Inside the Advisory Database and what happens when vulnerability volume breaks records
GitHub says record vulnerability volume — 1,560 reviewed advisories published in May 2026 — has stretched advisory review times to weeks, urging better report quality.
GitHub's Advisory Database published 1,560 reviewed advisories in May 2026, more than five times typical monthly output, while private vulnerability reports grew from roughly 550/week in January to over 3,000/week. Repository advisories scaled from about 650/week to more than 5,000/week, GitHub CNA CVE requests reached almost 4,000 in May (nearly 10x year-over-year), and the CVE program has published over 30,000 CVEs in 2026. Since mid-April, publication times have stretched to multiple weeks for a meaningful share of advisories, which can widen exposure windows. GitHub asks reporters to submit complete vulnerability data, coordinate with maintainers, and request CVEs only with intent to publish.
- May 2026 saw 1,560 reviewed advisories, five times typical output
- Private vulnerability reports rose from ~550/week to over 3,000/week
- Publication delays since mid-April may increase exposure windows
- CVE assignment rate held at 91-94 percent; advisory quality unchanged
- Over 1.7 million repositories have private vulnerability reporting enabled
From the original article
10 min read at github.blog
The GitHub Advisory Database is processing more vulnerability reports than ever before. Here’s what’s driving the surge, how we’re responding, and how the community can help. In May 2026, the GitHub Advisory Database published 1,560 reviewed advisories —more than five times our typical monthly output and the highest in its history.
By github.blog via ni5arga · github.blog
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.