Research

Volume is rising and severity is not falling with it, so the corpus is getting bigger without getting milder — but publication volume measures disclosure, not risk, and a quiet month is not a safe one.

CVE publication volume — monthly

CVSS distribution by quarter

Substantively-modified CVEs — weekly

Where this comes from. Built from the CVE corpus this pipeline ingests (NVD, EPSS, and our per-CVE annotations). These are publication-side signals: what was disclosed, when, and at what severity. A rising line here is not evidence of rising attacks — that question is the next one.

What changed recently in this area →

KEV is the only confirmed-exploited signal here and it is a floor, not a census: it counts what CISA has confirmed, so everything else on this tab is an estimate of pressure rather than a count of attacks.

CISA KEV — additions per month

Time from publication to KEV listing

Ransomware-attributed share of new KEV entries

Exploit pressure of the CVE corpus

Attacker-attributed CVEs — weekly

Where this comes from. Built from CISA's KEV catalog (confirmed exploited in the wild), EPSS probabilities, and ransomware flags on KEV entries. This is not attacker telemetry. It measures what is publicly known to be exploited, so it lags real exploitation and undercounts anything nobody reported.

What changed recently in this area →

The weakness mix moves slowly, which is the finding — the same handful of CWEs stay at the top year after year, so a defence tuned to last year's ranking is mostly still tuned to this year's.

Top weaknesses (CWE) — rank shift across years

ATT&CK techniques mapped to recent CVEs — rank shift

Tactic coverage of recent CVEs (Σ EPSS)

Where this comes from. Built from CWE assignments on published CVEs and our CWE→ATT&CK cross-walks. Rank shifts are shifts in what gets assigned; a weakness class can move because analyst practice changed rather than because attackers did.

What changed recently in this area →

Vendor CVE counts measure disclosure practice as much as product quality: a vendor that publishes diligently outranks one that stays quiet, so read high counts as visibility, not as a verdict.

Vendor cohorts — monthly CVE volumeAI

Per-vendor sparklines — monthly CVE counts

Top-15 vendors by KEV adds (quarterly)

Product categories compared — six metrics side by side

Where this comes from. Built from CPE product matches on CVEs, with CNA-assignment fallback where CPE data lags. Vendors ship different amounts of software and disclose at different rates, so volume here reads as attention and surface, not as relative product quality.

What changed recently in this area →

One chart, honestly. This is the thinnest evidence on the page: it shows which control families our mappings attach to recent CVEs, which is a statement about our cross-walks before it is a statement about your controls.

Control family share of mitigations

Where this comes from. Built from our control↔weakness cross-walks, which are authored and graded rather than observed. It shows which control families carry the mitigation weight on paper. Whether a control is deployed, tuned, or working is not something this data can see.

What changed recently in this area →

This is the one argument on the page rather than a measurement. The difference-in-differences compares an LLM-credited cohort against a matched one; it supports a claim about severity mix in the credited cohort, and it does not establish that LLMs caused the difference.

Severity impact of LLM-assisted vulnerability discoveryAI

Section A — Direct attribution (high-confidence, narrow)

2049 CVEs detected with explicit LLM-discovery credit.

By LLM family: Openai: 1641, Anthropic: 446, Google: 2, Moonshot: 2.
Specific models cited (top 8): OpenAI (1636), Claude (216), Anthropic (137), Project Glasswing (23), Claude Code (3), GPT5 (2), Claude Opus 4.6 (2), GPT-5.5 (2).

Section B — Cohort × time-window DiD

Distribution split — cohort × period

Per-vendor: more vulns AND more severe?

Robustness — matched 3-week pre/post window

Parallel-trends check (pre-paper)

Where this comes from. Built from acknowledgement text on published CVEs, which is where AI-assisted discovery is credited when it is credited at all. Attribution is voluntary and inconsistent, so the level is a floor rather than a count — which is why the charts here compare cohorts over time instead of trusting any single total.

What changed recently in this area →