A CVE is a public ID for a known security vulnerability, such as CVE-2026-109618. CVE stands for Common Vulnerabilities and Exposures. The ID lets everyone, from vendors to sysadmins, talk about the same bug without confusion.
Our shirt is a workplace safety sign: Days since last critical CVE: 0, previous record: 0. Below it, the patch list of every sysadmin: php patched, node patched, nginx patched, me: pending reboot.
Where CVE comes from
The CVE List was officially launched for the public in September 1999. MITRE runs it, with sponsorship from the US government. Before CVE, each vendor and each security tool used its own names, so the same bug could have five different ones.
When is a CVE critical?
A CVE ID does not say how dangerous a bug is. Severity comes from a separate score, the CVSS (Common Vulnerability Scoring System), from 0 to 10. The CVSS specification maps scores to ratings:
| CVSS score | Rating |
|---|---|
| 0.1 – 3.9 | Low |
| 4.0 – 6.9 | Medium |
| 7.0 – 8.9 | High |
| 9.0 – 10.0 | Critical |
A separate list matters even more: the CISA Known Exploited Vulnerabilities catalog, “the authoritative source of vulnerabilities that have been exploited in the wild.” A high CVE in that list is more urgent than a critical one nobody exploits.
Why the counter never moves
There are a lot of CVEs. An analysis of NVD data by Jerry Gamblin counted 48,185 CVEs published in 2025, a 20.6% increase on the 39,962 of 2024. That is more than 130 per day.
Our patch list is real. In October and November 2026:
| Software | What happened | Severity |
|---|---|---|
| PHP | 8.5.12, 8.4.27, 8.3.36 and 8.2.35 fixed CVE-2026-109618 and CVE-2026-109619, unauthenticated remote code execution. Both were added to the KEV catalog on 26 October. | Critical (CVSS 4.0: 9.2) |
| Node.js | October and November security releases; the November one fixed 16 CVEs. | High |
| nginx | Security advisories fixed in 1.31.7 and 1.30.6. | Medium |
So the honest version of the sign is “days since last CVE that affects me”. It is still zero.
What to do about it
- Know what you run. You cannot patch software you forgot you installed.
- Subscribe to the security announcements of your main stack: PHP, Node.js, nginx, your OS.
- Check the KEV catalog first. Exploited bugs go to the front of the queue.
- Automate updates where you can, and schedule the reboot. “Pending reboot” is not patched.
Patching is a team sport. When the patch breaks something, read single point of failure before you plan the next one.
Get the shirt
Days Since Last Critical CVE T-Shirt · 24 €
0 days. Previous record: 0.
Sysadmin Hero T-Shirt · 24 €
For the person who applies the patches.
Single Point of Failure T-Shirt · 24 €
The server nobody can reboot.
All shirts are unisex, S to 5XL, printed on demand in black, graphite heather and white. Check the size guide before ordering. More ideas in the Christmas gift guide for programmers.
FAQ
What does CVE stand for?
Common Vulnerabilities and Exposures. It is a list of public IDs for known security vulnerabilities, launched in 1999.
What makes a CVE critical?
A CVSS score of 9.0 to 10.0. The score depends on how easy the attack is and how much damage it can do.
How many CVEs are published each year?
Around 48,000 in 2025 and around 40,000 in 2024, according to an analysis of NVD data.