Inside the Advisory Database and what happens when vulnerability volume breaks records

The GitHub Advisory Database published 1,560 reviewed advisories in May 2026, over five times its typical monthly output, yet still couldn't keep pace with incoming volume. Private vulnerability reports surged from ~550/week in January to 3,000+/week in May, repository advisories jumped from ~650 to 5,000+/week, and GitHub CNA CVE requests hit nearly 4,000 in May alone. The bottleneck isn't infrastructure failure but throughput: curators must manually validate package ecosystems, reconstruct version ranges, resolve conflicting upstream data, and handle multi-ecosystem advisories. Review times have extended to multiple weeks for a meaningful share of submissions. GitHub is responding with AI-assisted research tooling, improved automation, smarter risk-based prioritization, and tighter upstream data integration. Contributors can help by submitting complete vulnerability data (version ranges, CVSS vectors, CWE classifications), using registry-accurate package names, coordinating with maintainers, and only requesting CVEs when there is clear publication intent.

Source: https://github.blog/security/supply-chain-security/inside-the-advisory-database-and-what-happens-when-vulnerability-volume-breaks-records. 8 Sync News only summarizes and links out; content copyright belongs to the authors and original sources.