Q2 2026 closed with 18,400 new CVEs assigned to vulnerabilities disclosed in the quarter. The number sits up 22 percent year over year. The number that matters, the count of vulnerabilities that the typical enterprise actually needs to patch, is different. And the gap between the two numbers is the story of the quarter. Here is what is in the CVE database, what is not, and what the defender should actually be doing about it.
What is in the CVE database
Three categories, in roughly that order of volume. The first category serves as web application CVE. The XSS, the SQL injection, the SSRF, the path traversal, the authentication bypass in the third party web app that the enterprise has deployed. The volume of web application CVEs continues to climb because the volume of web applications continues to climb. The second category is the dependency CVE. The transitive dependency in the npm package that pulls in a vulnerable version of a parser. The transitive dependency in the Docker image that has not been updated since 2024. The volume of dependency CVEs has exploded because the software supply chain has exploded. The third category is the operating system and platform CVE. The Windows CVE, the Linux kernel CVE, the container runtime CVE. The volume of these has flattened. The flatness reflects the maturity of the patch process for the OS layer.
What is not in the CVE database
Three categories, in roughly that order of operational impact. The first category serves as misconfiguration. The S3 bucket that is public, the identity role that is over privileged, the network security group that allows the world. The misconfiguration does not get a CVE. The misconfiguration gets a breach. The misconfiguration is, in aggregate, the larger source of cloud incidents than the CVE. The second category is the compromised credential. The stolen password, the leaked API key, the harvested session token. The credential compromise does not get a CVE. The credential compromise gets a breach. The credential compromise is, in aggregate, the largest source of incidents across the security industry. The third category is the business logic flaw. The application that processes a refund in a way that allows the customer to extract value. The workflow that lets the contractor escalate to admin. The business logic flaw does not get a CVE. The business logic flaw gets a breach, and often a lawsuit.
What the defender should actually do
Three moves, in priority order. The first is to focus the patching on the vulnerabilities that have active exploitation. The CISA KEV catalog is the single best filter. The defender who patches the KEV catalog on a weekly cadence has patched the vulnerabilities that the attacker is actually using. The defender who tries to patch all 18,400 CVEs in the quarter has, in aggregate, wasted the cycle. The second move is to invest in the misconfiguration and credential defences, because the CVE database does not capture the larger problem. The CSPM tooling, the identity threat detection, the credential rotation: these address the categories the CVE database misses. The third move is to test the business logic. The threat modelling exercise, the red team engagement, the security review of the new feature. The business logic flaw does not get a CVE, but the business logic flaw is the most expensive to discover after the breach.
The bottom line
18,400 CVEs in Q2. The number that matters sits in the KEV catalog. The number that does not show up in the CVE database, the misconfigurations and the credentials and the business logic flaws, accounts for more incidents than the CVEs themselves. Patch the KEV. Defend the misconfig. Test the logic. The defender who does all three has done the actual work.
Sources & Further Reading
All claims in this article are sourced from primary documentation, vendor advisories, and reputable security researchers.
Spotted an error? Email the editor. Corrections are issued with a visible correction note.
Editorial standards. Every article on humanrequired.org is reviewed by a human editor before publication. AI may assist with drafting or research; final editorial control is human. Read the full standards.
