NEOSEC Intel — NEOSEC Intel

Year-to-date CVE publications

Cumulative CVE publications per year, derived from the earliest publication date across our ingested sources (NVD, CVE.org, OSV, MSRC, Debian, Ubuntu). Note: our capture ratio against the MITRE CVE List is currently below 100% — NVD records with status "Received / Awaiting Analysis" are now counted (since 2026-06-07), a full cvelistV5 sync follows in a later wave. A 1 : 1 match with FIRST/first.org/epss/data_stats is the target but not yet reached.

Citable

Source: NIST NVD CVE API 2.0
Dataset: intel.vulnerability.published_at
Computation: SUM(COUNT(*)) OVER (PARTITION BY year ORDER BY day-of-year)
Data as of: 2026-07-28 12:10 UTC
Attribution: NEOSEC GmbH · intel.neosec.io

Yearly severity mix (with KEV overlay)

Severity mix per yearCriticalHighMedium / LowUnscoredof which KEVof which ransomware

Citable

Source: NIST NVD CVE API 2.0 + CISA Known Exploited Vulnerabilities Catalog
Dataset: intel.advisory + intel.vulnerability
Computation: GROUP BY year(advisory.published_at), severity-bucket; KEV-Overlay aus vulnerability.is_kev
Data as of: 2026-07-28 12:10 UTC
Attribution: NEOSEC GmbH · intel.neosec.io

Ransomware-used CVEs (CISA-confirmed)

CISA maintains a "Known Ransomware Campaign Use" column in the KEV catalog. CVEs flagged "Known" were used in documented ransomware campaigns — they deserve the highest patch priority.

Confirmed CVEs

330

Source: CISA-KEV, as of last sync

Share of KEV catalog

20.0 %

of 1,653 current KEV entries

Direct filter

Show all ransomware CVEs →

opens search with `ransomware_only` filter and "Ransomware first" sort

Recently added

Citable

Source: CISA Known Exploited Vulnerabilities Catalog — column `knownRansomwareCampaignUse`
Dataset: intel.vulnerability.kev_known_ransomware
Computation: COUNT(DISTINCT vulnerability.id WHERE kev_known_ransomware = true)
Data as of: 2026-07-28 12:10 UTC
Attribution: NEOSEC GmbH · intel.neosec.io

Time-to-KEV listing (Known Exploited Vulnerabilities — CISA's catalog of vulnerabilities confirmed exploited in the wild)

Time-to-KEV (median, days)

Median days between CVE publication and CISA-KEV listing. Lower = prioritized sooner.

2022 outlier: CISA only launched the KEV catalog in November 2021. The first full year (2022) therefore carried a large backfill of historically known and long-exploited vulnerabilities — the gap between publication date and KEV listing averaged several years. From 2023 onwards the median actually reflects the operational turnaround.

Citable

Source: CISA Known Exploited Vulnerabilities Catalog
Dataset: intel.vulnerability (KEV-flagged rows)
Computation: percentile_cont(0.5)/(0.9) WITHIN GROUP (ORDER BY kev_added_at - published_at), per kev-year
Data as of: 2026-07-28 12:10 UTC
Attribution: NEOSEC GmbH · intel.neosec.io

CPE Dictionary inventory (Common Platform Enumeration — the canonical registry of product/version identifiers)

Local aggregation of the canonical CPE 2.3 catalog (NIST). Mirrors the NVD statistics page at cpe/statistics, computed against our daily incremental snapshot.

CPE entries total

504,703

Anwendung (a)

441,979

Betriebssystem (o)

43,287

Hardware (h)

19,437

Top vendors by CPE count

Show 188 more vendors

Vendor and product names are trademarks or registered trademarks of their respective owners. The vendor slugs shown here are taken verbatim from the public NVD CPE Dictionary (NIST) and used solely to identify advisories — no trademark infringement is intended and no commercial affiliation is implied.

Citable

Source: NIST NVD CPE API 2.0 — cf. nvd.nist.gov/products/cpe/statistics
Dataset: intel.cpe_dictionary
Computation: COUNT(*) GROUP BY part / vendor — lokal aggregiert aus intel.cpe_dictionary
Data as of: 2026-07-17 01:53 UTC
Attribution: NEOSEC GmbH · intel.neosec.io