CVE Tools
Track your stack

How we compute the trends

Every trend number comes from a monthly snapshot: once a month is over, one run counts its CVEs, vendors, weaknesses and sectors and stores the result. When a data fix lands, the affected months are recomputed in place, so a report always shows the current count, and the method's version would change if the method did.

Definitions

What each number on the trend pages counts, with its value in Aug 2026 where the snapshot series carries it.

Month
A calendar month in UTC. A month is complete once it has ended; the month in progress is recomputed as it goes and read "so far", with a pace estimate where the pages give one.
Aug 2026 in Aug 2026, open the reportlast complete month
CVEs published
Distinct CVE IDs whose publication date falls in the month, across every source merged into one record per CVE.
12,909 in Aug 2026, open the report
Critical
CVEs with a CVSS base score of 9.0 to 10.0. CVEs without a score yet are not counted in any severity. Severity says how bad a flaw could be, not whether anyone exploits it.
1,589 in Aug 2026, open the report15% of 10,466 scored
Added to CISA KEV
Entries CISA added to its Known Exploited Vulnerabilities catalog during the month, whatever year the CVE is from. Counted from the catalog's own date added. The catalog starts in November 2021, so earlier months carry no KEV mark.
31 in Aug 2026, open the report
In CISA KEV
Of one month's own CVEs (or one vendor's CVEs that month), how many are in the catalog today. It grows as CISA lists older CVEs, so it is never the same number as "added".
in each report and full record
Median days to KEV
For the month's CVEs that are now in KEV, the median days from publication to CISA's date added.
2.5 days in Aug 2026, open the report
Change on a month
CVEs published against the month before and against the same month a year earlier, over the stored snapshots. Above double it reads as a multiple (3.3×).
3.3× in Aug 2026, open the reporton Aug 2025
Vendors
Distinct vendors named in the affected products of the month's CVEs, before any alias is folded in.
2,151 in Aug 2026, open the report5,622 products
Rank
Vendors ranked by distinct CVEs in the month, ties broken by name. Each snapshot keeps the top 200 vendors and the top 50 weakness classes (CWE).
in each report
Below the cut
A month a vendor or weakness is missing from the list. When the list was full it had at most the smallest count that made it, so the full records show that ceiling, hatched. When the list had room it truly had none.
on each full record
Rank change
Places moved since the month before: +3 climbed three places, −2 fell two, "new" was not on the list before.
in each report
New in the top 100
A vendor in the month's top 100 that was in none of the 24 monthly top-100 lists before it.
in each report
Breakout
A vendor's CVEs in the month divided by its median over the 12 months before. At 3× or more it is listed as a breakout.
in each report
Which weakness, where
Distinct CVEs for each weakness class against each vendor, or against each sector of the affected software, for the month's top classes.
in each report

Held back for now

Layers we compute but do not show, because the data under them is wrong or stale. Each comes back when its fix and a recompute land.

  • Nuclei coverage and the detection gapThree of the four template mirrors stopped updating in March 2026, so every month since would read as a detection gap that is not there.Hidden on the trend pages. The verification page lists each template source with its own freshness.
  • Public exploit countsSome vendors use the exploit field of their advisories to deny exploitation ("not aware of any"), and those statements were counted as exploits.No exploit count or amber layer on the trend pages and hubs until the fix and a recompute land.
  • Sector critical and KEVA sector's critical and KEV numbers counted a CVE once per affected product, not once per CVE.Sector pages show volume only until the counts are made distinct and recomputed.

Sources

The feeds we mirror. Vulnerability records merge into one record per CVE; the rest attach exploitation and detection context to it.

  • CVE List V5The CVE records themselves, as CNAs publish them.Every count
  • NVDCVSS vectors and scores, CWE assignments, product configurations.Severity, weakness classes
  • GitHub advisories (GHSA)Advisories for open source packages, with affected versions.Vendors and products
  • CSAF advisoriesVendor security advisories in the CSAF format.Vendors and products
  • BDU (FSTEC)The Russian national vulnerability database.Every count
  • CISA KEVThe catalog of vulnerabilities CISA confirms exploited, with the date each was added.KEV marks and counts
  • EPSSFIRST's daily probability that a CVE is exploited in the next 30 days.CVE pages, not the trend snapshots
  • Nuclei templatesPublic detection templates, from the official repository and community and AI mirrors.Held back on the trend pages

How a snapshot is made

A durable workflow computes one isolated run per month, so one bad month never blocks the rest.

  1. After the month closesA scheduler starts a run for every month and every ISO week once it ends; a backfill covers every month since the first CVE records in 1999.
  2. One run per monthThe run computes the overview (totals, severity, KEV), the top 200 vendors with rank changes, newcomers and breakouts, the top 50 weakness classes, the sector breakdown, and how fast CVEs reach KEV.
  3. Recomputed in placeRows are keyed by month and snapshot version. Running a month again replaces its rows rather than adding to them, which is how data fixes reach old months.
  4. Then across monthsA last pass recomputes the changes between months (month on month, year on year, rank movement) and clears the public API cache.

Sector tagging

Every vendor and product pair is placed in one of 15 sectors, and one subsector, from a fixed, versioned taxonomy. It answers "what kind of software is being hit".

Rules first, a model for the rest. Package-registry vendors (npm, PyPI, Maven, Go, RubyGems, crates.io, NuGet, Packagist, Hex, pub) map to the open source libraries sector by rule. Everything else is classified by a language model in two passes: vendors first, then the products of large vendors that span several sectors.

Stored, versioned, reviewable. Tags live in one map the snapshots join against; a snapshot never calls the model. Changing the taxonomy version re-queues every machine tag, while tags a person reviewed are pinned and survive. Pairs the model is unsure about stay "unknown".

Counting. A CVE that affects products in two sectors counts once in each, so sector totals add up to more than the month's CVEs.

Vendors classified
54,72186% with a known sector
Reviewed by a person
46vendor tags, pinned
With a home country
3,370vendors
Products tagged one by one
134,792taxonomy v1, last run Jun 2026

A sector, country or vendor type looks wrong? Report a misclassification; confirmed fixes are pinned and survive re-tagging.

Known limits

  • KEV is CISA's viewThe catalog lists what CISA confirms exploited, with a US federal lens. It is a floor for exploitation, not a census.
  • SaaS undercountsCloud services often fix silently and never file a CVE, so deployment-model comparisons inherit that gap.
  • Country is the vendor's homeNot where the code was written or runs. Read country figures as where disclosures come from.
  • Machine tags carry confidenceVendors the model cannot place fall back to "unknown" rather than a guess, and long-tail tags are less reliable than the head.

The trend API is public and unauthenticated under /api/public/trends, and every report and full record exports its rows as CSV and JSON.

All months on recordAll 15 sectors

We use analytics cookies to see which pages and articles actually help people. Decline and none of them run — the site works the same. What we store