VulNow's Q2 2026 Vulnerability Disclosure Report is out. It covers more than 320 confirmed PreCVE detections, the widening gap between vulnerability discovery and public disclosure, and why two of the three data sources the vulnerability management industry depends on have said, in public, that they can no longer keep pace.
Download Full Report (PDF, 418 KB)
The headline finding
Of the 328 confirmed findings in this quarter's snapshot, 117 (35.6%) resolved to a GitHub Security Advisory with no CVE record at all. Another 15 (4.6%) went the other way: a CVE with no GHSA. Only 196 (59.8%) landed in both databases. For a security program keyed to CVE feeds alone, more than a third of this quarter's confirmed vulnerabilities simply don't exist — not delayed, absent.
Two of the three data sources the vulnerability management industry is built on have publicly stated that they cannot process the current volume. The third, the maintainers themselves, never agreed to be a data source in the first place.
2026: disclosure infrastructure hit its ceiling
In May 2026 the GitHub Advisory Database published 1,560 reviewed advisories in a single month, more than five times its typical output and the highest total in its history. It still wasn't enough: private vulnerability reports rose from roughly 550 to more than 3,000 per week between January and May, and publication times stretched from days to multiple weeks for a meaningful share of advisories.
On 15 April 2026, NIST changed how the National Vulnerability Database operates. Enrichment is no longer universal — the NVD now prioritizes CVEs in CISA's Known Exploited Vulnerabilities catalog, CVEs affecting U.S. federal government software, and CVEs affecting critical software under Executive Order 14028. Everything else, including roughly 29,000 previously unenriched CVE records, was moved to a "not scheduled" backlog. A growing share of CVE records now arrive with no CVSS score and no affected product mapping, the exact fields most scanning tools match against.
The pressure runs upstream too. The curl project ended its bug bounty program in January 2026 over the cost of triaging AI-generated submissions. HackerOne paused new submissions to the Internet Bug Bounty in March. Linus Torvalds has described the Linux kernel security mailing list as "almost entirely unmanageable."
Lead time and severity
Roughly 85% of this quarter's confirmed findings arrived more than a full day before any public advisory existed; 46% arrived more than a week ahead. The longest window remains axios, first identified 154 days and 15 hours before its advisory was published. Two thirds of the confirmed set is rated High or Critical severity — the material most likely to matter is not reliably the material that gets deprioritized when enrichment queues back up.
| Advance warning | Findings | Share |
|---|---|---|
| More than 30 days | 16 | 5% |
| 7 to 30 days | 135 | 41% |
| 1 to 7 days | 127 | 39% |
| 1 hour to 24 hours | 31 | 9% |
| Under 1 hour | 19 | 6% |
Coverage beyond JavaScript and Python
The Q1 2026 report covered 28 packages across npm and PyPI. This quarter's matched set spans 97 distinct packages across six ecosystems: npm, PyPI, Packagist, Maven, Go modules, and container images. Vulnerabilities that reach production through a dependency graph don't respect ecosystem boundaries, and neither does the disclosure backlog — this quarter's set includes findings in symfony, laravel, twig, activemq, cassandra, and jdbi3-freemarker alongside the usual npm and PyPI names.
VulNow is now a CVE Numbering Authority
In July 2026, VulNow was appointed a CVE Numbering Authority (CNA) under the ENISA CVE Root, with scope covering our own products and third-party open source vulnerabilities not already covered by another CNA. See our full press release for details.
The vulnerabilities in this report share a structural problem: they occur in projects whose maintainers aren't CNAs themselves, so the path from a quietly shipped fix to a public record runs through disclosure queues that are now several weeks deep and lengthening. The CNA appointment lets findings in VulNow's queue become advisories that anyone can act on, including organizations that will never be VulNow customers, with the assignment step built into the same process that already verifies affected versions and reproduces the flaw. The work is ahead of us rather than behind us, and we'll have more to say once there are published records to point at.
The useful question is no longer how quickly a team responds after a CVE is published. It's how much of the relevant risk ever gets a CVE at all, how long the rest waits, and whether anything in the stack is listening when it finally lands.