What is changing in the CVE corpus?
Volume, severity, and exploitation evidence from the retained local snapshot. Each number keeps its date basis; missing values stay unknown.
0 records carry confirmed-exploitation evidence; 0 have no primary severity score.
Snapshot updated · CVE List 2447ce37 · KEV not recorded · EPSS 2026-10-29
Latest month: not recorded · 0 published · no estimates where the source is silent.
Publication volume
Monthly CVE publications in the retained snapshot. Select a month to inspect it; the chart window switches without changing the corpus.
How to read
Cumulative growth
The running total inside this window. It is cumulative, not a forecast.
No publication history in this window.
Severity composition
Primary CNA CVSS only. Click a band to filter Explore; unscored is an explicit band, never low.
How to read
EPSS distribution
Log-spaced probability buckets reveal the base rate: most records sit far below 10%.
How to read
0.00% of scored records sit below a 10% probability. Log height keeps the tail visible. Score date 2026-10-29.
Data table
| EPSS bucket | Records | Share |
|---|---|---|
| <0.1% | 0 | 0.00% |
| 0.1–0.5% | 0 | 0.00% |
| 0.5–1% | 0 | 0.00% |
| 1–2% | 0 | 0.00% |
| 2–5% | 0 | 0.00% |
| 5–10% | 0 | 0.00% |
| 10–20% | 0 | 0.00% |
| 20–50% | 0 | 0.00% |
| 50–100% | 0 | 0.00% |
Joint distribution: severity × forecast
Every cell is an exact count from the accepted snapshot. Selection updates the inspector; arrow keys move between cells.
How to read
Swipe horizontally to see every EPSS bucket.
397,508 records have a current EPSS row; 0 are not on the probability axis. Unscored CVSS is an explicit row, never zero severity. KEV rings mark cells containing at least one catalog entry.
KEV rhythm
Catalog additions by month. This is listing activity, not exploitation volume.
0 catalog additions in twelve months. This is catalog activity, not exploitation volume: a quiet month means no new listings.
Source freshness
How old the snapshot is, and what each state means for the numbers.
2 of 3 current: CISA KEV missing. Freshness explains how old the numbers are; it never changes the numbers themselves.
CVE List V5: Recent CVEs may be missing from this snapshot. CISA KEV: No snapshot accepted yet; dependent counts are empty. FIRST EPSS: Forecasts stay dated; older scores are never relabeled current.
How this page stays honest
No score stitching, no silent zeros, no interpolation.
- Unknown stays unknown. Missing EPSS is not zero; missing CVSS is Unscored, not low.
- Three signals, never one score. KEV is evidence, EPSS is a dated forecast, CVSS is supplied severity.
- Every share names its denominator. Charts and tables use the same accepted snapshot.
Read the methodology and data status for ordering rules, coverage gaps, and reuse notices.
Priority evidence
Four deterministic views. Each shows the signal that put a record there; none invents a composite score.
No priority lists yetThe retained snapshot holds no published records, so every list is empty.
Known exploited
Full listKEV catalog date descending, then CVE ID.
No KEV-listed records in the retained snapshot.
Highest forecast
Full listRaw EPSS probability descending; unknown sorts after every known value.
No scored forecasts in the retained snapshot.
New critical
Full listPublished in the trailing 30 days with a primary CNA CVSS of 9.0 or higher.
Rising forecast
Full listSame-model 7-day probability rise; cross-model comparisons are ineligible.
No rising forecasts in the retained window.