The GitHub Advisory Database has reached an unprecedented milestone, publishing 1,560 reviewed advisories in May 2026, more than five times its typical monthly output and the highest single-month total in the database’s history.
From March through May 2026, GitHub sustained more than 6,000 advisory decisions per month, exceeding any prior three-month peak.
Private vulnerability reports jumped from approximately 550 per week in January to more than 3,000 per week through most of May, while repository advisories scaled from around 650 per week to more than 5,000 per week.
GitHub CNA CVE requests reached nearly 4,000 in May alone, approximately 10x year-over-year, and the CVE program has already published more than 30,000 CVEs in 2026.
GitHub Advisory Database Breaks Records
More than 1.7 million repositories now have private vulnerability reporting enabled, reflecting a fundamental shift in how vulnerabilities are discovered and disclosed globally, not a temporary anomaly.
The volume increase has created measurable downstream impact. Since mid-April, GitHub has not consistently met its internal publication goals, with processing times extending first to approximately one week, then to multiple weeks for a significant portion of advisories.
Longer publication windows increase the risk of exposure, which GitHub acknowledges. Not all advisories carry equal complexity. Well-formatted submissions with clear package names, version ranges, and fix references can be validated in under a few minutes.
However, a growing share of incoming advisories requires substantial investigative work: disambiguating packages across ecosystems such as npm, PyPI, and Maven; reconstructing version ranges from commits and changelogs; and resolving conflicts between CVE records and maintainer advisories.
Critically, advisory quality standards have not been lowered; every reviewed advisory still undergoes human validation, and CVE assignment quality has remained steady at 91–94% throughout the surge.
GitHub has deployed several countermeasures to address the throughput gap. The team introduced AI-assisted research tooling that accelerates routine research tasks while keeping human curators in control of every final decision.
Enhanced automation now handles upstream CVE data extraction and community contribution management.
Risk-based review prioritization incorporating signals such as package usage, evidence of active exploitation, and ecosystem impact is being developed to ensure the most critical advisories reach users first.
Backend curation systems have also been scaled for higher sustained throughput. High-quality upstream data is one of the most effective ways to improve both speed and accuracy across the ecosystem.
GitHub stated that users should use registry-accurate package names, list all affected packages with individual version ranges, include complete CVSS vector strings rather than severity labels alone, and add CWE classifications to enable downstream filtering.
CVE requests should only be made with a clear intention to publish, and close coordination with maintainers helps eliminate conflicting upstream data that compounds curation delays.
Two years ago, the database published approximately 270 advisories per month. In May 2026, it published over 1,500 while processing thousands of additional decisions system-wide.
More repositories are enabling responsible disclosure, more researchers are reporting vulnerabilities, and more maintainers are publishing coordinated fixes than ever before.
The challenge now is scaling the infrastructure needed to match that momentum without sacrificing the data quality that developers and security tools worldwide depend on.
Follow us on Google News , LinkedIn and X to Get More Instant Updates. Set Cyberpress as a Preferred Source in Google.
