In April I counted the CVE alerts on our own repos. Dependabot went from 44 alerts in Q4 2025 to 182 in Q1 2026, and 3 of them were exploitable.
Six months later I pulled the same export to compare Q1 with Q3. Alerts more than doubled again. So did the amount of code we ship: we merged 973 pull requests in Q1 and 2,305 in Q3.
Q1 to Q3: from 176 alerts to 384
Dependabot opened 176 alerts across our repos in Q1 2026 and 384 in Q3, up 118%. Q2 already landed at 376, so the step happened in the spring and the new level held through the summer.
| Severity | Q1 2026 | Q3 2026 | Change |
|---|---|---|---|
| Critical | 4 | 21 | +425% |
| High | 96 | 175 | +82% |
| Moderate | 58 | 157 | +171% |
| Low | 18 | 31 | +72% |
npm is still the largest source. Go nearly tripled, and Maven went from 1 alert to 22.
| Ecosystem | Q1 2026 | Q3 2026 | Change |
|---|---|---|---|
| npm | 122 | 220 | +80% |
| pip | 29 | 74 | +155% |
| Go | 22 | 65 | +195% |
| Maven | 1 | 22 | 22x |
| Rust | 0 | 2 | new |
| RubyGems | 2 | 1 | -50% |
The fan-out from April is still there. In Q1, three minimatch advisories produced 36 alerts. In Q3, three advisories on brace-expansion, the package minimatch uses to expand brace patterns, produced 22. Overall, the 384 Q3 alerts came from 177 distinct advisories.
A note on Q1: it shows 176 today against the 182 in April, because a few alerts have dropped out of the data since. Konvu still counts 3 exploitable.
NVD published 2.4x more CVEs than in Q1
In April, the number everyone quoted was +30% CVEs year over year. NVD published 36,960 CVEs in Q3 2026, rejected ones excluded. That is 3.2x Q3 2025 and 2.4x Q1 2026, and the count rose every month of the quarter: 9,770 in July, 12,257 in August, 14,933 in September.
The timing lines up with Mythos and the AI-assisted vulnerability research that followed it.
And one CVE can mean many alerts. A CVE in a popular package opens an alert in every repo and manifest that pulls it in, sometimes 20 or 30 for a single CVE.
19 repos with alerts, up from 10
Dependabot alerts come from the dependencies on each repo's default branch, which for us is the code we deploy. 19 repos had Dependabot alerts in Q3, up from 10 in Q1.
New advisories land on that bigger footprint. 296 of the 384 Q3 alerts opened within a week of their advisory going public, on dependencies already on main.
Every dependency that ships is one more place for the next advisory to land, and security headcount does not double in two quarters.
10 of 384 were exploitable
Konvu runs on our repos the same way it runs for customers. It picks up each Dependabot alert, works out whether it is exploitable in our code and deployment, and writes the verdict back to GitHub.
Of the 384 Q3 alerts, 10 were exploitable.
That is 2.6% of the quarter's alerts, against 1.7% in Q1. Volume doubled and the exploitable share stayed under 3%. Severity did not predict it: only 1 of the 21 critical alerts was exploitable.
One of the real ones came from the AI stack itself. In CVE-2026-52869, the HTTP transports of the MCP Python SDK serve session requests without verifying the authenticated principal. Our MCP backend serves stateful SSE sessions behind bearer tokens, which is the setup the advisory describes. We fixed it.
Remediation got faster too.
Takeaway
Our alert volume now grows with two curves: the CVEs published each quarter and the amount of code we run, which grows as our engineers ship with agents. Neither is slowing down: as of October 26, we have logged 245 Dependabot alerts this month, more than in all of Q1.
The exploitable share stayed under 3% in both quarters. The hard part is still the decision on each alert, at 384 a quarter for us and far more for teams 100 times our size.
If your team is triaging or remediating Dependabot alerts by hand, we should talk.