FlagThis | CVE Analysis

CVE Analysis Exploit metrics & risk CVE List Real-time tracking & triage Vendors Vendor risk scorecards Products Product security scores Top Discussed Trending on social

CVE Analysis

How CVE volume, exploitation, and patch/exploit timing are trending over time

Vulnerabilities Trends — rolling 30-day windows

Marinating threat data…

Metrics Over Time

Updating… Trailing windows

Each column counts CVEs published within that trailing window. Vendor / product / min-CVSS filters apply to the whole table.

Metric	1D	1W	30D	90D	1Y	2Y	5Y	All
Volume
New CVEs	1,384	3,906	14,219	33,166	80,641	126,237	213,642	374,674
Critical (9.0+)	167	444	1,825	4,266	8,637	12,716	23,424	46,425
High (7.0–8.9)	768	1,635	6,130	14,035	31,698	47,099	78,862	135,899
Exploitation
Known Exploits	3	32	253	794	2,792	4,481	8,267	34,589
% With Exploit	0.2%	0.8%	1.8%	2.4%	3.5%	3.5%	3.9%	9.2%
Actively Exploited (KEV)	0	1	20	57	208	399	858	1,709
Exploited After Patch	0	8	50	166	410	595	1,004	9,170
% Post-Patch Exploit	0.0%	0.2%	0.4%	0.5%	0.5%	0.5%	0.5%	2.4%
0-Day (Before Patch)	0	1	13	50	99	245	299	14,555
Timing
Avg Days to Patch	22d	32d	32d	34d	71d	152d	132d	106d
Avg Days to Exploit	—	12d	36d	32d	69d	116d	180d	262d

CVE Surge — Possible AI-Assisted Bug Hunting Last 2 Quarters

Vendors and products active for 4+ years whose newly-published CVEs jumped sharply over the last ~180 days versus their own 5-year baseline — a pattern often tied to new AI-assisted bug-finding & fixing programs. This data doesn't reveal who is discovering the bugs — they may be found by the vendor's own teams or reported by external researchers. Jump is how many standard deviations the recent per-quarter rate sits above the historical quarterly mean, shown for both all CVEs (the sort order) and exploited CVEs. Δ Severity is the change in average CVSS base score — which may hint at the quality of the bugs being found or at how the vendor is prioritizing which issues to fix (a drop toward lower-severity bugs is also common with AI fuzzing noise). Each cell's small text is baseline → recent. Click any name to open it in the analysis filters below.

Top Vendors

#	Vendor	CVE Jump	Expl Jump	Δ Severity
1	Oracle Corporation	33.6σ 84.2→1187.5/q	6.3σ2.5→13.0/q	+1.8 5.8→7.6
2	Apache Software Foundation	20.3σ 57.3→357.0/q	12.1σ8.0→46.0/q	+0.0 7.3→7.4
3	Microsoft	17.7σ 273.4→1356.0/q	2.1σ21.1→32.5/q	+0.1 7.3→7.4
4	google	14.1σ 202.7→1450.5/q	3.5σ10.8→28.0/q	-0.1 7.1→7.0
5	Elastic	9.9σ 7.3→70.0/q	-0.4σ0.2→0.0/q	-0.3 6.4→6.1
6	grafana	9.3σ 4.5→24.0/q	1.6σ0.5→1.5/q	+0.0 6.5→6.6
7	splunk	8.6σ 11.0→66.0/q	1.0σ0.4→1.0/q	+0.1 6.4→6.5
8	Wireshark Foundation	8.5σ 5.3→42.0/q	—	-1.0 6.4→5.4
9	IBM	8.1σ 118.6→437.0/q	3.0σ0.8→3.5/q	+1.3 5.8→7.1
10	dataease	7.4σ 4.3→21.5/q	1.1σ0.1→0.5/q	-0.3 8.1→7.8
11	Rapid7	7.4σ 2.7→21.0/q	-0.4σ0.1→0.0/q	+1.4 5.6→7.0
12	vercel	7.2σ 2.5→15.5/q	1.6σ0.5→1.5/q	+0.4 6.0→6.4
13	TYPO3	6.1σ 5.5→28.5/q	-0.3σ0.1→0.0/q	+1.1 5.6→6.7
14	Dell	5.8σ 56.0→176.5/q	-0.5σ0.2→0.0/q	+0.0 6.6→6.6
15	checkpoint	5.5σ 2.0→7.5/q	3.6σ0.1→1.0/q	+1.0 6.8→7.9
16	hashicorp	5.4σ 6.3→20.5/q	6.2σ0.1→2.0/q	+0.2 6.5→6.8
17	ericsson	5.0σ 2.4→8.5/q	-0.4σ0.1→0.0/q	-0.9 6.9→6.0
18	Devolutions	4.9σ 6.7→27.0/q	—	-1.0 6.6→5.7
19	jetbrains	4.8σ 19.3→55.0/q	-0.1σ0.6→0.5/q	+1.1 5.5→6.6
20	discourse	4.8σ 11.1→46.0/q	-0.5σ0.4→0.0/q	-0.1 5.4→5.2

Top Products

#	Product	CVE Jump	Expl Jump	Δ Severity
1	Chrome	35.0σ 71.0→1332.0/q	8.2σ3.9→23.0/q	-0.6 7.6→7.0
2	i	30.6σ 2.8→69.5/q	-0.3σ0.2→0.0/q	-0.0 6.7→6.6
3	Visual Studio Code	22.5σ 1.7→17.0/q	-0.5σ0.3→0.0/q	+0.3 7.4→7.7
4	zephyr	20.9σ 5.1→65.5/q	2.7σ0.1→1.0/q	-1.1 7.1→6.0
5	Microsoft SharePoint Server Subscription Edition	20.0σ 6.1→62.5/q	3.2σ0.6→3.5/q	-0.8 7.7→6.8
6	Windows 10 Version 1809	18.9σ 122.9→658.0/q	0.7σ10.8→13.0/q	-0.0 7.3→7.3
7	Windows 10 Version 21H2	16.9σ 130.1→643.5/q	0.2σ11.5→12.0/q	-0.1 7.3→7.3
8	Windows 10 Version 1607	16.6σ 105.6→568.0/q	0.3σ9.6→10.5/q	-0.0 7.4→7.3
9	Microsoft Word 2016	16.3σ 2.7→35.0/q	-0.4σ0.1→0.0/q	-0.1 7.4→7.3
10	Windows Server 2022	15.5σ 141.5→717.0/q	0.7σ12.2→14.5/q	-0.0 7.4→7.3
11	Windows Server 2019	15.1σ 137.8→677.0/q	0.9σ11.6→14.5/q	-0.0 7.3→7.3
12	AIX	15.0σ 4.1→72.5/q	-0.3σ0.1→0.0/q	+0.7 7.1→7.8
13	Windows Server 2019 (Server Core installation)	15.0σ 137.3→676.5/q	1.0σ11.3→14.5/q	-0.0 7.3→7.3
14	Kibana	14.1σ 3.6→48.0/q	-0.4σ0.1→0.0/q	-0.4 6.5→6.1
15	postgresql	14.1σ 2.1→19.5/q	3.2σ0.2→1.5/q	+0.6 6.4→7.0
16	Microsoft Office 2019	13.5σ 15.4→157.0/q	-0.9σ1.1→0.0/q	-0.3 7.6→7.2
17	Windows Server 2016	13.5σ 120.6→586.5/q	0.4σ10.4→12.0/q	-0.0 7.4→7.3
18	Windows Server 2016 (Server Core installation)	13.4σ 120.2→586.5/q	0.5σ10.1→12.0/q	-0.0 7.4→7.3
19	WebSphere Application Server	12.7σ 2.5→24.0/q	—	+1.5 5.6→7.1
20	Windows Server 2012 R2	12.7σ 100.4→456.5/q	0.3σ8.8→10.0/q	-0.1 7.4→7.3

Total Tracked CVEs

New 24h–

New 7d–

Active Exploits / KEV

Exploited 24h–

Exploited 7d–

Actionable · KEV or EPSS ≥ 10%

of in-scope–

Critical CVSS–

CVSS Severity Distribution

Dicing tomatoes…

% With Exploit

% Post-Patch Exploit

Median Days to Patch

discovery → disclosure

Median Days to Exploit

patch → exploit

Exploit Rate Over Time

⤢ expand

Seasoning with salt hashes…

% of CVEs per period with a known exploit.

Exploit Count Over Time

⤢ expand

Flambéing the firewall…

Absolute number of CVEs with a known exploit per period.

Days to Patch

⤢ expand

Brewing fresh queries…

Discovery → public disclosure (0–1825 day window).

Days: Patch → Exploit

⤢ expand

Fermenting the results…

Days from public patch to first known exploit/PoC.

Want the context behind these numbers? Read our breakdown of the 2026 CVE surge, or get the daily brief:

CVE Analysis — Exploit Trends, CVSS Distribution & Patch Metrics

Vulnerabilities Trends — rolling 30-day windows

Top Vulnerability Classes by Exploit Count

CVE Surge — Possible AI-Assisted Bug Hunting Last 2 Quarters

CVSS Severity Distribution

Exploit Rate Over Time

Exploit Count Over Time

Days to Patch

Days: Patch → Exploit

CVE Analysis — Exploit Trends, CVSS Distribution & Patch Metrics

Vulnerabilities Trends — rolling 30-day windows

Top Vulnerability Classes by Exploit Count

CVE Surge — Possible AI-Assisted Bug Hunting Last 2 Quarters

CVSS Severity Distribution

Exploit Rate Over Time

Exploit Count Over Time

Days to Patch

Days: Patch → Exploit

SHARE INTELLIGENCE WIRE