Known exploited

How much warning did customers get?

How many exploited CVEs fell in each window between the CVE record publishing and CISA listing it as exploited. Read this as the outside limit of the defenders' head start, not its measure — the KEV date is when exploitation was documented, which trails when it began by an unknown margin.

By product

Which products attackers actually reach for. A product whose bars pile up in the first bucket is one being exploited the day it is disclosed.

Who found it changes everything

The same CVEs, grouped by how the vulnerability came to light. This is the one cut of the data where the differences are not subtle.

2 of 64 exploited CVEs are not yet mapped to a product, so they carry no vendor or category and appear only when both of those filters are set to all.

Is it getting better or worse?

Share of each year's CVEs exploited within 90 days of publication. Every year is measured over the same 90-day window and counts only CVEs old enough to have been watched for all of it, so these years are comparable in a way that filtering the charts above is not. Whole portfolio, not affected by the filters.

Newest KEV additions first, narrowed by the same filters. "Days to exploit" is the measure the charts bucket.