Opteryx Try Opteryx →

CVE data quality explorer

The National Vulnerability Database records every publicly disclosed software flaw; CISA's Known Exploited Vulnerabilities catalogue marks the few ever seen exploited in the wild. Side by side, they reveal how small the exploited fraction really is, how many vulnerabilities are never assigned a severity score, and how steeply the rate of disclosure has climbed.

Loading…
CVEs in range
—
Critical + High
—
Actively exploited (KEV)
—
Avg CVSS score
—

Publication volume over time

How many CVE records enter the catalogue over time — a steadily rising firehose of new disclosures.

Vendor concentration

The ten vendors with the most CVE records in range. A handful of vendors account for a large share of the entire catalogue.

First appearance of vendors

Cumulative count of distinct vendors, each counted from its first appearance in the catalogue. From a handful in the late 1980s to tens of thousands today — the software surface under scrutiny keeps widening.

Scored vs. unscored CVEs

Not every CVE carries a CVSS score. Older records in particular were often never scored at all — the ruler isn't just changing, it's frequently missing.

Assigned severity vs. real-world exploitation

Severity mix of the CVEs CISA lists as actively exploited, against the full population — does a high CVSS score actually predict what gets used in the wild?

If you patched by the score…

CVSS says how bad a flaw could be. EPSS estimates the chance it sees exploitation in the next 30 days. CISA's KEV catalogue records what actually was. Pick a patching rule and see how much exploited risk it catches, how much effort goes on flaws never seen exploited, and what's left exposed. Click a cell or a row to try it.
CVEs your rule patches CVEs it leaves Exploited in the wild (KEV)
KEV is a floor on exploitation, not a census: a CVE missing from it hasn't necessarily never been exploited. EPSS here is today's score, which already reflects any exploitation since disclosure, so this flatters EPSS. Replaying each decision with the EPSS score as it stood at the time is the next step.

How fast exploitation follows disclosure

For each year's CVEs that were exploited, how long after publication the exploitation was first recorded: in the wild, from CISA KEV, or as a public proof of concept, from Exploit-DB.

From a vendor's flaws to the groups that exploit them

Pick a vendor. From its most common weaknesses, the graph follows MITRE's own cross-references: CWE weakness → CAPEC attack pattern → ATT&CK technique → the threat groups ATT&CK has seen using it. Four catalogs, joined live. Dashed links are inherited from a parent entry; orange is exploitation CISA has seen.