On 18 October 2026 the NVD API returned 409,830 CVE records in total and 391,324 once rejected records were excluded. The difference, 18,506, is records the CVE Program no longer treats as valid. A fair count of real vulnerabilities uses the second number.
The two queries
Both numbers came from the public NVD CVE API, version 2.0, using the totalResults field with no filters and then with the noRejected parameter:
curl -s "https://services.nvd.nist.gov/rest/json/cves/2.0?resultsPerPage=1"
curl -s "https://services.nvd.nist.gov/rest/json/cves/2.0?resultsPerPage=1&noRejected"
The totals move every day as records are added and rejected, so treat any figure in a blog post, including this one, as a dated snapshot.
Why records get rejected
The CVE record format states that when a CVE ID and its record should no longer be used, the record moves to a rejected state. It stays on the CVE list so users can learn that it is invalid. A rejected record can also name replacements in a replacedBy field, for cases where the ID was assigned to vulnerabilities that were later folded into other IDs.
Common reasons, in plain terms: the ID was a duplicate, it was assigned in error, or it turned out not to describe a security flaw. See what published versus rejected means for the record level view.
Why headline totals mislead
| If you quote | You include |
|---|---|
| All records | Valid, rejected and awaiting analysis |
| Records without rejected | Valid records, whatever their enrichment state |
| Records with a KEV flag | A small subset of known exploited flaws |
On the same day, the API reported 1,748 records with the hasKev filter. That is well under one percent of the 391,324 non rejected records, which is a useful reminder that the overall count says very little about how many flaws are actively used in attacks.
How to count for a report
- State the date and the source API.
- Say whether rejected records are included.
- Say whether you count by published date or by last modified date.
- Keep the query text so a reader can repeat it.
A trend line of "CVEs per year" is only comparable if every year is counted the same way. Our post on NVD publication volume shows yearly counts.
Safeguard offers SBOM and dependency scanning with reachability analysis, which helps you rank the valid records that do apply. Run a free scan on your own packages.
Quick check
Does a rejected CVE disappear?
No. The record stays on the list marked rejected, so people can see that the ID is invalid.
Is a bigger NVD total a sign of a worse year?
Not necessarily. Publication volume reflects reporting and numbering practice as well as real flaws, and totals include records that were later rejected.
Sources
Last reviewed: 19 October 2026.
