Research

Six questions the corpus can answer, and what each answer does and does not support.

Every chart here is built from our own pipeline — NVD and EPSS ingest, CISA KEV, per-CVE annotations and our hand-QA'd cross-walks. Organised by the question you arrived with rather than by the table the data came from.

Last updated: 2026-08-23 00:42 UTC

Volume is rising and severity is not falling with it, so the corpus is getting bigger without getting milder — but publication volume measures disclosure, not risk, and a quiet month is not a safe one.

CVE publication volume — monthly

→ All CVEs published per month since 2024-01 (grey), with CVEs in AI-related software (purple) on the same axis. Monthly buckets smooth the large Oracle and Microsoft dumps. Both lines share one scale, so the gap you see is the real one: AI-related CVEs are a small fraction of total volume, and the chart is not rescaled to disguise that. Hover for exact counts.

CVSS distribution by quarter

→ Box plot of CVSS base scores per publication quarter. Box spans the interquartile range; the line inside is the median. Outliers shown as dots. Use this to spot whether the median CVE is getting more or less severe.

Substantively-modified CVEs — weekly

→ CVEs whose NVD record was updated at least 7 days after initial publication, bucketed by the week of modification. Filters out the small within-week post-publish corrections; what remains is the substantive re-touch signal — CPE additions, CVSS rescoring, description refinement, KEV-linked tweaks. Same threshold as the “Updated” badge on CVE detail pages (example).

Where this comes from. Built from the CVE corpus this pipeline ingests (NVD, EPSS, and our per-CVE annotations). These are publication-side signals: what was disclosed, when, and at what severity. A rising line here is not evidence of rising attacks — that question is the next one.

What changed recently in this area →

KEV is the only confirmed-exploited signal here and it is a floor, not a census: it counts what CISA has confirmed, so everything else on this tab is an estimate of pressure rather than a count of attacks.

CISA KEV — additions per month

→ How fast is CISA adding CVEs to the Known Exploited Vulnerabilities list? A rising bar means more confirmed-exploited threats are reaching ops teams.

Time from publication to KEV listing

→ For each KEV-listed CVE: how long after publication did CISA add it? Same-day means actively exploited at disclosure; years-later means it was a sleeper that became dangerous later.

Ransomware-attributed share of new KEV entries

→ For each quarter, the fraction of new KEV-catalog entries flagged by CISA as knownRansomwareCampaignUse=“Known”. A rising bar means ransomware operators are claiming a larger share of the confirmed-exploited cohort — ops teams should weight these CVEs higher in patching priority.

Exploit pressure of the CVE corpus

→ For each month, the sum of EPSS scores across all CVEs published that month. Combined volume × exploit-probability. A rising curve means new vulnerabilities are getting more exploitable on average. (This is a property of the CVE corpus, not observed exploitation activity.)

Attacker-attributed CVEs — weekly

→ Weekly count of CVEs where our actor-attribution pass identified at least one named threat-actor (e.g. Conti, Lazarus, APT41) exploiting the CVE. Data lives in cve_actor_attribution. Coverage is partial — the annotator runs daily over CVEs with synthesised summaries; recent weeks may grow as the backfill catches up.

Where this comes from. Built from CISA's KEV catalog (confirmed exploited in the wild), EPSS probabilities, and ransomware flags on KEV entries. This is not attacker telemetry. It measures what is publicly known to be exploited, so it lags real exploitation and undercounts anything nobody reported.

What changed recently in this area →

The weakness mix moves slowly, which is the finding — the same handful of CWEs stay at the top year after year, so a defence tuned to last year's ranking is mostly still tuned to this year's.

Top weaknesses (CWE) — rank shift across years

→ The top-15 CWEs in each of 2024, 2025, and 2026 YTD by rank. Lines crossing means a CWE moved up or down the prevalence ladder. Hover for exact CVE counts.

ATT&CK techniques mapped to recent CVEs — rank shift

→ The top-15 MITRE ATT&CK Enterprise techniques in each of 2024, 2025, and 2026 YTD by how often they appear on annotated CVEs. This is a coverage signal on the CVE corpus — what attacker techniques the published CVEs enable. It is not a measure of which techniques attackers actually use. Limited to CVEs with ATT&CK annotations.

Tactic coverage of recent CVEs (Σ EPSS)

→ For each month, Σ EPSS of CVEs whose ATT&CK techniques map to each tactic. A CVE counts toward every tactic its techniques span. A rising band means newly-disclosed CVEs are giving attackers more material in that attack stage; not a direct telemetry signal. Limited to CVEs with ATT&CK annotations.

Where this comes from. Built from CWE assignments on published CVEs and our CWE→ATT&CK cross-walks. Rank shifts are shifts in what gets assigned; a weakness class can move because analyst practice changed rather than because attackers did.

What changed recently in this area →

Vendor CVE counts measure disclosure practice as much as product quality: a vendor that publishes diligently outranks one that stays quiet, so read high counts as visibility, not as a verdict.

Vendor cohorts — monthly CVE volumeAI

→ Three cohorts: Glasswing (11 known) — the Project Glasswing participants we have publicly confirmed. Unknown — CVE-issuing organisations represented at the AI Vulnerability Storm paper review. Known or assumed not Glasswing — Barracuda, F5, Fedora, Fortinet, SAP, Siemens, and Trellix, plus every other CVE-issuing vendor. Dashed line at 2026-04-13 marks the Mythos paper publication. Y-axis log.

Reserved — Customer asset coverage

The auth-service’s “My Environment” feature already maps user-uploaded CPEs to active CVEs. When we surface aggregate (anonymised) statistics — which vendors appear most in user portfolios, average CVE exposure per portfolio — this slot becomes a real chart.

Per-vendor sparklines — monthly CVE counts

→ One sparkline per named vendor with at least one CVE in the current window. Purple = Glasswing, cyan = Unknown, gray = Not Glasswing (named). The Σ badge in each cell is the total CVE count for that vendor across the window. Hover for monthly counts.

Top-15 vendors by KEV adds (quarterly)

→ Stacked-bar quarterly view of the top-15 vendors by total KEV-listing volume. Highlights which vendor classes attract repeated confirmed-exploited entries — managed file transfer and VPN/edge-appliance vendors dominate the right half. Same data as the article’s actor-drift map but vendor-summary rather than per-CVE detail.

Product categories compared — six metrics side by side

→ A small-multiples view (two rows of three) of how the seven product categories (Microsoft / macOS / Linux / Mobile / Network / Application / Other) stack up over the trailing 12 months. Top row: CVE volume, open-source share, KEV share. Bottom row: AI-related share, the mean EPSS of each category’s top-decile CVEs, and ransomware-linked KEV share. Every metric — the volume and each share — is computed over the same last-365-day window, so the counts double as the denominator for the rates. Each panel rescales independently so the ranking within a metric is visible even when totals differ by orders of magnitude. Multi-label CVEs (e.g. Microsoft Office for Mac) count toward every category they touch — same semantics as the per-CVE pill on detail pages.

Where this comes from. Built from CPE product matches on CVEs, with CNA-assignment fallback where CPE data lags. Vendors ship different amounts of software and disclose at different rates, so volume here reads as attention and surface, not as relative product quality.

What changed recently in this area →

One chart, honestly. This is the thinnest evidence on the page: it shows which control families our mappings attach to recent CVEs, which is a statement about our cross-walks before it is a statement about your controls.

Control family share of mitigations

→ Each week, the share of CVEs whose strongest mitigating control falls in each grouping. Use the Framework selector under the chart to switch between NIST 800-53 families, ISO 27002 themes, and NIST CSF 2.0 functions. Every mapping runs CVE → its official CWE → control through the direct CWE↔framework cross-walks — no per-CVE model call.

Reserved — Configuration rule coverage by control family

Coming when CIS Benchmarks / AWS Config conformance / Azure Policy / STIG ingestion lands. See the controls catalogue for the 49 cloud-native rules we have today.

Reserved — Implementation drift

Coming when configuration-drift observations are ingested. Will chart deviation between a customer's running configuration and their declared baseline, by control family.

Where this comes from. Built from our control↔weakness cross-walks, which are authored and graded rather than observed. It shows which control families carry the mitigation weight on paper. Whether a control is deployed, tuned, or working is not something this data can see.

What changed recently in this area →

This is the one argument on the page rather than a measurement. The difference-in-differences compares an LLM-credited cohort against a matched one; it supports a claim about severity mix in the credited cohort, and it does not establish that LLMs caused the difference.

Severity impact of LLM-assisted vulnerability discoveryAI

→ Are vulnerabilities found with help from large language models more or less severe than other vulnerabilities? Two views below. Section A uses direct attribution: CVEs that explicitly credit Claude / Anthropic / Project Glasswing / GPT / Gemini / Grok / Llama / Copilot / Mistral / DeepSeek / etc. in NVD descriptions, vendor advisories, or our manual override list. Section B uses the Glasswing-cohort × time-window proxy (broader signal but causally weaker).

Section A — Direct attribution (high-confidence, narrow)

924 CVEs detected with explicit LLM-discovery credit.

By LLM family: Openai: 653, Anthropic: 287, Google: 2.
Specific models cited (top 8): OpenAI (648), Claude (166), Anthropic (75), Project Glasswing (19), Claude Code (2), GPT5 (2), Claude Opus 4.6 (2), GPT-5.5 (2).

Metric	Mythos-credited (n / mean)	All other CVEs (n / mean)	Difference	95% CI	p (Holm)	Hedges’ g / RD
CVSS base	924 / 7.34	81,469 / 6.85	+0.495	[+0.376, +0.613]	1.2e-19	+0.290
EPSS	924 / 0.0041	81,469 / 0.0072	-0.003	[-0.004, -0.001]	0.73	-0.074
KEV-listing rate	924 / 0.0%	81,469 / 0.3%	-0.003	[-0.004, -0.003]	0.25	-0.003
Risk Priority	924 / 53.94	81,469 / 50.93	+3.009	[+2.252, +3.755]	4.3e-18	+0.257

Section B — Cohort × time-window DiD

Metric	Treated pre (n / mean)	Treated post (n / mean)	Control pre (n / mean)	Control post (n / mean)	DiD	95% CI	p (Holm)	Hedges’ g / RD
CVSS base	8,046 / 6.67	7,285 / 7.04	40,722 / 6.75	26,340 / 7.02	+0.102	[+0.047, +0.158]	1e-50	+0.240
EPSS	8,046 / 0.0074	7,285 / 0.0050	40,722 / 0.0089	26,340 / 0.0050	+0.002	[+0.000, +0.003]	0.0067	-0.056
KEV-listing rate	8,046 / 0.9%	7,285 / 0.4%	40,722 / 0.3%	26,340 / 0.2%	-0.004	[-0.007, -0.002]	0.00011	-0.005
Risk Priority	8,046 / 49.30	7,285 / 51.37	40,722 / 50.66	26,340 / 51.82	+0.922	[+0.540, +1.303]	1.5e-29	+0.194

Distribution split — cohort × period

Per-vendor: more vulns AND more severe?

Robustness — matched 3-week pre/post window

Metric	Treated pre (n / mean)	Treated post (n / mean)	Control pre (n / mean)	Control post (n / mean)	DiD	95% CI	p (Holm)	Hedges’ g / RD
CVSS base	606 / 6.57	783 / 7.04	3,884 / 6.95	2,814 / 6.68	+0.745	[+0.560, +0.929]	8.6e-09	+0.310
EPSS	606 / 0.0027	783 / 0.0070	3,884 / 0.0076	2,814 / 0.0061	+0.006	[+0.002, +0.010]	0.43	+0.110
KEV-listing rate	606 / 0.3%	783 / 0.6%	3,884 / 0.2%	2,814 / 0.1%	+0.004	[-0.003, +0.012]	0.71	+0.003
Risk Priority	606 / 48.36	783 / 51.08	3,884 / 51.89	2,814 / 49.99	+4.627	[+3.363, +5.893]	8.3e-06	+0.261

Parallel-trends check (pre-paper)

Where this comes from. Built from acknowledgement text on published CVEs, which is where AI-assisted discovery is credited when it is credited at all. Attribution is voluntary and inconsistent, so the level is a floor rather than a count — which is why the charts here compare cohorts over time instead of trusting any single total.

What changed recently in this area →

Active anomalies

→ Statistical outliers our daily pass flagged across every lens. An anomaly is a value far from its own recent range, not a judgement that something is wrong.

Technique shift ▲ 86%

ATT&CK T1548 rising 86% YoY: 5,518 CVE-associations in H1 2026 vs 2,960 in H1 2025

view details › first detected 2026-08-01

Technique shift ▲ 58%

ATT&CK T1499 rising 58% YoY: 3,138 CVE-associations in H1 2026 vs 1,987 in H1 2025

view details › first detected 2026-08-01

Technique shift ▲ 91%

ATT&CK T1556 rising 91% YoY: 2,871 CVE-associations in H1 2026 vs 1,501 in H1 2025

view details › first detected 2026-08-01

Technique shift ▲ 109%

ATT&CK T1548.003 rising 109% YoY: 2,385 CVE-associations in H1 2026 vs 1,140 in H1 2025

view details › first detected 2026-08-01

Technique shift ▲ 108%

ATT&CK T1133 rising 108% YoY: 2,291 CVE-associations in H1 2026 vs 1,103 in H1 2025

view details › first detected 2026-08-01

Technique shift ▲ 73%

ATT&CK T1211 rising 73% YoY: 2,249 CVE-associations in H1 2026 vs 1,297 in H1 2025

view details › first detected 2026-08-01

Technique shift ▲ 109%

ATT&CK T1548.006 rising 109% YoY: 2,041 CVE-associations in H1 2026 vs 977 in H1 2025

view details › first detected 2026-08-01

Technique shift ▲ 98%

ATT&CK T1548.001 rising 98% YoY: 1,775 CVE-associations in H1 2026 vs 895 in H1 2025

view details › first detected 2026-08-01

Technique shift ▲ 87%

ATT&CK T1499.003 rising 87% YoY: 1,726 CVE-associations in H1 2026 vs 921 in H1 2025

view details › first detected 2026-08-01

Technique shift ▲ 67%

ATT&CK T1552.004 rising 67% YoY: 1,344 CVE-associations in H1 2026 vs 805 in H1 2025

view details › first detected 2026-08-01

Technique shift ▲ 101%

ATT&CK T1550.004 rising 101% YoY: 1,325 CVE-associations in H1 2026 vs 660 in H1 2025

view details › first detected 2026-08-01

Technique shift ▲ 93%

ATT&CK T1134.001 rising 93% YoY: 1,273 CVE-associations in H1 2026 vs 659 in H1 2025

view details › first detected 2026-08-01

Technique shift ▲ 82%

ATT&CK T1505.005 rising 82% YoY: 1,268 CVE-associations in H1 2026 vs 698 in H1 2025

view details › first detected 2026-08-01

Technique shift ▲ 108%

ATT&CK T1556.006 rising 108% YoY: 1,266 CVE-associations in H1 2026 vs 610 in H1 2025

view details › first detected 2026-08-01

Technique shift ▲ 108%

ATT&CK T1553.004 rising 108% YoY: 1,266 CVE-associations in H1 2026 vs 610 in H1 2025

view details › first detected 2026-08-01

Technique shift ▲ 85%

ATT&CK T1021 rising 85% YoY: 1,263 CVE-associations in H1 2026 vs 684 in H1 2025

view details › first detected 2026-08-01

Technique shift ▲ 85%

ATT&CK T1021.002 rising 85% YoY: 1,231 CVE-associations in H1 2026 vs 667 in H1 2025

view details › first detected 2026-08-01

Technique shift ▲ 58%

ATT&CK T1543 rising 58% YoY: 1,155 CVE-associations in H1 2026 vs 731 in H1 2025

view details › first detected 2026-08-01

Technique shift ▲ 70%

ATT&CK T1687 rising 70% YoY: 1,134 CVE-associations in H1 2026 vs 667 in H1 2025

view details › first detected 2026-08-01

Weakness shift ▲ 60%

CWE-125 rising 60% YoY: 857 CVEs in H1 2026 vs 534 in H1 2025

view details › first detected 2026-06-30

Weakness shift ▲ 29%

CWE-119 rising 29% YoY: 755 CVEs in H1 2026 vs 585 in H1 2025

view details › first detected 2026-06-23

Weakness shift ▲ 96%

CWE-284 rising 96% YoY: 879 CVEs in H1 2026 vs 449 in H1 2025

view details › first detected 2026-06-23

Weakness shift ▲ 86%

CWE-190 rising 86% YoY: 325 CVEs in H1 2026 vs 175 in H1 2025

view details › first detected 2026-06-23

Weakness shift ▲ 61%

CWE-601 rising 61% YoY: 203 CVEs in H1 2026 vs 126 in H1 2025

view details › first detected 2026-06-23

Weakness shift ▲ 77%

CWE-94 rising 77% YoY: 576 CVEs in H1 2026 vs 325 in H1 2025

view details › first detected 2026-06-15

Weakness shift ▲ 70%

CWE-200 rising 70% YoY: 649 CVEs in H1 2026 vs 381 in H1 2025

view details › first detected 2026-06-13

Weakness shift ▲ 118%

CWE-416 rising 118% YoY: 1,284 CVEs in H1 2026 vs 590 in H1 2025

view details › first detected 2026-06-09

Technique shift ▲ 56%

ATT&CK T1212 rising 56% YoY: 6,790 CVE-associations in H1 2026 vs 4,354 in H1 2025

view details › first detected 2026-06-02

Weakness shift ▲ 114%

CWE-770 rising 114% YoY: 469 CVEs in H1 2026 vs 219 in H1 2025

view details › first detected 2026-05-28

Weakness shift ▲ 65%

CWE-77 rising 65% YoY: 568 CVEs in H1 2026 vs 344 in H1 2025

view details › first detected 2026-05-27

Weakness shift ▲ 123%

CWE-400 rising 123% YoY: 478 CVEs in H1 2026 vs 214 in H1 2025

view details › first detected 2026-05-26

Weakness shift ▲ 108%

CWE-287 rising 108% YoY: 369 CVEs in H1 2026 vs 177 in H1 2025

view details › first detected 2026-05-26

Technique shift ▲ 98%

ATT&CK T1083 rising 97% YoY: 1,629 CVE-associations in H1 2026 vs 825 in H1 2025

view details › first detected 2026-05-24

Weakness shift ▲ 116%

CWE-269 rising 116% YoY: 329 CVEs in H1 2026 vs 152 in H1 2025

view details › first detected 2026-05-17

Technique shift ▲ 61%

ATT&CK T1552.001 rising 61% YoY: 1,584 CVE-associations in H1 2026 vs 985 in H1 2025

view details › first detected 2026-05-12

Technique shift ▲ 138%

ATT&CK T1557 rising 138% YoY: 1,379 CVE-associations in H1 2026 vs 579 in H1 2025

view details › first detected 2026-05-12

Technique shift ▲ 86%

ATT&CK T1078 rising 86% YoY: 2,235 CVE-associations in H1 2026 vs 1,201 in H1 2025

view details › first detected 2026-05-12

Technique shift ▲ 90%

ATT&CK T1210 rising 90% YoY: 11,767 CVE-associations in H1 2026 vs 6,192 in H1 2025

view details › first detected 2026-05-08

Technique shift ▲ 84%

ATT&CK T1068 rising 84% YoY: 13,232 CVE-associations in H1 2026 vs 7,187 in H1 2025

view details › first detected 2026-05-06

Technique shift ▲ 54%

ATT&CK T1005 rising 54% YoY: 1,231 CVE-associations in H1 2026 vs 798 in H1 2025

view details › first detected 2026-05-06

Weakness shift ▲ 54%

CWE-862 rising 53% YoY: 1,734 CVEs in H1 2026 vs 1,130 in H1 2025

view details › first detected 2026-05-06

Weakness shift ▲ 143%

CWE-22 rising 143% YoY: 1,362 CVEs in H1 2026 vs 561 in H1 2025

view details › first detected 2026-05-06

Weakness shift ▲ 154%

CWE-78 rising 154% YoY: 804 CVEs in H1 2026 vs 316 in H1 2025

view details › first detected 2026-05-06

Weakness shift ▲ 187%

CWE-918 rising 187% YoY: 784 CVEs in H1 2026 vs 273 in H1 2025

view details › first detected 2026-05-06

Weakness shift ▲ 220%

CWE-20 rising 220% YoY: 975 CVEs in H1 2026 vs 305 in H1 2025

view details › first detected 2026-05-06

Weakness shift ▲ 102%

CWE-98 rising 102% YoY: 507 CVEs in H1 2026 vs 251 in H1 2025

view details › first detected 2026-05-06

Weakness shift ▼ 54%

CWE-352 falling 54% YoY: 597 CVEs in H1 2026 vs 1,305 in H1 2025

view details › first detected 2026-05-06

Weakness shift ▲ 104%

CWE-863 rising 103% YoY: 588 CVEs in H1 2026 vs 289 in H1 2025

view details › first detected 2026-05-06

Weakness shift ▲ 246%

CWE-639 rising 246% YoY: 577 CVEs in H1 2026 vs 167 in H1 2025

view details › first detected 2026-05-06

Weakness shift ▲ 155%

CWE-121 rising 155% YoY: 456 CVEs in H1 2026 vs 179 in H1 2025

view details › first detected 2026-05-06

Weakness shift ▼ 26%

CWE-476 falling 27% YoY: 632 CVEs in H1 2026 vs 860 in H1 2025

view details › first detected 2026-05-06

Weakness shift ▲ 192%

CWE-306 rising 192% YoY: 465 CVEs in H1 2026 vs 159 in H1 2025

view details › first detected 2026-05-06

Weakness shift ▲ 73%

CWE-502 rising 73% YoY: 555 CVEs in H1 2026 vs 320 in H1 2025

view details › first detected 2026-05-06

Weakness shift ▲ 127%

CWE-122 rising 127% YoY: 475 CVEs in H1 2026 vs 209 in H1 2025

view details › first detected 2026-05-06

Weakness shift ▼ 1%

CWE-120 falling 1% YoY: 405 CVEs in H1 2026 vs 409 in H1 2025

view details › first detected 2026-05-06

Weakness shift ▲ 7%

CWE-434 rising 7% YoY: 347 CVEs in H1 2026 vs 325 in H1 2025

view details › first detected 2026-05-06

Weakness shift ▲ 59%

CWE-362 rising 59% YoY: 345 CVEs in H1 2026 vs 217 in H1 2025

view details › first detected 2026-05-06

Weakness shift ▲ 47%

CWE-266 rising 47% YoY: 314 CVEs in H1 2026 vs 213 in H1 2025

view details › first detected 2026-05-06

Weakness shift ▲ 182%

CWE-285 rising 182% YoY: 209 CVEs in H1 2026 vs 74 in H1 2025

view details › first detected 2026-05-06

Weakness shift ▼ 26%

CWE-401 falling 26% YoY: 303 CVEs in H1 2026 vs 408 in H1 2025

view details › first detected 2026-05-06

Weakness shift ▲ 165%

CWE-295 rising 165% YoY: 204 CVEs in H1 2026 vs 77 in H1 2025

view details › first detected 2026-05-06

Technique shift ▲ 65%

ATT&CK T1203 rising 65% YoY: 9,445 CVE-associations in H1 2026 vs 5,733 in H1 2025

view details › first detected 2026-05-06

Past anomalies (resolved)

Anomalies that triggered on a previous run but no longer do. Showing the most recent 30.

Technique shift ▲ 5555% resolved 2026-08-01

ATT&CK T9999.9999 rising 5555% YoY: 2,884 CVE-associations in H1 2026 vs 51 in H1 2025

view details › first detected 2026-07-31

Technique shift ▲ 436% resolved 2026-08-01

ATT&CK T1059.006 rising 436% YoY: 268 CVE-associations in H1 2026 vs 50 in H1 2025

view details › first detected 2026-07-30

Technique shift ▲ 79% resolved 2026-08-01

ATT&CK T1105 rising 79% YoY: 174 CVE-associations in H1 2026 vs 97 in H1 2025

view details › first detected 2026-06-28

Technique shift ▲ 101% resolved 2026-08-01

ATT&CK T1070.004 rising 101% YoY: 143 CVE-associations in H1 2026 vs 71 in H1 2025

view details › first detected 2026-06-01

Technique shift ▲ 103% resolved 2026-08-01

ATT&CK T1098 rising 103% YoY: 181 CVE-associations in H1 2026 vs 89 in H1 2025

view details › first detected 2026-05-27

Technique shift ▲ 99% resolved 2026-08-01

ATT&CK T1565.001 rising 99% YoY: 310 CVE-associations in H1 2026 vs 156 in H1 2025

view details › first detected 2026-05-24

Technique shift ▲ 274% resolved 2026-08-01

ATT&CK T1046 rising 274% YoY: 198 CVE-associations in H1 2026 vs 53 in H1 2025

view details › first detected 2026-05-12

Technique shift ▲ 608% resolved 2026-08-01

ATT&CK T1552 rising 608% YoY: 439 CVE-associations in H1 2026 vs 62 in H1 2025

view details › first detected 2026-05-12

Technique shift ▲ 112% resolved 2026-08-01

ATT&CK T1505.003 rising 112% YoY: 524 CVE-associations in H1 2026 vs 247 in H1 2025

view details › first detected 2026-05-08

Technique shift ▲ 71% resolved 2026-08-01

ATT&CK T1059.008 rising 71% YoY: 128 CVE-associations in H1 2026 vs 75 in H1 2025

view details › first detected 2026-05-08

Technique shift ▲ 209% resolved 2026-08-01

ATT&CK T1190 rising 209% YoY: 15,647 CVE-associations in H1 2026 vs 5,059 in H1 2025

view details › first detected 2026-05-08

Technique shift ▲ 123% resolved 2026-08-01

ATT&CK T1566.002 rising 123% YoY: 330 CVE-associations in H1 2026 vs 148 in H1 2025

view details › first detected 2026-05-06

Technique shift ▲ 209% resolved 2026-08-01

ATT&CK T1485 rising 209% YoY: 213 CVE-associations in H1 2026 vs 69 in H1 2025

view details › first detected 2026-05-06

Technique shift ▲ 291% resolved 2026-08-01

ATT&CK T1204.002 rising 291% YoY: 880 CVE-associations in H1 2026 vs 225 in H1 2025

view details › first detected 2026-05-06

Technique shift ▲ 430% resolved 2026-08-01

ATT&CK T1499.004 rising 430% YoY: 3,569 CVE-associations in H1 2026 vs 673 in H1 2025

view details › first detected 2026-05-06

Technique shift ▲ 313% resolved 2026-08-01

ATT&CK T1185 rising 313% YoY: 1,070 CVE-associations in H1 2026 vs 259 in H1 2025

view details › first detected 2026-05-06

Technique shift ▲ 80% resolved 2026-08-01

ATT&CK T1539 rising 80% YoY: 693 CVE-associations in H1 2026 vs 384 in H1 2025

view details › first detected 2026-05-06

Technique shift ▲ 91% resolved 2026-08-01

ATT&CK T1059.007 rising 91% YoY: 1,699 CVE-associations in H1 2026 vs 890 in H1 2025

view details › first detected 2026-05-06

Technique shift ▲ 306% resolved 2026-08-01

ATT&CK T1059 rising 306% YoY: 528 CVE-associations in H1 2026 vs 130 in H1 2025

view details › first detected 2026-05-06

Technique shift ▲ 552% resolved 2026-08-01

ATT&CK T1189 rising 552% YoY: 1,109 CVE-associations in H1 2026 vs 170 in H1 2025

view details › first detected 2026-05-06

Technique shift ▲ 343% resolved 2026-08-01

ATT&CK T1059.004 rising 343% YoY: 1,094 CVE-associations in H1 2026 vs 247 in H1 2025

view details › first detected 2026-05-06

Weakness shift ▲ 218% resolved 2026-07-03

CWE-367 rising 218% YoY: 162 CVEs in H1 2026 vs 51 in H1 2025

view details › first detected 2026-06-30

Weakness shift ▲ 80% resolved 2026-06-30

CWE-288 rising 80% YoY: 153 CVEs in H1 2026 vs 85 in H1 2025

view details › first detected 2026-05-06

Technique shift ▼ 50% resolved 2026-06-29

ATT&CK T1213.006 falling 50% YoY: 481 CVE-associations in H1 2026 vs 965 in H1 2025

view details › first detected 2026-05-06

Technique shift ▲ 88% resolved 2026-06-29

ATT&CK T1078.001 rising 88% YoY: 98 CVE-associations in H1 2026 vs 52 in H1 2025

view details › first detected 2026-06-01

Weakness shift ▲ 111% resolved 2026-06-24

CWE-404 rising 111% YoY: 150 CVEs in H1 2026 vs 71 in H1 2025

view details › first detected 2026-05-08

Exploitation pressure ▼ 56% resolved 2026-06-15

Σ EPSS of newly-published CVEs falling 55% YoY: 14.2 this month (6,955 CVEs) vs 32.0 same month prior year (3,981 CVEs)

view details › first detected 2026-06-01

Exploitation pressure ▼ 62% resolved 2026-06-01

Σ EPSS of newly-published CVEs falling 62% YoY: 13.7 this month (5,831 CVEs) vs 36.1 same month prior year (4,035 CVEs)

view details › first detected 2026-05-06

KEV velocity ▲ 107% resolved 2026-06-01

KEV additions accelerating 107% YoY: 31 CVEs added to CISA KEV in 2026-04 vs 15 in 2025-04

view details › first detected 2026-05-06

Technique shift ▼ 52% resolved 2026-05-12

ATT&CK T1204.001 falling 52% YoY: 140 CVE-associations in H1 2026 vs 289 in H1 2025

view details › first detected 2026-05-06