CVE Trends · official CVE list + CISA KEV · nothing tracked
Every CVE published since 1999, counted from the CVE Program's own records, next to the vulnerabilities CISA has confirmed attackers are using. The gap between the two charts is the whole case for prioritizing by exploitation instead of by volume.
CVEs published this year
–
loading…
Projected for the year
–
at the current pace
Added to KEV this year
–
confirmed exploited
Ever confirmed exploited
–
of all published CVEs
Records in the official CVE list, by publication date. Rejected IDs excluded.
Vulnerabilities CISA has evidence of attackers using, by date added. Live from the catalog.
As named by the reporting CNA. Volume reflects how much software a vendor ships and how actively it reports, not how insecure it is.
CVE volume keeps climbing every year. No team patches everything, so "patch all criticals" quietly turns into "patch nothing on time".
The second chart is what attackers actually use. Start your patch queue there, then rank the rest by exploitation probability. The method is in our KEV and EPSS guide.
Which of these hit your products? Run a stack check.
Want the new KEV entries each week, already triaged? Get the threat brief.
We build prioritization pipelines on exactly these signals, wired into your scanner, SIEM and ticketing.
Method. CVE counts come from the CVE Program's cvelistV5: every record in state PUBLISHED, counted on its datePublished (UTC). Rejected IDs are excluded; a few legacy records dated before 1999 are counted on 1 January 1999. KEV counts come live from CISA's catalog by dateAdded; the catalog started in November 2021 and includes older CVEs, so a KEV addition is dated when CISA confirmed exploitation, not when the CVE was published. The current period is partial and drawn lighter. Projections are a straight-line extrapolation of this year's pace, nothing cleverer.