data
where the numbers come from, what counts, and what they can't tell you.
sources
every cve record: its publish date, who filed it, the product and its cvss score.
2026-10-25
cc0
whether a cve is on cisa's list of vulnerabilities known to be used in real attacks. cisa adds it to the cve record itself.
2026-10-25
as above
the score from whoever filed the cve. when they gave none, the score cisa added. we don't use nvd.
2026-10-25
the snapshot was taken at 00:00 utc on october 25, 2026, so the last day in the data is october 24, 2026.
what counts
- a month's cves
- every cve published in that month, by its publish date in utc. rejected records are left out, including 625 that were published and later rejected before the snapshot.
- critical
- a cvss score of 9 or higher.
- no login, no click
- reachable over the network, with no account and nothing for a user to do, according to the cve's cvss vector. it tells how easy a flaw is to reach. it doesn't mean anyone used it.
- used in real attacks
- a cve from that month that was on cisa's known exploited vulnerabilities list by the snapshot date. it is counted in the month the cve was published, not the month cisa added it.
- the 2025 average
- 2025 had 48,151 published cves, about 4,013 a month. for days, the average is taken per weekday, from 29 on a sunday to 227 on a tuesday.
- kind of software
- sorted by a first-match rule over the filer, the vendor and the description. open-source packages, enterprise vendors, the linux kernel, browsers and ai software are one group; everything else is the other.
what it can't tell you
6%
of records have no cvss score yet. they count toward the totals but never toward critical, so the critical counts are a floor. the share goes up to 13% in december 2025.
17%
of the scores were added by cisa, not by whoever filed the cve.
5 days
is the typical wait between a cve going public and cisa listing it as exploited. some take months, so the attack counts for recent months will keep rising.
24 of 31
days of october 2026 are in the data. the month and its poster are still running.
a cve count is a count of disclosures, not of attacks or of risk. more cves can also mean more people looking.
download
every month: published cves, critical, the busiest day, the biggest batches and each cve used in real attacks.
95 kbevery cve on the kev list, with its id, product and the dates it was published and listed.
28 kbfree to reuse. cve list data stays under the cve terms of use, so keep the mitre notice below with any copy.
changes
2026-10-25
first snapshot. 22 months, january 2025 to october 24, 2026.
cve™ is a trademark of the mitre corporation. cve list data is used under the cve terms of use. cisa kev and vulnrichment data are cc0. cvegen is not affiliated with mitre, the cve program or cisa.