Of the 23,934 non-rejected CVEs published between 1 September and 16 October 2026, 7,467 (31.2%) carry a CVSS 4.0 score in the NVD API. 14,821 have only CVSS 3.x, 1,892 have only 4.0, and 1,646 have neither. If your tooling reads one version of the score, you are working from part of the data.
How we counted
NVD CVE API 2.0, filtered by publication date, downloaded 18 October 2026 (24,141 records, 207 rejected). A CVE counts as "v4" if its metrics object has a cvssMetricV40 entry. CNA names come from the NVD source API.
curl -sS "https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-09-01T00:00:00.000Z&pubEndDate=2026-10-16T23:59:59.999Z&resultsPerPage=2000&startIndex=0"
# repeat with startIndex=2000, 4000 ... and sleep between calls
curl -sS "https://services.nvd.nist.gov/rest/json/source/2.0?resultsPerPage=1000&startIndex=0"
v4 = lambda x: "cvssMetricV40" in x["metrics"]
v3 = lambda x: "cvssMetricV31" in x["metrics"] or "cvssMetricV30" in x["metrics"]
print(sum(map(v4, live)), sum(1 for x in live if v4(x) and v3(x)),
sum(1 for x in live if v4(x) and not v3(x)))
What's affected
| Score data on the record | CVEs | Share |
|---|---|---|
| CVSS 3.x and 4.0 | 5,575 | 23.3% |
| CVSS 4.0 only | 1,892 | 7.9% |
| CVSS 3.x only | 14,821 | 61.9% |
| Neither | 1,646 | 6.9% |
| Total | 23,934 |
Every one of the 7,467 v4 entries has type Secondary, meaning a CNA supplied it. NVD's own analysts supplied none. The share rose from 29.4% of September's CVEs (4,387 of 14,936) to 34.2% of those published 1 to 16 October (3,080 of 8,998).
It is concentrated in a few publishers. Of the 280 sources that published a CVE in the window, 167 have at least one record with a v4 score. The biggest ten by volume:
| CNA | CVEs | With CVSS 4.0 | Share |
|---|---|---|---|
| VulnCheck | 3,035 | 3,035 | 100.0% |
| Microsoft | 2,449 | 0 | 0.0% |
| kernel.org | 2,383 | 0 | 0.0% |
| GitHub | 2,277 | 664 | 29.2% |
| VulDB | 1,289 | 1,289 | 100.0% |
| Patchstack | 1,057 | 10 | 0.9% |
| WPScan | 847 | 0 | 0.0% |
| Wordfence | 811 | 0 | 0.0% |
| Chrome | 772 | 0 | 0.0% |
| MITRE | 746 | 43 | 5.8% |
VulnCheck and VulDB together supplied 4,324 of the 7,467 v4 scores (57.9%). Among the 47 sources with at least 50 CVEs, 16 score more than half of their records with v4 and 24 score none.
The two versions often disagree. For the 5,528 CVEs with both a 3.1 and a 4.0 score, the severity band (Low, Medium, High, Critical) is the same in 3,484 (63.0%). The 4.0 band is higher in 946 and lower in 1,098.
What to do now
- Check which version your scanner and policy use. A "Critical" gate on 3.1 only will not see a score that exists only in 4.0.
- Plan for 1,892 CVEs with 4.0 only. In this window that was 7.9% of the total.
- Keep both scores in your records, with the source and version, rather than overwriting one with the other.
- Use exploitation data first. Scores disagree in 37% of the paired cases, so a KEV match is a firmer signal than either band.
Quick check
What share of new CVEs carry a CVSS 4.0 score, and who supplied them?
7,467 of 23,934 (31.2%), all supplied by CNAs. VulnCheck and VulDB account for 57.9%.
