Methodology

Source data

KEV figures come from CISA's Known Exploited Vulnerabilities catalog JSON feed. The current build uses catalog version 2026.09.23, released 2026-09-23, with 1,721 entries. The raw fields are kept as published: cveID, vendorProject, product, vulnerabilityName, dateAdded, shortDescription, requiredAction, dueDate, knownRansomwareCampaignUse, notes and cwes.

Reference date

Rolling windows ("last 7 days", "last 30 days", "last 90 days") end on the catalog's release date, 2026-09-23, not the build date, so a rebuild without new data gives the same numbers. A window of N days includes entries whose dateAdded falls in the N calendar days ending on the reference date, inclusive.

Definitions

• Vendor and product are CISA's vendorProject and product strings, unchanged. We do not merge spelling variants or subsidiaries, so a vendor's count is the count under that exact name.
• Ransomware-linked means knownRansomwareCampaignUse is "Known". "Unknown" is not the same as "no".
• CWE counts count an entry once for every CWE it lists. Entries with no CWE are reported separately. Shares are computed against the whole catalog, so they can add up to more than 100%.
• Remediation window is the number of days from dateAdded to dueDate. We report the median.
• Open deadlines are entries whose dueDate is on or after the reference date. The deadline applies to US federal civilian agencies only.
• CVE ID year is the year in the identifier. It is when the ID was assigned or reserved, which can differ from disclosure or exploitation.

Which pages exist and which are indexed

• A vendor page is generated for every vendor with at least 5 KEV entries.
• A product page is generated for every vendor-product pair with at least 3 entries.
• A weakness page is generated for every CWE with at least 3 entries, and is indexed from 5 entries.
• A CVE page is generated for the latest 100 additions. CVE pages repeat the CISA record, so they are marked noindex unless an editor has added an analyst note in data/cve-notes/.
• Search results and pages below the thresholds above are noindex.

CWE names

Names are shown only for well-known CWE IDs, following MITRE's CWE list. Other IDs are shown as the ID alone.

SMS OTP regulation board

Telemetry lists a jurisdiction when a regulator or standards body has issued a rule, circular or guideline that restricts or phases out SMS one-time passcodes for authenticating financial transactions or logins. Status is checked against the primary document or regulator statement. Dates are effective dates unless noted. The board was last verified on 2026-09-24.

Charts

Charts are drawn as SVG when the site is built. Every chart has a data table next to it and a CSV and JSON download on the API page.

Reuse

Data and charts may be reused with credit to Telemetry and a link to the page. The underlying KEV data is published by CISA.