Live numbers on how many bugs are being found, how many attackers use, and how to tell them apart. Each number comes with one sentence on what it means.
Patch the top 35% of CVEs by each score. How many of the 183 bugs CISA later confirmed under attack would you already have covered? VEDAS: 90%. EPSS: 53%.
VEDAS
90%
of the bugs attackers went on to use were already in the top 35% of CVEs by VEDAS, before CISA confirmed the attacks.
EPSS
53%
for the top 35% by EPSS, the industry’s standard exploit forecast. Same patching effort, 37 points fewer attacks covered.
VEDASEPSSpatching at random
Source: cve-scores weekly history since 2025-04-13 · CISA KEVVULNPOCALYPSE.DEV
How to read it
Each line shows what share of later-attacked bugs you cover (up) as you patch more of all CVEs (right). Higher is better. The shaded area is where VEDAS covers more for the same effort, from about the top 24% of CVEs onward. The grey line is patching at random. At the very top EPSS is sharper: in the top 10%, EPSS covered 43% and VEDAS 7%. VEDAS pulls ahead once you aim to catch most attacks.
How this is calculated
For every bug CISA added to its Known Exploited Vulnerabilities list after 2025-04-13, we take its EPSS and VEDAS from the last cve-scores snapshot before the listing, so neither score gets credit for reacting to CISA. A bug only counts if that snapshot is at most 7 days old: cve-scores published almost daily until 22 February 2026, paused until 8 August 2026, and was irregular after, so 62 bugs listed during the pause were left out. Patching effort is the share of all 477,329 CVEs at or above the same score today. A CVE with no EPSS score cannot be flagged by EPSS.
13 of 183
attacked bugs had no EPSS score at all before CISA listed them
VEDAS had scored every one of them.
1,728
CVEs from 2026 have no EPSS score today
VEDAS scores all 84,067 of them, from the day they appear.
Dots near zero were exploited almost as soon as they were made public. Dots below zero were listed by CISA before the CVE record was published. Dots high up are old bugs attackers turned to later.
How this is calculated
Publication date is the CVE.org datePublished field. Listing date is CISA’s dateAdded. The vertical scale is logarithmic in days.
Every bug CISA confirmed under attack since 2022, grouped into 14 technologies. Firewalls and VPNs lead 2026 with 58. Fastest growing: websites, cms and plugins (7 to 19) and developer, ai and data platforms (22 to 43). Full breakdown by technology.
Technology
2022
2023
2024
2025
2026*
2026 vs 2025
Zero-day
Median time to exploit
Ransomware
VEDAS rules
Firewalls and VPNsFirewalls, VPN gateways, load balancers and other network edge appliances.
74
25
28
39
58
+49% so far
38%
4 days
16
28 of 90
Operating systemsWindows, Linux, macOS and iOS components, including the kernel and system services.
Year columns: bugs added to CISA’s exploited list (darker is more). *2026 is the year so far. Zero-day, time to exploit, ransomware and VEDAS rules cover 2025 and 2026: zero-day means CISA listed the bug on or before the day its CVE was published; time to exploit is days from CVE publication to CISA listing; VEDAS rules counts remotely exploitable bugs that have a free detection rule.
Read across a row to see how one technology has trended since 2022; read down a year column to compare technologies. The extra columns show how attacks on that technology behave: how often bugs were exploited before they were even published, how fast, and whether ransomware gangs used them.
How this is calculated
Each KEV entry is assigned to a technology by its vendor and product name, using an ordered keyword list (published in technologies.py). Entries that fit no group are counted as Other.
Each rule’s patch load against how many of the 183 bugs CISA later confirmed under attack it had already flagged before the listing.
Rule
Patches it adds · backlog
Exploited bugs it caught early · missed
Patch everything Impossible in practice
8,363 a month backlog 477,329
100%(98%-100%) · 0 left open
EPSS 1% or higher Misses 5 in 10
364 a month backlog 148,292
52%(45%-59%) · 88 left open
EPSS 3% or higher Misses 5 in 10
93 a month backlog 50,400
45%(38%-53%) · 100 left open
EPSS 10% or higher Misses 6 in 10
31 a month backlog 17,509
36%(29%-43%) · 118 left open
VEDAS 0.10 or higher Recommended
2,856 a month backlog 167,531
91%(86%-94%) · 17 left open
VEDAS 0.50 or higher
2,032 a month backlog 142,015
77%(70%-82%) · 43 left open
VEDAS 0.90 or higher Misses 7 in 10
751 a month backlog 86,598
28%(22%-35%) · 132 left open
EPSS 10%+ or VEDAS 0.50+
2,041 a month backlog 145,293
78%(71%-83%) · 41 left open
EPSS 10%+ or VEDAS 0.10+
2,858 a month backlog 168,021
91%(86%-94%) · 17 left open
patches a rule adds a monthexploited bugs already on the rule’s listexploited bugs it missed
Source: cve-scores history · CISA KEVVULNPOCALYPSE.DEV
How to read it
Grey bar: patches the rule adds each month. Black: exploited bugs it had flagged before CISA listed them. Orange: ones it missed. The highlighted row covers the most attacks while adding no more than half the patches of patching everything.
How this is calculated
Coverage uses each bug’s EPSS and VEDAS on the last weekly snapshot before CISA listed it. Ranges are 95% Wilson intervals. Monthly load is this year’s CVEs that meet the rule today, divided by the months so far; backlog is every CVE that meets it today.
Can you detect them?
vedas-signatures is a free, open set of detection rules: Nuclei templates that check whether a system is exposed, and Suricata rules that spot attacks on the network. It covers 15,787 CVEs. For now it targets remotely exploitable bugs, so the figures below count only those. Bugs that need local access, like privilege escalation, are out of scope.
Remotely exploitable bugs among the 100 most likely to be attacked (highest EPSS)86% (83 of 96)
Have at least one VEDAS detection rule.
Remotely exploitable bugs among the 1,000 most likely to be attacked65% (621 of 957)
Remotely exploitable bugs added to CISA’s exploited list in 202640% (96 of 242)
40 more need local access and are out of scope. The remote ones without a rule are on the detection gaps list.
What this means: most remotely exploitable bugs that matter can be checked for today, for free. The gaps are listed openly on the detection gaps page, so anyone can help close them.
Scores: EPSS (FIRST.org) and VEDAS (A.R.P. Syndicate) for every CVE, from the public cve-scores repository. Malformed IDs are dropped.
Attacks: CISA’s Known Exploited Vulnerabilities catalogue is our list of bugs attackers are confirmed to use. It is US-focused and incomplete, so treat it as a floor.
Detection: a CVE counts as covered if vedas-signatures has a Nuclei template or a Suricata rule for it.
History: weekly snapshots of cve-scores since 13 Apr 2025, plus every snapshot in the last three weeks.
Thresholds: “likely to be attacked” means EPSS 0.10 or more. “Strong exploit evidence” means VEDAS 0.90 or more.
Third-party figures (Verizon, Mandiant, VulnCheck and others) are on the numbers page.
