The GoodTech Telnet Server Buffer Overflow vulnerability generated 42.2 million detection events in the financial services industry in the first half of 2026.

81% of organizations using AI packages have at least one known vulnerability, up from 62% in 2024.

Log4Shell generated 35.6 million detection events in the first half of 2026 in the financial services industry, more than two years after disclosure.

Vulnerabilities account for 56.4% of critical exposures in Government.

42.6% of all critical exposures are vulnerabilities, more than double the 18.7% recorded the year before.

Vulnerabilities account for 78.2% of critical exposures in Utilities.

60% of healthcare leaders have self-attested to HIPAA compliance despite known, unpatched vulnerabilities.

79% are concerned about missing vulnerabilities introduced between scheduled tests

Actual CVE disclosures are running 46.3% above projections published four months earlier.

There were 6,420 excess CVEs recorded through April 2026, representing a 46.3% cumulative drift above the February forecast.

GitHub Security Advisory (GHSA) volume increased 449% year-over-year.

The 2026 projected total of CVE disclosures is approximately 66,000, up from a February median projection of 59,427.

Annual vulnerability disclosures are on pace to approach 70,000 for the first time in history.

Mozilla CNA Q1 CVE disclosures spiked 164% due to AI-assisted tooling against the Firefox engine.

VulnCheck CNA-of-Last-Resort activity increased 3,119%.

Over 48,000 CVEs were published globally in 2025, an 18% year-on-year increase.

Three of four Chinese LLMs generate hidden security vulnerabilities when prompted with a U.S. government persona.

From 2024 to 2025, the number of critical vulnerabilities carried across vendors serving the financial sector increased 387%.

Among the 140 vendors whose client base is meaningfully concentrated in finance, critical vulnerabilities increased 181%.

9% of Nordic CISOs cited vulnerabilities as their primary concern.