CISA KEV Statistics
The flaws attackers are using, counted: how many, how fast, and whose software.
- Flaws on the list
- 1,779
- Added in 12 months
- 323
- Listed by day one
- 20%
- Used in ransomware
- 20%
Key Findings
- 1,779 flaws are on CISA's Known Exploited Vulnerabilities catalogue, and 323 were added in the past 12 months: about 6 a week.
- CISA has added 295 flaws so far in 2026, 34% more than the 220 it had added by the same date in 2025.
- In the past two years, 20% of newly listed flaws were on the list by the day the CVE was published, and 42% within a week of it.
- The other side: 20% of flaws listed in the past two years were more than a year old when CISA listed them.
- Microsoft accounts for 22% of the catalogue (391 flaws), more than the next 4 vendors put together.
- 20% of listed flaws (361) are known to have been used in ransomware attacks.
- Only 36% of exploited flaws score 9 or more on CVSS, so patching only the critical ones misses most of the flaws attackers use.
- Old flaws still matter: 29 of the flaws added in 2026 are five or more years old, the oldest CVE-2008-4128.
Flaws Added Each Month
Show as a table
| Month | Added |
|---|---|
| November 2026 | 13 |
| September 2026 | 43 |
| August 2026 | 31 |
| July 2026 | 26 |
| June 2026 | 23 |
| May 2026 | 21 |
| April 2026 | 31 |
| March 2026 | 26 |
| February 2026 | 28 |
| January 2026 | 17 |
| December 2025 | 20 |
| November 2025 | 11 |
| September 2025 | 16 |
| August 2025 | 15 |
| July 2025 | 20 |
| June 2025 | 20 |
| May 2025 | 24 |
| April 2025 | 15 |
| March 2025 | 32 |
| February 2025 | 27 |
| January 2025 | 14 |
| December 2024 | 16 |
Added Each Year
| Year | Added |
|---|---|
| 2021 | 311 |
| 2022 | 555 |
| 2023 | 187 |
| 2024 | 186 |
| 2025 | 245 |
| 2026 | 295 |
By CVSS Score
| Score | Flaws | Share |
|---|---|---|
| Critical (9-10) | 640 | 36% |
| High (7-8.9) | 936 | 53% |
| Medium (4-6.9) | 197 | 11% |
| Low (under 4) | 6 | under 1% |
Time From CVE to Listing
| Listed by the day the CVE was published | 20% |
| Within a week | 42% |
| Middle value | 16 days |
| More than a year later | 20% |
Most Common Weaknesses
| Weakness | Flaws |
|---|---|
| Input not checked properly | 127 |
| OS command injection | 116 |
| Out-of-bounds write | 109 |
| Use after free | 99 |
| Memory buffer error | 94 |
| Path traversal | 82 |
| Code injection | 77 |
| Unsafe deserialisation | 75 |
| Broken authentication | 52 |
| Missing authentication | 47 |
Don't wait for the list
Get an email within half an hour when a flaw in your software is added. Free.
About These Figures
Where do these numbers come from?
CISA's Known Exploited Vulnerabilities catalogue, with CVSS scores and publication dates from the NVD. CVE Hawk checks the catalogue every hour and works the figures out again from it.
Why are 2021 and 2022 so high?
The catalogue started in November 2021 with a backlog of flaws already known to be exploited, and CISA kept adding older flaws through 2022. From 2023 the yearly counts show new additions.
How is "on the list by the day the CVE was published" worked out?
For each flaw listed in the past two years: the day CISA added it compared with the day the NVD published the CVE. Zero or fewer days means attackers were using it by the time it was public.
Can I use these figures?
Yes. Quote them with a link to this page. The CSV has every flaw with the fields behind each figure.