{"meta":{"title":"Headline KEV statistics","description":"Every headline figure on the dashboard and stats report.","source":"CISA Known Exploited Vulnerabilities catalog (https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json)","catalogVersion":"2026.09.23","catalogDateReleased":"2026-09-23T12:51:35.821Z","referenceDate":"2026-09-23","publisher":"Telemetry","license":"https://creativecommons.org/licenses/by/4.0/","documentation":"https://glide-telemetry.pages.dev/api/","records":1},"data":[{"catalogVersion":"2026.09.23","dateReleased":"2026-09-23T12:51:35.821Z","referenceDate":"2026-09-23","totalEntries":1721,"firstDateAdded":"2021-11-03","latestDateAdded":"2026-09-22","addedLast7Days":8,"addedLast30Days":46,"addedLast90Days":92,"vendorCount":283,"productCount":725,"cweCount":185,"entriesWithoutCwe":175,"ransomwareKnown":361,"ransomwareKnownPercent":21.0,"medianRemediationDays":21,"openFederalDeadlines":8,"topVendor":{"name":"Microsoft","entries":388,"percent":22.5},"topCwe":{"id":"CWE-20","entries":119,"percent":6.9},"top10VendorEntries":919,"top10VendorPercent":53.4,"cveIdFiveOrMoreYearsOlderPercent":21.4,"figures":[{"id":"additions-by-year","title":"KEV additions per year","statement":"CISA added 555 entries in 2022, the catalog's first full calendar year, and 237 in 2026 through 2026-09-23. The catalog's first year, 2021, began on 2021-11-03 with 311 entries by year end.","json":"https://glide-telemetry.pages.dev/api/stats/additions-by-year.json","csv":"https://glide-telemetry.pages.dev/api/stats/additions-by-year.csv"},{"id":"additions-by-month","title":"KEV additions per month","statement":"The busiest month on record was November 2021, with 291 additions (the catalog's first month). Across all 59 months the median is 19 a month.","json":"https://glide-telemetry.pages.dev/api/stats/additions-by-month.json","csv":"https://glide-telemetry.pages.dev/api/stats/additions-by-month.csv"},{"id":"top-vendors","title":"Top vendors by KEV entries","statement":"Microsoft has the most KEV entries, 388 (22.5% of the catalog). The top 10 vendors account for 53.4%.","json":"https://glide-telemetry.pages.dev/api/stats/top-vendors.json","csv":"https://glide-telemetry.pages.dev/api/stats/top-vendors.csv"},{"id":"top-cwes","title":"Top weaknesses (CWE) in KEV","statement":"CWE-20 (Improper input validation) is the most-listed weakness, on 119 entries (6.9%). 175 entries list no CWE.","json":"https://glide-telemetry.pages.dev/api/stats/top-cwes.json","csv":"https://glide-telemetry.pages.dev/api/stats/top-cwes.csv"},{"id":"ransomware-by-year","title":"Known ransomware use","statement":"361 of 1,721 KEV entries (21%) are flagged as known to be used in ransomware campaigns. By year added, the share ranges from 11.4% to 27%.","json":"https://glide-telemetry.pages.dev/api/stats/ransomware-by-year.json","csv":"https://glide-telemetry.pages.dev/api/stats/ransomware-by-year.csv"},{"id":"remediation-by-year","title":"Days from addition to federal due date","statement":"The median KEV entry gives federal agencies 21 days from dateAdded to dueDate. The median by year added was 2021: 181; 2022: 21; 2023: 21; 2024: 21; 2025: 21; 2026: 14.","json":"https://glide-telemetry.pages.dev/api/stats/remediation-by-year.json","csv":"https://glide-telemetry.pages.dev/api/stats/remediation-by-year.csv"},{"id":"cve-age-by-year","title":"Age of CVE IDs when added","statement":"21.4% of KEV entries carry a CVE ID at least five years older than the year they were added. In 2022 that share was 47%.","json":"https://glide-telemetry.pages.dev/api/stats/cve-age-by-year.json","csv":"https://glide-telemetry.pages.dev/api/stats/cve-age-by-year.csv"},{"id":"weekly-additions","title":"KEV additions per week (last 26 weeks)","statement":"169 entries were added in the 26 weeks to 2026-09-23, an average of 6.5 a week.","json":"https://glide-telemetry.pages.dev/api/stats/weekly-additions.json","csv":"https://glide-telemetry.pages.dev/api/stats/weekly-additions.csv"}]}]}