Explore
Time-to-exploit analytics
How fast vulnerabilities go from publication to confirmed exploitation (CISA KEV), public proof-of-concept and press coverage · last 365 days of KEV additions
- KEV additions · 365d302
- Median days to KEV9.7p25 <1 · p75 97.1
- Exploited within 7 days45%of KEV entries
- Median days to news37.8in our feeds
- Median days to PoC15.0as tracked here
- Known ransomware use29KEV entries
Recent KEV additions
publication → exploitation gapAll| CVE | Affected | Published | KEV | → KEV | → news | → PoC | Articles | Risk |
|---|---|---|---|---|---|---|---|---|
| CVE-2026-118527 | Ivanti Connect Secure | — | — | — | — | 6 | —— | |
| CVE-2026-111357 | Ivanti Connect Secure | 14.1 | 13.6 | — | 7 | 7.0<1% | ||
| CVE-2026-76418 | Cisco Secure Firewall ASA Software and Cisco Secure FTD Software | <1 | <1 | — | 11 | 8.6<1% | ||
| CVE-2026-97229 | GitLab Community Edition and Enterprise Edition | 15.9 | <1 | <1 | 26 | 10.027%PoC ×5 | ||
| CVE-2026-41709 | Broadcom VMware ESX | 89.4 | <1 | — | 12 | 2.7<1% | ||
| CVE-2026-46300 | Linux Kernel | 158 | 34.1 | 138 | 31 | 7.816%PoC | ||
| CVE-2026-48356 | Adobe Commerce and Magento | 104 | 2.4 | — | 12 | 9.345% | ||
| CVE-2026-111497 | Google Brotli | 4.4 | <1 | <1 | 59 | 9.283%PoC ×25 | ||
| CVE-2026-109619 | PHP Group PHP | 4.4 | <1 | <1 | 167 | 9.2100%PoC ×15 | ||
| CVE-2026-109618 | PHP Group PHP | 4.4 | <1 | <1 | 160 | 9.2100%PoC ×25 | ||
| CVE-2026-110447 | Collabora Collabora Online – Built-in CODE Server | 8.9 | <1 | 1.4 | 8 | 9.273%PoC ×2 | ||
| CVE-2026-114625 | Arista VeloCloud Orchestrator | <1 | <1 | 7.6 | 12 | 9.41%PoC | ||
| CVE-2026-96655 | Plex Media Server | 26.3 | 25.5 | — | 10 | 5.32% | ||
| CVE-2026-110936 | Siemens Software Center | 4.4 | 4.1 | — | 12 | 8.4<1% | ||
| CVE-2026-96652 | Plex Media Server | 26.3 | 25.5 | 28.9 | 10 | 5.32%PoC | ||
| CVE-2026-96656 | Plex Media Server | 26.3 | 25.5 | — | 10 | 8.62% | ||
| CVE-2026-106931 | EG Secure Solutions SiteGuard Server Edition | 5.8 | 4.4 | — | 8 | 8.53% | ||
| CVE-2026-96654 | Plex Media Server | 26.3 | 25.5 | — | 10 | 6.92% | ||
| CVE-2026-102764 | BeyondTrust Remote Support | <1 | <1 | <1 | 24 | 9.319%PoC ×2 | ||
| CVE-2025-61624 | Fortinet Multiple Products | 184 | 183 | — | 9 | 6.51% | ||
| CVE-2026-21589 | Atlassian Multiple Products | 9.1 | <1 | <1 | 31 | 9.399%PoC ×10 | ||
| CVE-2026-105133 | Ahsay AhsayCBS | 9.7 | 4.5 | — | 13 | 6.979% | ||
| CVE-2026-76519 | Cisco Secure Email Gateway | <1 | <1 | <1 | 15 | 9.82%PoC | ||
| CVE-2026-0322 | Palo Alto Networks PAN-OS | <1 | <1 | — | 15 | 8.62% | ||
| CVE-2026-105134 | Ahsay AhsayCBS | 9.7 | 4.5 | 1.2 | 13 | 10.082%PoC | ||
| CVE-2026-104935 | Ivanti Connect Secure | <1 | <1 | <1 | 25 | 8.687%PoC ×4 | ||
| CVE-2026-96951 | Microsoft Windows | <1 | <1 | — | 18 | 8.810% | ||
| CVE-2015-3306 | ProFTPD ProFTPD | 4160 | 4161 | — | 8 | 10.099%PoC ×5 | ||
| CVE-2023-22894 | Strapi Strapi | 1267 | 1268 | — | 6 | 4.94%PoC ×2 | ||
| CVE-2016-3081 | Apache Struts | 3816 | 3817 | — | 9 | 8.197%PoC ×2 |
CVEs published per day · 30 days
NVD + GitHub advisoriesTable view
| Day | CVSS < 9 | CVSS ≥ 9 |
|---|---|---|
| 2026-10-03 | 110 | 5 |
| 2026-10-04 | 55 | 13 |
| 2026-10-05 | 375 | 31 |
| 2026-10-06 | 913 | 105 |
| 2026-10-07 | 290 | 53 |
| 2026-10-08 | 455 | 62 |
| 2026-10-09 | 278 | 42 |
| 2026-10-10 | 335 | 78 |
| 2026-10-11 | 215 | 16 |
| 2026-10-12 | 632 | 48 |
| 2026-10-13 | 2,138 | 170 |
| 2026-10-14 | 737 | 92 |
| 2026-10-15 | 510 | 51 |
| 2026-10-16 | 417 | 53 |
| 2026-10-17 | 101 | 4 |
| 2026-10-18 | 541 | 10 |
| 2026-10-19 | 509 | 29 |
| 2026-10-20 | 1,772 | 169 |
| 2026-10-21 | 495 | 50 |
| 2026-10-22 | 427 | 69 |
| 2026-10-23 | 459 | 40 |
| 2026-10-24 | 64 | 12 |
| 2026-10-25 | 128 | 3 |
| 2026-10-26 | 738 | 21 |
| 2026-10-27 | 593 | 70 |
| 2026-10-28 | 766 | 35 |
| 2026-10-29 | 480 | 66 |
| 2026-10-30 | 640 | 44 |
| 2026-10-31 | 101 | 11 |
| 2026-11-01 | 69 | 8 |
How long until exploitation?
KEV entries · 365 days- same day91
- 1–7 days46
- 8–30 days49
- 31–90 days36
- 91–365 days36
- > 1 year44
Gap between NVD publication and CISA KEV listing. “Same day” includes flaws exploited as zero-days before publication.
Vendors in KEV · 365 days
All| Vendor | KEV | Median days | Ransomware |
|---|---|---|---|
| Microsoft | 42 | <1 | 4 |
| Cisco | 21 | <1 | 2 |
| Fortinet | 12 | 21.3 | 0 |
| 11 | <1 | 0 | |
| Apple | 10 | 97.1 | 0 |
| Linux | 9 | 339 | 0 |
| Ivanti | 8 | 1.3 | 0 |
| Adobe | 7 | 24.8 | 0 |
| Citrix | 6 | 3.1 | 0 |
| Synacor | 5 | 71.4 | 0 |
| SonicWall | 5 | <1 | 2 |
| Oracle | 5 | 47.1 | 1 |
| JFrog | 4 | 21.8 | 0 |
| GitLab | 4 | 764 | 0 |
“PoC seen” is when this dashboard first saw a public exploit reference (GitHub repos, NVD exploit tags); it starts from the day the tracker went live, so early values are conservative. “First news” is the earliest article in our feeds mentioning the CVE.