The Exploitation Velocity Index

A reproducible read on which vendors actually get exploited in the wild — derived entirely from the official CISA Known Exploited Vulnerabilities catalog, not from vendor marketing or estimated severity.

Dataset: CISA KEV catalog v2026.07.01 · 1631 entries · updated 2026-07-05 · Download JSON · Methodology

01Catalog growth velocity

KEV additions per calendar month — the rate at which CISA confirms new in-the-wild exploitation. The trailing 12 months added 240 entries versus 251 in the prior 12 (-4.4% year-over-year). Each bar is one calendar month.

02Which vendors dominate real-world exploitation

Ranked by share of the entire KEV catalog. This is the single most useful patch-prioritization signal most teams ignore: exploitation is heavily concentrated. Microsoft alone accounts for 23.2% of every confirmed in-the-wild exploited vulnerability CISA tracks.

03Highest assessed urgency — tightest deadlines

Vendors with >=5 KEV entries, ranked by shortest median CISA remediation window (days from catalog addition to federal remediation deadline). A shorter window is CISA signalling higher assessed urgency.

04Dominant weakness categories

The CWE classes most represented across exploited CVEs — where detection and secure-development effort pays off most.

05Most recent additions

The 10 most recently confirmed in-the-wild exploited CVEs. Detection content for the highest-priority entries is published in our detection pack.

06Methodology & reproducibility