GeekWala Research
Original, primary-source research on CVE exploitation, CISA KEV listing patterns, and package-registry advisory lag. Every dataset below is CC BY 4.0 licensed and downloadable.
The 10% Problem — What 12 Months of KEV Data Says About CVE Exploitation
Published August 8, 2026
A 12-month audit of how few published CVEs ever become known-exploited, how long KEV listings take, and whether EPSS predicts them.
Advisory Lag 2026 — We Measured It, and It Isn't There
Published August 4, 2026
We measured the gap between NVD disclosure and the matching package-registry advisory across 8 ecosystems and 48,162 CVEs. The median is same-day. The real gap is coverage, not speed.