Skip to main content
cvebuzz

CVE mentions, exploit signals, and PoC evidence in one fast public view.

Strongest supported finding

KEV inclusion often follows publication much later

Among 1,600 KEV-listed CVEs with usable dates, the median gap from CVE publication to CISA's recorded dateAdded is 325 days. This describes retrospective inclusion in the current catalog, not how quickly CISA responded when each vulnerability was first disclosed.

Median KEV-inclusion lag
325.0
UTC calendar days from CVE publication to CISA dateAdded
Usable sample
1,600
Non-negative publication-to-KEV date pairs

Metric 1

Disclosure-to-KEV-inclusion lag

For each CVE with both dates, cvebuzz subtracts the UTC calendar date of cves.published_at from CISA's dateAdded, stored in the KEV row's observed_at field. Same-calendar-day entries are 0 days regardless of timestamp.

Median lag
325 days
1,600 CVEs in the lag sample
0-7 days
328
KEV-listed CVEs in this bucket
8-30 days
119
KEV-listed CVEs in this bucket
31-90 days
125
KEV-listed CVEs in this bucket
90+ days
1,028
KEV-listed CVEs in this bucket
Of 1,662 KEV CVEs (1,662 stored rows), 1,600 have a usable non-negative lag. 62 have a CISA dateAdded on an earlier UTC date, 0 lack dateAdded, and 0 more have dateAdded but no publication timestamp; each group is reported separately and excluded from the histogram and median.

PoC comparison is not yet reliable

The per-CVE scanner has covered 331 of 356,120 CVEs (0.1% coverage): 45 have a tracked public exploit repository and 286 completed a scan without one found. 4,652 more have discovery-only public exploit evidence but no per-CVE scan checkpoint, so they do not enter the comparison; 351,137 remain unknown/unscanned. At least 100 CVEs are required in each scanned arm before cvebuzz reports a numeric rate difference. Coverage is non-random and coverage-biased, and “no tracked repository found” is not proof that no PoC exists. This is an exploratory association, not a causal claim.

Metric 2

PoC-to-KEV correlation

This compares only CVEs processed by the same per-CVE scanner: those where a public exploit repository was found versus those where none was found. Discovery-only and unknown/unscanned CVEs remain visible as coverage context but are excluded from the rate difference.

Rate delta
Not reported
Shown only when both scanned arms contain at least 100 CVEs

Scanned; public exploit repository found

0 of 45 CVEs are in KEV

0.0%

Scanned; no tracked public PoC found

0 of 286 CVEs are in KEV

0.0%

Discovery-only public exploit evidence

107 of 4,652 CVEs are in KEV

2.3%

Unknown / unscanned

1,555 of 351,137 CVEs are in KEV

0.4%