Patch Tuesday vs. the noise Monthly
Whose vulnerability count moved this month, and why it usually does not mean what it looks like. Updated 2026-07-25.
A vendor's monthly vulnerability count is mostly a publishing schedule, not a risk signal. This view separates the three things people confuse: a scheduled bulk disclosure, a steady release cadence, and a vendor whose flaws are actually being exploited. Read the last two columns, not the first.
| Vendor | Last 30d | Prior 30d | Change | Year | Known-exploited (yr) | Read |
|---|---|---|---|---|---|---|
| Oracle | 1,108 | 268 | 4.1x | 1,634 | 5 | bulk drop |
| Microsoft | 853 | 786 | 1.1x | 3,792 | 36 | steady |
| 516 | 860 | 0.6x | 2,457 | 12 | steady | |
| Linux Kernel | 395 | 1,216 | 0.3x | 5,358 | 8 | steady |
| Apple | 258 | 580 | 0.4x | 2,236 | 14 | steady |
| Apache | 132 | 95 | 1.4x | 555 | 1 | steady |
| Adobe | 105 | 132 | 0.8x | 802 | 4 | steady |
| Mozilla | 72 | 50 | 1.4x | 426 | 0 | steady |
| Red Hat | 47 | 71 | 0.7x | 265 | 3 | steady |
| Openclaw | 42 | 67 | 0.6x | 574 | 0 | steady |
| IBM | 40 | 73 | 0.5x | 515 | 0 | steady |
| Dell | 39 | 22 | 1.8x | 283 | 1 | steady |
Source: our vendor vulnerability stats, refreshed daily. "Known-exploited" counts entries on the CISA Known Exploited Vulnerabilities catalog over the trailing year. A change of 2.5x or more usually marks a scheduled bulk disclosure (for example a quarterly update), not a new problem.