About the data
Every number on this site comes from three public datasets and is updated every day.
Sources
| Dataset | Version | As of | Terms |
|---|---|---|---|
| CVE List V5 (CVE Program) | cve_2026-10-28_0000Z | 28 Oct 2026 | Published under the CVE Program Terms of Use. CVE is a registered trademark of The MITRE Corporation. |
| FIRST Exploit Prediction Scoring System (EPSS) | v2026.06.15 | 28 Oct 2026 | Published by FIRST.org (Forum of Incident Response and Security Teams); credit required. |
| CISA Known Exploited Vulnerabilities (KEV) catalog | 2026.10.27 | 27 Oct 2026 | U.S. government work; CISA publishes the catalog without copyright restriction. |
What is counted
- Published CVE records: 396,180 as of 28 Oct 2026. Rejected records are not counted.
- Records are counted in the year and month of their publication date, in UTC. The current month and year are not finished and are marked as partial.
- "Last three years" means the three years up to the as-of date (28 Oct 2026).
Severity
Severity is the CVSS rating published for a record. Records without a published CVSS score are shown as not scored:173,339 of the 396,180 published records (43.8%) as of 28 Oct 2026. Shares of "critical or high" on vendor pages are shares of scored records, and the not-scored share is always shown next to them.
Vendors
Records are assigned to the vendors named in the source records. A record that names several vendors counts for each of them. Records that name no vendor are included in the totals on the home page but on no vendor page. Product lines and corporate groups appear as the sources name them.
Exploitation signals
- KEV lists vulnerabilities CISA has evidence of being exploited. "Tied to ransomware" is CISA's own flag; "Unknown" means CISA has no evidence, not that there is none.
- Days from publication to KEV is the number of days between a record's publication date and the date CISA added it to KEV, as a median. It can be negative: CISA sometimes lists a vulnerability before its CVE record is published.
- EPSS is the probability, between 0 and 100%, that a vulnerability is exploited in the next 30 days, as estimated by FIRST's model. Scores change daily; the ones shown are those at the as-of date.
What the numbers measure
- A count of CVE records measures how much a vendor reports and publishes, not how secure its products are. Vendors that run a CNA and disclose thoroughly look worse than those that do not.
- KEV is evidence of exploitation known to one agency, and it leans towards products used by U.S. government networks.
Trademarks and independence
CVE is a registered trademark of The MITRE Corporation, used here only to refer to records in the CVE List. VulnTide is not affiliated with or endorsed by MITRE, CISA, FIRST or any vendor named on this site.