PatchRader
Before the breach
92,205 vulnerabilities were published in 2026 through November 6. No team can fix them all, so the question is which ones attackers will use. This page follows the public data on that question, using CISA's Known Exploited Vulnerabilities list (KEV) as the record of confirmed attacks.
1. The haystack
Of 48,150 vulnerabilities published in 2025, 165 reached the KEV list by year end
1 in 292
One dot per vulnerability. The highlighted dots are placed at random; their positions are not data.
2. The obvious answer
Critical is riskier, but 98.5% of Critical vulnerabilities weren't on the list by the end of 2025
Share on the KEV list, for vulnerabilities published through 2025 with a CVSS 3 severity. KEV starts in November 2021, and severity scores are NIST's current versions.
Data table
| Severity | Listed | Published | Share listed |
|---|---|---|---|
| Low | 5 | 4,617 | 0.11% |
| Medium | 162 | 102,041 | 0.16% |
| High | 807 | 92,911 | 0.87% |
| Critical | 510 | 33,817 | 1.51% |
Weakness type separates them more sharply. Cross-site scripting is the most common, with 41,168 vulnerabilities and 28 listed (0.07%). Type confusion has 680, with 40 listed (5.9%). NIST assigns weakness types during review, so most new vulnerabilities don't have one yet.
3. Two different races
Some listings arrive within days of publication and others years later, so there isn't one warning window
Days from NIST publication to KEV listing, for 431 vulnerabilities listed in 2024 and 2025. The bins have unequal widths.
Data table
| Publication to listing | Listings | Share |
|---|---|---|
| Same day or earlier | 89 | 21% |
| 1 to 7 days | 86 | 20% |
| 8 to 30 days | 46 | 11% |
| 31 to 180 days | 80 | 19% |
| 181 to 365 days | 29 | 7% |
| 1 to 3 years | 36 | 8% |
| Over 3 years | 65 | 15% |
What was visible at the last month-end before listing
410 listings from Feb 2024 to Dec 2025. Loud means public exploit code or an EPSS score of at least 10%, and quiet means neither. For scale, 14% of unlisted vulnerabilities in the December 2024 snapshot were loud. The snapshots are monthly, so a vulnerability published on the 1st and listed on the 28th counts as not yet published.
Data table
| At the last month-end before listing | Listings | Share |
|---|---|---|
| Not yet published | 186 | 45% |
| Published, no data | 7 | 2% |
| Quiet | 85 | 21% |
| Loud | 132 | 32% |
For 45%, the last monthly snapshot before listing came before publication, so a ranking built on monthly signals would have had nothing to go on. The description is the one field every new vulnerability has from the start.
4. The alarm
For older vulnerabilities, the EPSS score sat flat for six months, then jumped in the month of listing
Median EPSS for 36 vulnerabilities listed from Jul 2024 to Dec 2024 and published before the six months shown began: 2.6% the month before listing, 26% the month of it. This window avoids EPSS's March 2025 model change, which adds a false step to wider groups. Monthly data can't show whether the jump came just before or just after listing, and a listing date isn't when attacks began. Not every case looks like this: for the 16 chosen the same way and listed in Oct 2025, the median stayed between 86% and 88% throughout.
Data table
| Months from listing | Median EPSS | Vulnerabilities with a score |
|---|---|---|
| -6 | 2.5% | 36 |
| -5 | 2.4% | 36 |
| -4 | 2.3% | 36 |
| -3 | 2.6% | 36 |
| -2 | 2.6% | 36 |
| -1 | 2.6% | 36 |
| 0 | 26.0% | 36 |
| +1 | 38.3% | 36 |
| +2 | 41.0% | 35 |