Snapshot Source dates & coverage
- NVD
- Feed 7 Nov 2026. Publication and severity; recent records may be incomplete.
- CISA KEV
- Released 6 Nov 2026. Confirmed exploitation; absence does not establish safety.
- FIRST EPSS
- Scored 7 Nov 2026. Probability of exploitation activity in the next 30 days, not severity.
Public intelligence, not an inventory or a record of your remediation. Confirm affected versions, exposure and business impact before deciding what to fix. CISA due dates apply to US federal civilian agencies.
Vendors and weaknesses
Microsoft had the most CVEs added to KEV from Dec 2021 to Nov 2026 (309), ahead of Cisco (90). The most common weakness across all KEV listings in the period is Out-of-bounds write (119).
Where CVEs come from, and the classes of mistake behind them. Select a vendor for its products and exploited CVEs.
Use Left and Right Arrow to move one month, Shift and Arrow to move one year, and Home or End to move to the beginning or end. On the selected period slider, arrows move the whole range. Drag the range to move it or drag either handle to change an endpoint.
CVE counts: calendar years 2021–2026 (latest year so far). KEV listings: Dec 2021–Nov 2026. Vendor details: all time, independent of this period.
Figure 13. Vendors with the most exploited CVEs
CVEs published 2021–2026. Exploited counts KEV listings added Dec 2021 to Nov 2026. Trend shows the last 10 years.
Figure 14. The weaknesses behind the most exploited CVEs
CWE types; CVEs published 2021–2026. Exploited counts KEV listings added Dec 2021 to Nov 2026.