Research

Statistics

Comprehensive overview of known exploited vulnerabilities and their characteristics — catalog growth, Beyond CISA KEV coverage, sensor telemetry, and enrichment distributions.

KEV Feed Research and Data Pricing

Total KEVs: 2,846; Known exploited vulnerabilities tracked
KEVs (Last 30 Days): 227; Recently added to Previdian
CISA KEVs: 1,705; Also listed in the official catalog
Beyond CISA KEV: 1,141; Additional exploited vulnerabilities beyond CISA
Total Tags: 32; Tags applied across the catalog
Total Vendors: 930; Distinct affected vendors

Weekly

Intelligence Highlights

Rolling last 7 days by KEV added date. “Ahead of CISA” is by CISA listing date and uses operational sources only (excludes CVE metadata ingest). Sensor counts reflect observed exploitation attempts in the honeypot and sensor network (90-day aggregate history; lifetime first/last observed preserved).

Last 7 Days

34
New KEVs: 25
Beyond CISA KEV: 9
In CISA: 10
Ahead of CISA: 34h
Avg Faster: 12h
Median Faster

Sensor Telemetry

174
KEVs in Sensors: 136
Active (7d): 34,059
Exploitation Events (7d): 873
Unique Attackers (7d)

Ahead of CISA This Week

CVE	Vendor / Product	Lead
CVE-2026-81963	Microsoft / Windows 11 version 23H2, Windows 11 Version 23H2, Windows 11 Version 24H2, Windows 11 Version 25H2, Windows 11 version 26H1, Windows Server 2025, Windows Server 2025 (Server Core installation)	Recorded 12 hours before CISA KEV
CVE-2026-85880	Microsoft / Windows 10 Version 1607, Windows 10 Version 1809, Windows 10 Version 21H2, Windows 10 Version 22H2, Windows Server 2012, Windows Server 2012 (Server Core installation), Windows Server 2012 R2, Windows Server 2012 R2 (Server Core installation), Windows Server 2016, Windows Server 2016 (Server Core installation), Windows Server 2019, Windows Server 2019 (Server Core installation), Windows Server 2022	Recorded 12 hours before CISA KEV
CVE-2026-87491	Google / Chrome	Recorded 11 hours before CISA KEV
CVE-2026-85046	Google / Chrome	Recorded 10 hours before CISA KEV
CVE-2026-20079	Cisco / Cisco Secure Firewall Management Center (FMC)	Recorded 3 hours before CISA KEV
CVE-2026-86060	Mikrotik / RouterOS	Recorded 3 hours before CISA KEV
CVE-2026-19490	NetScaler / ADC, Gateway	Recorded 6 days before CISA KEV
CVE-2026-75650	Adobe / Adobe Commerce, Adobe Commerce B2B, Magento Open Source	Recorded 3 days before CISA KEV
CVE-2026-86218	N-able / N-central	Recorded 2 days before CISA KEV
CVE-2025-25249	Fortinet / FortiSwitchManager, FortiOS	Recorded 1 day before CISA KEV

Trends

Catalog growth over time and by year added.

KEVs Over Time (Last 12 Months)

KEVs by Year Added

Note: CISA KEV launched on November 3rd, 2021. Previdian launched on April 30th, 2025.

KEVs by Tag

Distribution

Table

Tag	KEV Count
cisa	1705
nuclei_scanner	1256
windows	438
metasploit	420
nessus_scanner	368
microsoft	330
malware	330
edge	302
ransomware	261
ios	180
php	150
macos	98
linux	97
java	90
wordpress	79
apache	69
android	49
dotnet	29
joomla	13
python	10
drupal	6
elasticsearch	5
magento	4
nodejs	3
redis	3
ruby	3
postgresql	3
qilin ransomware	3
mysql	2
mongodb	1
mirai	1

Vendors

Distribution

Top 10 Vendors by KEV Count

Top 10 Vendors with Edge KEVs

Vendors with the most KEVs tagged as 'edge' (edge computing, edge devices, etc.)

Severity

CVSS Score Distribution

Each chart shows the distribution of CVSS scores for all KEVs. Only KEVs with a score for that version are included in the chart.

CVSS v4.0

CVSS v3.0

CVSS v2.0

EPSS

EPSS Analysis

EPSS Score Distribution (Last 30 Days)

Top 10 KEVs by EPSS Score

Activity

CVE Analysis

Top 10 KEVs by News Mentions

Based on mentions in security news articles and advisories

Top 10 KEVs by Proof of Concepts

Based on publicly available unverified proof of concept exploits

Timing

Exploitation Analysis

Time Between CVE Publication and KEV Listing

Note: This shows the time between CVE publication and KEV listing, not necessarily when exploitation began