CVE and Vulnerability Exploitation Statistics
Key figures from GeekWala's original research. Every statistic below shows the exact count it was measured over — the population matters as much as the percentage.
Updated whenever the KEV Exploitation and Advisory Lag reports below are regenerated — see each report for its own "generated_at" date. No automated recurring refresh is scheduled for either dataset.
KEV Exploitation 2026: CISA KEV catalog vs. EPSS lead time, 8 open-source package ecosystems, trailing 12 months
Data generated August 4, 2026Measurement window: August 4, 2025 through August 4, 2026 (CISA KEV dateAdded (for KEV-side counts) and NVD/OSV CVE publication date (for the ecosystem population denominator), trailing 365 days from data-collection date.)
0.19%
Newly published CVEs that reached CISA KEV within the window
18 of 9,427 — CVEs newly published across 8 tracked package ecosystems in the trailing 12 months.
10%
CISA KEV additions (any vendor/product) that touch an open-source package
27 of 269 — Every CISA KEV catalog entry added in the trailing 12 months, across all vendors and products.
Prakash, S. (2026). The 10% Problem -- What 12 Months of KEV Data Says About CVE Exploitation. GeekWala Research. CC BY 4.0. https://www.geekwala.com/research/kev-exploitation-2026
Advisory Lag 2026: NVD-to-OSV advisory publication lag, 8 package ecosystems, calendar year 2025
Data generated August 4, 2026Measurement window: January 1, 2025 through December 31, 2025 (NVD CVE published date (calendar year 2025))
7.18%
CVEs published in the window with a matched, measurable registry advisory
3,456 of 48,162 — CVEs published on NVD in calendar year 2025 across 8 tracked package ecosystems.
0.01 days
Median NVD-to-OSV advisory publication lag
n = 3,513 — Matched CVE-to-advisory pairs with a measurable publication-date gap.
GeekWala Research (2026). Advisory Lag 2026: NVD-to-OSV Advisory Publication Lag Dataset. CC BY 4.0. https://www.geekwala.com/research/advisory-lag-2026