Vulnerability Intelligence
Track CVE Disclosures and CISA KEV Additions Week by Week.
Triage works one CVE at a time. Planning and reporting need the whole database: how many CVEs were published this week, what CISA added to its Known Exploited Vulnerabilities catalog, which weakness types keep coming back, how one product’s CVEs split by severity.
Deep Search & Insights returns those numbers as JSON, from the endpoints behind our public Vulnerability Insights page.
403,188 CVEs on record
| Year | Total | Critical | High | Medium | Low | Unscored |
|---|---|---|---|---|---|---|
| 2026 (to date) | 77,911 | 8,717 | 31,234 | 28,112 | 5,271 | 4,577 |
| 2025 | 49,972 | 4,174 | 15,905 | 24,066 | 3,100 | 2,727 |
| 2024 | 40,704 | 4,300 | 14,036 | 20,755 | 853 | 760 |
| 2023 | 30,949 | 4,634 | 10,956 | 12,802 | 423 | 2,134 |
| 2022 | 26,431 | 4,247 | 10,157 | 10,180 | 487 | 1,360 |
Added to CISA KEV
- Last 7 days
- 9
- Last 30 days
- 44
The Endpoints Cover Velocity, Structure and One CVE Over Time.
The endpoints group by the question they answer. All of them live under GET / and return plain JSON.
Velocity
What Is New
CVEs published and modified in the last 1, 7 and 30 days, CISA KEV additions over the same windows, and the latest added CVEs, filterable by vendor, product, version and severity.
cve-statscisa-kev-statslatest-added-vulnerabilities-list
Structure
How the Database Is Shaped
CVE counts per year and severity back to 1988, the spread of CVEs by CVSS score, and the number of CVEs per weakness type (CWE) in each year.
vulnerability-severity-stats-by-yearvulnerability-stats-by-cvss-scorescwe-timeline
One CVE
How Its Odds Moved
The EPSS score and percentile of a single CVE for each day on record, so you can see when its estimated likelihood of exploitation changed.
epss-history/{cve}
Four Numbers Sum Up Thirty Days of Disclosures.
CVE Stats and CISA KEV Stats at the last Insights refresh, reloaded from the Insights cache when the page opens. Publication volume and evidence of exploitation move separately, so the row shows both.
- Last 7 days
- 3,073CVEs publishedCVE Stats
- Last 30 days
- 15,943CVEs publishedCVE Stats
- Last 7 days
- 9added to CISA KEVCISA KEV Stats
- Last 30 days
- 44added to CISA KEVCISA KEV Stats
Split Each Year’s CVE Volume by Severity.
One call returns the CVE count for each year, broken into critical, high, medium, low and other. Add a vendor, a product or a version and the same call returns that product’s history.
https://api.deepinfo.com/v1/explore/vulnerability-insight/vulnerability-severity-stats-by-year
Reference
| Parameter | Type | Description | |
|---|---|---|---|
vendor | string | Optional | Count only CVEs that affect this vendor. |
product | string | Optional | Count only CVEs that affect this product. |
version | string | Optional | Count only CVEs that affect this version. |
version_ | string | Optional | Count only CVEs that affect versions with this prefix, such as one major release. |
Request
curl "https://api.deepinfo.com/v1/explore/vulnerability-insight/vulnerability-severity-stats-by-year" \
-H "apikey: YOUR_API_KEY"import requests
r = requests.get(
"https://api.deepinfo.com/v1/explore/vulnerability-insight/vulnerability-severity-stats-by-year",
headers={"apikey": "YOUR_API_KEY"},
)
for y in r.json()["cve_count_by_year"][-3:]:
print(y["year"], y["cve_count_by_severity"]["critical"])const r = await fetch(
'https://api.deepinfo.com/v1/explore/vulnerability-insight/vulnerability-severity-stats-by-year',
{ headers: { apikey: 'YOUR_API_KEY' } }
)
const { cve_count_by_year } = await r.json()
console.log(cve_count_by_year.slice(-3))Response · from the Insights snapshot of 2026-10-08; the current year is partial
{
"vendor": "",
"product": "",
"version": "",
"cve_count": 403188,
"cve_count_by_year": [
"…",
{
"year": 2024,
"cve_count": 40704,
"cve_count_by_severity": {
"critical": 4300, "high": 14036,
"medium": 20755, "low": 853, "other": 760
}
},
{
"year": 2025,
"cve_count": 49972,
"cve_count_by_severity": {
"critical": 4174, "high": 15905,
"medium": 24066, "low": 3100, "other": 2727
}
},
{
"year": 2026,
"cve_count": 77911,
"cve_count_by_severity": {
"critical": 8717, "high": 31234,
"medium": 28112, "low": 5271, "other": 4577
}
}
]
}Follow One CVE’s EPSS Day by Day.
EPSS estimates the probability that a CVE is exploited in the next 30 days, and the estimate is recalculated as new evidence arrives. A single current score hides when the change happened.
EPSS History returns the score and percentile for each day on record. Set it against your patch dates and you can see whether a fix landed before or after the likelihood climbed.
EPSS history
CVE-2021-44228
/epss-history/CVE-2021-44228 · a score and percentile for each day on record
In this response, newest first
curl "https://api.deepinfo.com/v1/explore/vulnerability-insight/epss-history/CVE-2021-44228" \
-H "apikey: YOUR_API_KEY"{
"cve": "CVE-2021-44228",
"records": [
{ "epss": 0.99999, "percentile": 1.0, "date": "2026-09-21" },
{ "epss": 0.99999, "percentile": 1.0, "date": "2026-09-20" },
"…"
]
}Where the Numbers End Up.
Vulnerability Management
Check each week’s KEV additions against the products you run, and pull the newest CVEs for your stack with the Latest Added filters.
Threat Intelligence Reporting
Disclosure volume, severity mix and the weakness types on the rise, for a weekly or quarterly brief, from one source.
Supplier Due Diligence
A supplier product’s CVE history by year and severity, and the spread of its CVSS scores, before it goes into your estate.
Secure Development
The CWE timeline shows which weakness types dominate each year’s disclosures. That is a measured input for training plans and code review checklists.
Query This Data Through the API
Everything Deep Search & Insights shows in the platform is also available as data, through the API and as bulk feeds.
Questions About Vulnerability Intelligence
What is the difference between published and modified?
Published counts new CVE records. Modified counts changes to existing records, such as CVSS metrics added after analysis, new affected products or new references.
Do the stats cover all CVEs or only ours?
All CVEs in Deepinfo’s database. The CVEs found on your own assets, ranked for your team, are in External Attack Surface Management.
Why do some recent CVEs have no CVSS score?
A CVE record can be published before any CVSS metrics are attached. The record’s status shows how far analysis has gone, and last_ changes when scores are added.
Where does EPSS come from?
EPSS is the Exploit Prediction Scoring System, published by FIRST. Deepinfo attaches the score and percentile to each CVE record and keeps the daily history that EPSS History returns.
Where does the CISA KEV data come from?
From the Known Exploited Vulnerabilities catalog that CISA publishes. Once a CVE is listed, its record carries the KEV entry with the date added, the due date and the required action.
Can we narrow the trends to one vendor or product?
Severity by year, CVSS score stats and Latest Added accept vendor, product, version and version_. CVE Stats, CISA KEV Stats and the CWE timeline cover the whole database.
Ask the CVE Database a Structural Question.
Book a demo with a vendor, a product or a weakness class in mind. We query the trend endpoints with you and read the results together.