12 questions
Direct answers to operational CVE questions: how many are published daily, what share are actually exploited, how to prioritise a five-figure backlog, and how to track only the vulnerabilities affecting your stack.
Scale
Roughly 247 CVEs are published per day in 2026, up from about 136 per day in 2025 — an increase of well over half in a single year. The all-time total published stands at 386,879. Figures from NVD, September 2026.
About 0.44% of all published CVEs have confirmed exploitation in the wild. CISA's Known Exploited Vulnerabilities catalog lists 1,695 entries against 386,879 CVEs published all time. Sources: CISA KEV and NVD, September 2026.
Prioritisation
Order by evidence of exploitation, not by severity. Take anything with confirmed in-the-wild exploitation on an internet-facing system first, then high exploitation probability combined with real exposure, then everything else on a normal patch cycle. Severity scores describe worst-case impact and say nothing about whether a vulnerability is being used.
There is no universal threshold, but the distribution is extremely skewed: the vast majority of CVEs score below 0.01, so anything above roughly 0.1 already sits in a small minority worth a look, and above 0.5 is a strong signal. Treat EPSS as a ranking tool within your exposed inventory, not as a pass/fail gate.
CISA’s Known Exploited Vulnerabilities catalog is the authoritative free list, published as JSON and CSV and updated as evidence arrives. Pair it with vendor advisories, which often warn of exploitation before an entry appears, and with EPSS to rank everything not yet confirmed. Absence from the catalog means unconfirmed, never safe.
Workflow
Declare the technologies you actually run, then filter every incoming CVE against that list before a human ever sees it. This inverts the default workflow: instead of reading a global feed and asking "do we run this?", you receive only the disclosures that touch your declared inventory, which is typically a very small fraction of daily volume.
Route alerts to the channel your team already watches — email for the daily record, and a chat channel such as Slack or Telegram for anything urgent. The rule that makes alerting survive is that only exploitation-relevant, inventory-matched CVEs page anyone; everything else belongs in a digest nobody has to read immediately.
Check the vendor advisory linked from the CVE record, because that is the only authoritative source for a fix. Patch availability changes after publication, so a CVE that had no fix at disclosure often has one days later — which means the answer has to be re-checked rather than recorded once during triage.
Because NIST no longer enriches every CVE. Since 15 April 2026 the NVD prioritises CVEs in CISA KEV, in software used by the US federal government, or designated critical under Executive Order 14028; everything else is marked lowest priority and not scheduled. A missing score means nobody has assessed it yet — not that the flaw is minor.
The CVE Program record at cve.org carries the description and affected versions, NVD adds enrichment where it is prioritised, CISA KEV confirms exploitation, and the vendor advisory is the only authority on the fix. For open-source packages use OSV.dev or GitHub Security Advisories, and FIRST publishes EPSS probabilities free.
Product
Yes. The vulneraibility.com screener is open without an account or a credit card: you can search the analysed CVE corpus, filter by exploitation and severity signals, and read the per-CVE analysis pages directly. Accounts exist for the things that need to persist — your declared stack, alert routing and saved status — not for read access.
Yes. vulneraibility.com exposes a JSON API over the analysed CVE corpus so you can pull enrichment into your own tooling — ticketing, SIEM, or an internal dashboard — rather than reading a web page. API access is part of the top tier, and the reference documents the endpoints, authentication and response shape.