FlagThis | CVE Analysis

CVE Analysis Exploit metrics & risk CVE List Real-time tracking & triage Vendors Vendor risk scorecards Products Product security scores Top Discussed Trending on social

CVE Analysis

How CVE volume, exploitation, and patch/exploit timing are trending over time

Vulnerabilities Trends — rolling 30-day windows

Marinating threat data…

Metrics Over Time

Updating… Trailing windows

Each column counts CVEs published within that trailing window. Vendor / product / min-CVSS filters apply to the whole table.

Metric	1D	1W	30D	90D	1Y	2Y	5Y	All
Volume
New CVEs	730	4,341	16,212	42,772	96,616	143,602	232,986	396,257
Critical (9.0+)	43	361	1,508	4,822	10,280	14,342	25,219	48,457
High (7.0–8.9)	126	1,435	6,312	17,361	38,351	53,957	86,379	144,287
Exploitation
Known Exploits	3	55	329	998	3,265	4,996	8,888	35,334
% With Exploit	0.4%	1.3%	2.0%	2.3%	3.4%	3.5%	3.8%	8.9%
Actively Exploited (KEV)	0	3	22	70	231	423	877	1,758
Exploited After Patch	2	15	64	216	528	728	1,147	9,326
% Post-Patch Exploit	0.3%	0.3%	0.4%	0.5%	0.5%	0.5%	0.5%	2.4%
0-Day (Before Patch)	0	1	16	47	115	259	322	14,579
Timing
Avg Days to Patch	14d	17d	31d	32d	55d	130d	122d	103d
Avg Days to Exploit	49d	37d	20d	40d	68d	107d	169d	262d

CVE Surge — Possible AI-Assisted Bug Hunting Last 2 Quarters

Vendors and products active for 4+ years whose newly-published CVEs jumped sharply over the last ~180 days versus their own 5-year baseline — a pattern often tied to new AI-assisted bug-finding & fixing programs. This data doesn't reveal who is discovering the bugs — they may be found by the vendor's own teams or reported by external researchers. Jump is how many standard deviations the recent per-quarter rate sits above the historical quarterly mean, shown for both all CVEs (the sort order) and exploited CVEs. Δ Severity is the change in average CVSS base score — which may hint at the quality of the bugs being found or at how the vendor is prioritizing which issues to fix (a drop toward lower-severity bugs is also common with AI fuzzing noise). Each cell's small text is baseline → recent. Click any name to open it in the analysis filters below.

Top Vendors

#	Vendor	CVE Jump	Expl Jump	Δ Severity
1	Oracle Corporation	77.5σ 86.9→1992.0/q	0.2σ3.6→4.5/q	+1.6 5.8→7.4
2	Apache Software Foundation	37.8σ 60.4→539.0/q	16.8σ8.6→62.0/q	+0.1 7.3→7.4
3	microsoft	34.3σ 276.2→2001.5/q	2.2σ21.1→32.5/q	+0.1 7.3→7.4
4	Google	23.0σ 206.7→1860.5/q	4.7σ10.8→30.0/q	-0.0 7.1→7.1
5	Splunk	16.5σ 9.2→91.0/q	1.9σ0.3→1.5/q	+0.3 6.2→6.5
6	gnome	15.2σ 2.5→21.0/q	-0.3σ0.1→0.0/q	-0.6 7.1→6.5
7	IBM	12.4σ 117.1→645.5/q	5.9σ0.8→6.0/q	+1.4 5.8→7.2
8	Elastic	10.7σ 7.8→77.0/q	-0.4σ0.2→0.0/q	-0.2 6.4→6.1
9	vercel	10.0σ 2.5→20.5/q	2.0σ0.6→2.0/q	+0.3 6.0→6.3
10	Red Hat	9.5σ 87.9→640.5/q	4.0σ6.1→31.5/q	+0.2 6.5→6.7
11	openstack	9.1σ 4.6→59.0/q	1.7σ0.4→2.5/q	+0.0 6.9→6.9
12	Arista Networks	9.0σ 4.5→45.0/q	7.5σ0.1→2.0/q	-0.0 6.8→6.8
13	Dell	8.9σ 57.8→218.5/q	-0.5σ0.2→0.0/q	+0.1 6.5→6.7
14	Rapid7	8.8σ 2.9→24.5/q	1.1σ0.1→0.5/q	+0.9 5.8→6.7
15	quarkus	8.7σ 3.1→22.5/q	1.0σ0.1→0.5/q	+0.2 7.2→7.3
16	Villatheme	8.5σ 2.7→18.0/q	-0.4σ0.1→0.0/q	+0.1 6.3→6.4
17	watchguard	8.4σ 4.2→37.5/q	0.0σ0.5→0.5/q	+0.4 7.2→7.6
18	TYPO3	7.9σ 5.5→36.0/q	7.8σ0.1→2.0/q	+1.0 5.6→6.7
19	jetbrains	7.2σ 18.4→77.5/q	0.9σ0.6→1.5/q	+1.0 5.5→6.5
20	ISC	7.2σ 3.7→16.5/q	1.1σ0.3→1.0/q	-0.2 7.2→7.0

Top Products

#	Product	CVE Jump	Expl Jump	Δ Severity
1	Chrome	40.8σ 75.2→1671.5/q	9.1σ3.9→23.0/q	-0.6 7.7→7.1
2	Windows 10 Version 1809	37.6σ 124.4→1058.5/q	0.7σ10.8→13.0/q	-0.0 7.3→7.3
3	zephyr	36.2σ 4.6→100.0/q	4.0σ0.1→1.0/q	-1.1 7.1→6.1
4	i	35.5σ 2.9→78.5/q	-0.3σ0.2→0.0/q	-0.2 6.7→6.5
5	Windows Server 2022	31.1σ 143.6→1152.5/q	0.6σ12.3→14.0/q	-0.1 7.4→7.3
6	Windows 10 Version 1607	30.9σ 106.6→899.0/q	0.3σ9.6→10.5/q	-0.0 7.4→7.3
7	Windows 10 Version 21H2	30.3σ 128.7→1044.5/q	0.2σ11.2→12.0/q	-0.1 7.3→7.3
8	Visual Studio Code	29.8σ 1.7→22.0/q	-0.6σ0.3→0.0/q	+0.3 7.5→7.7
9	Windows Server 2019	29.5σ 139.4→1086.0/q	0.8σ11.7→14.0/q	-0.0 7.3→7.3
10	Windows Server 2019 (Server Core installation)	29.3σ 138.9→1085.5/q	0.9σ11.4→14.0/q	-0.0 7.3→7.3
11	Microsoft SharePoint Server Subscription Edition	25.8σ 5.8→80.5/q	3.3σ0.6→3.5/q	-0.6 7.6→7.0
12	Windows Server 2016	25.1σ 121.8→923.0/q	0.3σ10.5→11.5/q	-0.0 7.4→7.3
13	Windows Server 2016 (Server Core installation)	24.9σ 121.4→923.0/q	0.4σ10.2→11.5/q	-0.0 7.4→7.3
14	Windows Server 2012 R2	24.4σ 100.7→755.5/q	0.2σ8.9→9.5/q	-0.1 7.4→7.3
15	Windows Server 2012 R2 (Server Core installation)	24.3σ 100.6→755.5/q	0.2σ8.8→9.5/q	-0.1 7.4→7.3
16	Windows Server 2012	24.0σ 95.4→713.5/q	0.0σ8.4→8.5/q	-0.1 7.5→7.3
17	Windows Server 2012 (Server Core installation)	23.8σ 95.3→713.5/q	0.1σ8.3→8.5/q	-0.1 7.5→7.3
18	Windows 10 Version 22H2	22.2σ 121.7→1045.0/q	0.5σ10.5→12.5/q	-0.1 7.3→7.3
19	Microsoft Office LTSC 2021	19.1σ 16.2→232.5/q	-0.8σ1.1→0.0/q	-0.0 7.6→7.5
20	Microsoft 365 Apps for Enterprise	18.4σ 18.2→240.5/q	-0.8σ1.3→0.0/q	-0.0 7.6→7.5

Total Tracked CVEs

New 24h–

New 7d–

Active Exploits / KEV

Exploited 24h–

Exploited 7d–

Actionable · KEV or EPSS ≥ 10%

of in-scope–

Critical CVSS–

CVSS Severity Distribution

Dicing tomatoes…

% With Exploit

% Post-Patch Exploit

Median Days to Patch

discovery → disclosure

Median Days to Exploit

patch → exploit

Exploit Rate Over Time

⤢ expand

Seasoning with salt hashes…

% of CVEs per period with a known exploit.

Exploit Count Over Time

⤢ expand

Flambéing the firewall…

Absolute number of CVEs with a known exploit per period.

Days to Patch

⤢ expand

Brewing fresh queries…

Discovery → public disclosure (0–1825 day window).

Days: Patch → Exploit

⤢ expand

Fermenting the results…

Days from public patch to first known exploit/PoC.

Want the context behind these numbers? Read our breakdown of the 2026 CVE surge, or get the daily brief:

CVE Analysis — Exploit Trends, CVSS Distribution & Patch Metrics

Vulnerabilities Trends — rolling 30-day windows

Top Vulnerability Classes by Exploit Count

CVE Surge — Possible AI-Assisted Bug Hunting Last 2 Quarters

CVSS Severity Distribution

Exploit Rate Over Time

Exploit Count Over Time

Days to Patch

Days: Patch → Exploit

CVE Analysis — Exploit Trends, CVSS Distribution & Patch Metrics

Vulnerabilities Trends — rolling 30-day windows

Top Vulnerability Classes by Exploit Count

CVE Surge — Possible AI-Assisted Bug Hunting Last 2 Quarters

CVSS Severity Distribution

Exploit Rate Over Time

Exploit Count Over Time

Days to Patch

Days: Patch → Exploit

SHARE INTELLIGENCE WIRE