Data status
How fresh and how complete the data is, and how many new CVEs nobody has scored yet. Each source's reads are live; the rest is counted in the background at most every 15 minutes, never while you wait. What each source is and how it is read is on the data sources page.
Every source is up to date.
FreshnessLate: no successful read in three intervals. Failing: the last read failed.
- CVE ListFresh
Last read 10 min ago (), every 10 minutes
- NVDFresh
Last read 53 min ago (), every hour
- CISA KEVFresh
Last read 54 min ago (), every 6 hours
- FIRST EPSSFresh
Last read 53 min ago (), every 6 hours
- GitHub advisoriesFresh
Last read 53 min ago (), every 12 hours
- MetasploitFresh
Last read 13 h ago (), once a day
- Nuclei templatesFresh
Last read 13 h ago (), once a day
- Exploit-DBFresh
Last read 13 h ago (), once a day
- ENISA EUVDFresh
Last read 53 min ago (), every 12 hours
- CIRCL sightingsNot read here
Last read never
Scoring backlogNew CVEs without a CVSS score from the CNA, CISA or NVD
- Last 7 days192 of 3,421 published CVEs have no score from anyone yet5.6%
- Last 30 days919 of 17,064 published CVEs have no score from anyone yet5.4%
- Last 90 days2,841 of 44,543 published CVEs have no score from anyone yet6.4%
- Not scored yet
- Scored
Show the numbers as a table
| Week of | Published | Not scored yet | Share |
|---|---|---|---|
| 643 | 43 | 6.7% | |
| 3,306 | 167 | 5.1% | |
| 3,426 | 102 | 3.0% | |
| 4,090 | 164 | 4.0% | |
| 5,457 | 443 | 8.1% | |
| 3,209 | 162 | 5.0% | |
| 2,530 | 0 | 0% | |
| 2,836 | 403 | 14% | |
| 4,826 | 556 | 12% | |
| 3,778 | 161 | 4.3% | |
| 2,285 | 169 | 7.4% | |
| 2,559 | 85 | 3.3% | |
| 3,421 | 50 | 1.5% | |
| 3,875 | 537 | 14% | |
| 1,847 | 19 | 1.0% | |
| 2,000 | 7 | 0.4% | |
| 2,806 | 54 | 1.9% | |
| 2,692 | 23 | 0.9% | |
| 1,491 | 0 | 0% | |
| 1,846 | 0 | 0% | |
| 1,892 | 0 | 0% | |
| 1,801 | 0 | 0% | |
| 1,769 | 0 | 0% | |
| 1,609 | 0 | 0% | |
| 2,069 | 0 | 0% | |
| 952 | 0 | 0% |
Older weeks look better than they were: their CVEs had more time to be scored. A CVE without a score is not harmless; it only means nobody has rated it yet, so filters by severity leave it out.
Time to a first scoreFrom the history of changes the site keeps
Too early to tell
Changes have been recorded since 7 Nov 2026. A CVE counts once it is 7 days old, so the first figures appear on 14 Nov 2026.
CoverageOf 402,771 published CVEs; 19,156 rejected ids are left out
- Scored by the CNAThe organization that assigned the CVE gave a CVSS score in the record.46%184,798
- Scored by CISA (ADP)No CNA score; CISA added one to the record as an Authorized Data Publisher (Vulnrichment).11%44,832
- Scored by NVD onlyThe record has no score of its own; NIST’s NVD analysed it and gave one.42%168,992
- Not scored by anyoneNo CVSS score from the CNA, CISA or NVD. Shown as “Not scored” everywhere on the site.1.0%4,149
- Weakness (CWE)Names at least one CWE id, from the record or NVD. “NVD-CWE-Other” and “noinfo” do not count.85%341,714
- Affected productsNames an affected vendor other than “n/a”. Old records often name none.58%234,758
- EPSS scoreFIRST scores nearly every published CVE once a day; the newest wait for the next file.99.8%402,197
- In CISA KEVExploited in the wild, per CISA. A small share by design: KEV lists only what has evidence.0.4%1,773
- Exploited per ENISAIn ENISA’s consolidated catalog, which joins CISA KEV and the EU KEV.0.4%1,790
- EUVD idHas an entry in ENISA’s EU Vulnerability Database.>99.9%402,754
- Public exploitAn exploit reference, CISA’s SSVC, Metasploit, Nuclei or Exploit-DB. Anyone could try it; not proof of attacks.20%81,817
- SightingsReported seen, exploited or patched to CIRCL since the site began reading it. Unverified signals.CIRCL sightings has not been read on this server yet, so this count says nothing.0%0
Counted (4 min ago) in 5,637 ms. A CVE counts once per line, however many entries it has. The same figures are in the API as GET /v1/status.