FlagThis | CVE Analysis

CVE Analysis Exploit metrics & risk CVE List Real-time tracking & triage Vendors Vendor risk scorecards Products Product security scores Top Discussed Trending on social

CVE Analysis

How CVE volume, exploitation, and patch/exploit timing are trending over time

Vulnerabilities Trends — rolling 30-day windows

Marinating threat data…

Metrics Over Time

Updating… Trailing windows

Each column counts CVEs published within that trailing window. Vendor / product / min-CVSS filters apply to the whole table.

Metric	1D	1W	30D	90D	1Y	2Y	5Y	All
Volume
New CVEs	663	2,940	14,860	37,340	86,596	133,359	221,489	383,485
Critical (9.0+)	39	300	1,494	4,668	9,354	13,458	24,218	47,321
High (7.0–8.9)	188	1,143	6,078	15,561	34,251	49,875	81,837	139,259
Exploitation
Known Exploits	2	57	278	886	3,010	4,726	8,559	34,929
% With Exploit	0.3%	1.9%	1.9%	2.4%	3.5%	3.5%	3.9%	9.1%
Actively Exploited (KEV)	0	5	23	70	221	418	873	1,734
Exploited After Patch	1	10	61	184	460	650	1,060	9,230
% Post-Patch Exploit	0.2%	0.3%	0.4%	0.5%	0.5%	0.5%	0.5%	2.4%
0-Day (Before Patch)	0	4	14	58	108	255	310	14,566
Timing
Avg Days to Patch	35d	29d	31d	33d	64d	146d	129d	105d
Avg Days to Exploit	1d	18d	11d	29d	67d	110d	176d	261d

CVE Surge — Possible AI-Assisted Bug Hunting Last 2 Quarters

Vendors and products active for 4+ years whose newly-published CVEs jumped sharply over the last ~180 days versus their own 5-year baseline — a pattern often tied to new AI-assisted bug-finding & fixing programs. This data doesn't reveal who is discovering the bugs — they may be found by the vendor's own teams or reported by external researchers. Jump is how many standard deviations the recent per-quarter rate sits above the historical quarterly mean, shown for both all CVEs (the sort order) and exploited CVEs. Δ Severity is the change in average CVSS base score — which may hint at the quality of the bugs being found or at how the vendor is prioritizing which issues to fix (a drop toward lower-severity bugs is also common with AI fuzzing noise). Each cell's small text is baseline → recent. Click any name to open it in the analysis filters below.

Top Vendors

#	Vendor	CVE Jump	Expl Jump	Δ Severity
1	Oracle Corporation	52.5σ 88.9→1504.0/q	6.5σ2.6→13.0/q	+1.8 5.8→7.7
2	Apache Software Foundation	26.8σ 57.2→463.5/q	12.1σ7.9→47.5/q	+0.1 7.3→7.4
3	Google	16.8σ 208.3→1562.0/q	3.7σ11.1→28.5/q	-0.1 7.1→7.0
4	microsoft	15.1σ 271.1→1357.0/q	2.0σ20.8→34.5/q	+0.1 7.3→7.4
5	Wireshark Foundation	10.7σ 5.3→51.5/q	—	-1.0 6.4→5.5
6	Elastic	9.7σ 7.7→70.5/q	-0.4σ0.2→0.0/q	-0.3 6.4→6.1
7	vercel	9.4σ 2.5→19.5/q	2.0σ0.6→2.0/q	+0.3 6.0→6.3
8	IBM	9.3σ 118.5→524.0/q	4.2σ0.8→4.5/q	+1.4 5.8→7.2
9	Rapid7	9.0σ 2.6→24.5/q	-0.4σ0.1→0.0/q	+1.2 5.6→6.8
10	Splunk	8.9σ 11.4→66.0/q	0.9σ0.4→1.0/q	+0.1 6.3→6.5
11	Red Hat	8.9σ 81.5→589.5/q	4.1σ5.4→29.0/q	+0.3 6.5→6.8
12	watchguard	8.2σ 4.2→36.5/q	-0.7σ0.5→0.0/q	+0.4 7.2→7.6
13	jetbrains	7.4σ 19.3→74.0/q	-0.1σ0.6→0.5/q	+0.9 5.5→6.4
14	Dell	7.3σ 55.8→209.0/q	-0.5σ0.2→0.0/q	+0.1 6.5→6.6
15	NVIDIA	6.7σ 27.8→154.5/q	1.4σ0.5→1.5/q	+0.7 6.6→7.3
16	checkpoint	6.5σ 2.0→8.5/q	11.4σ0.1→3.0/q	+1.2 6.8→8.1
17	grafana	6.5σ 4.9→23.5/q	0.8σ0.5→1.0/q	-0.1 6.5→6.4
18	Arista Networks	6.4σ 4.3→32.5/q	5.7σ0.1→1.5/q	-0.2 6.8→6.6
19	ISC	6.1σ 3.7→14.5/q	0.3σ0.3→0.5/q	-0.3 7.2→6.9
20	dataease	6.0σ 4.3→21.5/q	1.1σ0.1→0.5/q	-0.4 8.1→7.6

Top Products

#	Product	CVE Jump	Expl Jump	Δ Severity
1	Chrome	36.3σ 73.3→1380.0/q	7.5σ4.0→22.0/q	-0.7 7.6→7.0
2	i	31.3σ 2.8→71.0/q	-0.3σ0.2→0.0/q	-0.0 6.7→6.6
3	Windows 10 Version 1809	27.5σ 127.9→658.0/q	0.9σ11.3→13.5/q	-0.0 7.3→7.3
4	zephyr	26.9σ 4.7→74.0/q	4.1σ0.1→1.0/q	-1.1 7.1→6.0
5	Visual Studio Code	22.5σ 1.7→17.0/q	-0.6σ0.3→0.0/q	+0.2 7.5→7.7
6	Windows Server 2022	21.2σ 147.7→717.0/q	1.1σ12.8→15.5/q	-0.0 7.4→7.3
7	Windows 10 Version 1607	21.1σ 109.9→568.0/q	0.3σ9.9→11.0/q	-0.0 7.4→7.3
8	Windows Server 2019	20.1σ 143.6→677.0/q	1.3σ12.1→15.5/q	-0.0 7.3→7.3
9	Microsoft SharePoint Server Subscription Edition	20.0σ 6.1→62.5/q	3.8σ0.6→4.0/q	-0.8 7.7→6.8
10	Windows Server 2019 (Server Core installation)	19.8σ 143.1→676.5/q	1.4σ11.8→15.5/q	-0.0 7.3→7.3
11	Windows 10 Version 21H2	16.9σ 130.1→643.5/q	0.3σ11.6→12.5/q	-0.1 7.3→7.3
12	Windows Server 2016	16.7σ 125.8→586.5/q	0.6σ10.8→13.0/q	-0.0 7.4→7.3
13	Windows Server 2016 (Server Core installation)	16.5σ 125.3→586.5/q	0.7σ10.5→13.0/q	-0.0 7.4→7.3
14	Microsoft Word 2016	16.1σ 2.7→34.5/q	-0.4σ0.1→0.0/q	-0.1 7.4→7.3
15	Windows Server 2012 R2	15.9σ 104.7→456.5/q	0.6σ9.1→11.0/q	-0.1 7.4→7.3
16	Windows Server 2012 R2 (Server Core installation)	15.7σ 104.4→456.5/q	0.6σ9.1→11.0/q	-0.1 7.4→7.3
17	Windows Server 2012	15.5σ 99.2→431.5/q	0.4σ8.6→10.0/q	-0.1 7.5→7.4
18	Windows Server 2012 (Server Core installation)	15.4σ 99.0→431.5/q	0.4σ8.6→10.0/q	-0.1 7.5→7.4
19	AIX	15.0σ 4.1→72.5/q	-0.3σ0.1→0.0/q	+0.7 7.1→7.8
20	WebSphere Application Server	14.6σ 2.6→27.5/q	—	+1.2 5.7→6.9

Total Tracked CVEs

New 24h–

New 7d–

Active Exploits / KEV

Exploited 24h–

Exploited 7d–

Actionable · KEV or EPSS ≥ 10%

of in-scope–

Critical CVSS–

CVSS Severity Distribution

Dicing tomatoes…

% With Exploit

% Post-Patch Exploit

Median Days to Patch

discovery → disclosure

Median Days to Exploit

patch → exploit

Exploit Rate Over Time

⤢ expand

Seasoning with salt hashes…

% of CVEs per period with a known exploit.

Exploit Count Over Time

⤢ expand

Flambéing the firewall…

Absolute number of CVEs with a known exploit per period.

Days to Patch

⤢ expand

Brewing fresh queries…

Discovery → public disclosure (0–1825 day window).

Days: Patch → Exploit

⤢ expand

Fermenting the results…

Days from public patch to first known exploit/PoC.

Want the context behind these numbers? Read our breakdown of the 2026 CVE surge, or get the daily brief:

CVE Analysis — Exploit Trends, CVSS Distribution & Patch Metrics

Vulnerabilities Trends — rolling 30-day windows

Top Vulnerability Classes by Exploit Count

CVE Surge — Possible AI-Assisted Bug Hunting Last 2 Quarters

CVSS Severity Distribution

Exploit Rate Over Time

Exploit Count Over Time

Days to Patch

Days: Patch → Exploit

CVE Analysis — Exploit Trends, CVSS Distribution & Patch Metrics

Vulnerabilities Trends — rolling 30-day windows

Top Vulnerability Classes by Exploit Count

CVE Surge — Possible AI-Assisted Bug Hunting Last 2 Quarters

CVSS Severity Distribution

Exploit Rate Over Time

Exploit Count Over Time

Days to Patch

Days: Patch → Exploit

SHARE INTELLIGENCE WIRE