build get no CVSS score, no published CVE record and nothing to grep for prior abuse.
Reality
Kaspersky's Q2 2026 figures credit AI with both writing the bugs and finding them. The disclosures carrying working exploit code never got a CVE identifier at all.
Reality
Ten drops since April 2026, the latest handing any local user SYSTEM on fully patched Windows 11. The next scheduled fix can be 28 days out, so mitigation has to be a day-one job.
Reality
V-etalon has no release date, no repository, and no published evaluation. Teams still treating NVD enrichment as authoritative should line up a second source now.
Reality