Snapshot Source dates & coverage
- NVD
- Feed 7 Nov 2026. Publication and severity; recent records may be incomplete.
- CISA KEV
- Released 6 Nov 2026. Confirmed exploitation; absence does not establish safety.
- FIRST EPSS
- Scored 7 Nov 2026. Probability of exploitation activity in the next 30 days, not severity.
Public intelligence, not an inventory or a record of your remediation. Confirm affected versions, exposure and business impact before deciding what to fix. CISA due dates apply to US federal civilian agencies.
Severity and exploit likelihood
59% of the exploited CVEs published Dec 2021 to Oct 2026 were not rated Critical.
CVSS says how bad a flaw could be. EPSS estimates how likely it is to be exploited. The two often disagree, and the gap shows where severity alone misleads.
Use Left and Right Arrow to move one month, Shift and Arrow to move one year, and Home or End to move to the beginning or end. On the selected period slider, arrows move the whole range. Drag the range to move it or drag either handle to change an endpoint.
Figure 8. Critical is not the whole story
Severity of CVEs published Dec 2021 to Oct 2026: all of them, and those later listed in KEV. Complete months only.
Figure 9. Exploit probability (EPSS) across all CVEs and exploited CVEs
All years: share of each population in each EPSS band. Scores are current, not as at publication.
Figure 10. Elevated EPSS, not currently in KEV
One row per product with EPSS of 10% or more and no current KEV listing, ranked by its highest EPSS. It draws on the 96 CVEs published Dec 2021 to Nov 2026 among the 300 highest-EPSS CVEs not in KEV, of 16,190 at 10% or more overall. EPSS estimates probability; it does not establish exposure or exploitation.
| Vendor · product | CVEs | Highest | Severity | Age | EPSS |
|---|---|---|---|---|---|
| Apache Log4j | 18 Dec 2021 | Medium 5.9 | 4 yr | >99.9% | |
| Red Hat Enterprise Linux | 14 Feb 2024 | High 7.5 | 2 yr | >99.9% | |
| Apache Commons Text | 13 Oct 2022 | Critical 9.8 | 4 yr | 99.9% | |
| Microsoft SharePoint Server | 20 Jul 2025 | Medium 6.5 | 16 mo | 99.9% | |
| Ivanti Endpoint Manager | 31 May 2024 | High 8.8 | 2 yr | 99.9% | |
| Fortinet FortiNAC | 16 Feb 2023 | Critical 9.8 | 3 yr | 99.8% | |
| Spip | 28 Feb 2023 | Critical 9.8 | 3 yr | 99.7% | |
| FLIR Ax8 Firmware | 18 Aug 2022 | Critical 9.8 | 4 yr | 99.6% | |
| SonicWall Sma 6200 Firmware | 1 Jul 2024 | High 8.1 | 2 yr | 99.5% | |
| Snakeyaml | 1 Dec 2022 | Critical 9.8 | 3 yr | 99.5% | |
| Metabase | 21 Jul 2023 | Critical 9.8 | 3 yr | 99.5% | |
| Nextgen Mirth Connect | 3 Aug 2023 | Critical 9.8 | 3 yr | 99.4% | |
| Ivanti Avalanche | 10 Aug 2023 | Critical 9.8 | 3 yr | 99.4% | |
| Kubernetes Ingress-nginx | 25 Mar 2025 | Critical 9.8 | 20 mo | 99.4% | |
| Chamilo | 1 Aug 2023 | Critical 9.8 | 3 yr | 99.3% | |
| Contec Solarview Compact Firmware | 6 Feb 2023 | Critical 9.8 | 3 yr | 99.3% | |
| Vercel Next.js | 21 Mar 2025 | Critical 9.1 | 20 mo | 99.2% | |
| Zoho Corp ManageEngine Access Manager Plus | 16 Sep 2022 | Critical 9.8 | 4 yr | 99.1% | |
| Raspap | 1 Aug 2023 | Critical 9.8 | 3 yr | 99.1% | |
| Open Web Analytics | 18 Mar 2022 | Critical 9.8 | 4 yr | 99.1% | |
| Cacti | 14 May 2024 | Critical 10.0 | 2 yr | 98.8% | |
| Zoho Corp ManageEngine Applications Manager | 11 Apr 2023 | Medium 6.1 | 3 yr | 98.7% | |
| Atlassian Bitbucket | 17 Nov 2022 | Critical 9.8 | 4 yr | 98.0% | |
| Zoho Corp ManageEngine Admanager Plus | 13 Apr 2023 | High 7.2 | 3 yr | 98.0% | |
| Backupbliss Backup Migration | 15 Dec 2023 | Critical 9.8 | 2 yr | 97.8% | |
Figure 11. Severity mix of new CVEs, by year
Share of CVEs published each year, by CVSS base severity
Figure 12. CVEs NVD has not analysed
Share of each month's CVEs that are deferred or still waiting for NVD analysis