CVE annual publication aggregate and latest published records

Source: CVE Program, https://github.com/CVEProject/cvelistV5
Official terms: https://www.cve.org/legal/termsofuse
Copyright © 1999-2026, The MITRE Corporation. CVE is a trademark.

CVE Usage license (retained from the official Terms of Use):

MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge,
royalty-free, irrevocable copyright license to reproduce, prepare derivative
works of, publicly display, publicly perform, sublicense, and distribute Common
Vulnerabilities and Exposures (CVE™). Any copy you make for such purposes is
authorized provided that you reproduce MITRE's copyright designation and this
license in any such copy.

Official disclaimer:

ALL DOCUMENTS AND THE INFORMATION CONTAINED THEREIN PROVIDED BY MITRE ARE
PROVIDED ON AN "AS IS" BASIS AND THE CONTRIBUTOR, THE ORGANIZATION HE/SHE
REPRESENTS OR IS SPONSORED BY (IF ANY), THE MITRE CORPORATION, ITS BOARD OF
TRUSTEES, OFFICERS, AGENTS, AND EMPLOYEES, DISCLAIM ALL WARRANTIES, EXPRESS OR
IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE
INFORMATION THEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF
MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE.

Methodology for cve-trends.json:

Count unique cveMetadata.cveId values in PUBLISHED state in the named official
baseline release, grouped by the UTC year of cveMetadata.datePublished. Legacy
timezone-less timestamps mean UTC. REJECTED records are excluded. Publications
at or after publicationCutoffExclusive are excluded, including records present
in a baseline whose publication dates follow the advertised midnight cutoff.
The unfinished cutoff year is partial. Counts are not extrapolated.

The same snapshot also includes up to 12 latest PUBLISHED records before that
exclusive cutoff. Entries are sorted by publication instant, newest first,
then by ascending ASCII CVE ID for ties. Each entry contains only its CVE ID,
normalized UTC publication timestamp, exact official CVE.org record link and
up to two concise product labels from the CNA affected vendor/product fields.
Unknown, n/a, unsafe or overlong labels are omitted; labels can be empty.
These entries do not assert severity, active exploitation, root cause or a fix.

States are those in the retrieved release, not a reconstruction of historical
state at midnight. Later rejections and corrected publication dates can revise
past totals. Publication volume also reflects coverage and reporting practices;
it is not a direct measure of risk to any individual product.

The JSON records its exact release, download URL, computed SHA-256, release
publication timestamp, generation timestamp and exclusive publication cutoff.
The refresh command checks the GitHub asset's official SHA-256 when provided.
No raw CVE archive or full individual vulnerability record is redistributed
here. The aggregate and bounded record metadata are one atomic publication.
Generation alone is not a new source; rollback and same-release conflicts
fail closed, and a failed refresh retains the last verified snapshot.
Retain this notice with copies of this derived snapshot.