Charts on the EU Vulnerability Database, regenerated every day by the monitor in this repository from the EUVD's own API, the CISA KEV catalogue and Shadowserver honeypot data as served by the EUVD. Data as of 13 Oct 2026. Every panel says what it shows, where the data comes from and what it cannot show. None of it says how a vulnerability reached ENISA: no source records the reporting route. Raw data: stats.json; the exploited entries one by one: index.html; the API: API.md.
This page is pre-rendered: the charts are drawn into the file, so it needs no JavaScript. Hover a bar or dot for its value where your viewer supports it.
Part 1: The EUVD as a whole
All 404,107 records, not only the exploited ones. Counts come from /api/search with fromDate/toDate (publication date) and the assigner and fromScore filters; the field total gives the count without downloading the records.
Volume1. Records published per month
/api/search totals per month, November 2024 to 13 Oct 2026 (documented filters).
Scroll sideways for the whole chart.
critical (CVSS 9+)other records
What you seeEach bar is the number of records the EUVD published that month; the red part is the critical ones (CVSS 9 or more). The last full month, September 2026, had 14,964 records (1,559 critical), against an average of 6,364 a month over the twelve months before it. It is the busiest month shown.
Limits: The date is when the EUVD published the record, not when the vulnerability was found. A jump can mean the EUVD ingested a new source rather than that more vulnerabilities exist; the API does not say which. The last bar is the current, unfinished month.
Small multiples2. European assigners, month by month
/api/search?assigner=... totals per month for 13 European CNAs, national CSIRTs and European vendors. The assigner is the body that issued the CVE record.
CERT@VDE (DE)
818 in total, 243 in the last 12 months
CERT Polska (PL)
548 in total, 327 in the last 12 months
INCIBE-CERT (ES)
1,177 in total, 337 in the last 12 months
CIRCL (LU)
235 in total, 215 in the last 12 months
ENISA (EU)
74 in total, 51 in the last 12 months
NCSC-NL (NL)
39 in total, 7 in the last 12 months
NCSC-FI (FI)
27 in total, 17 in the last 12 months
SK-CERT (SK)
6 in total, 3 in the last 12 months
Siemens (DE)
1,875 in total, 144 in the last 12 months
Schneider Electric (FR)
749 in total, 44 in the last 12 months
ABB (CH/SE)
285 in total, 38 in the last 12 months
Bosch (DE)
134 in total, 13 in the last 12 months
Nozomi Networks
303 in total, 92 in the last 12 months
What you seeOne small chart per assigner, same months as panel 1, each scaled to its own maximum (the number at top right). Most active over the last twelve full months: INCIBE-CERT (ES) (337), CERT Polska (PL) (327) and CERT@VDE (DE) (243). At least doubled in the last six months against the six before: CERT Polska (PL), ENISA (EU), Schneider Electric (FR). Highlighted, and shown in detail below: CERT@VDE (DE), CERT Polska (PL), INCIBE-CERT (ES), CIRCL (LU).
Limits: Each chart has its own scale, so compare shapes, not heights. Only the assigners listed here are counted; the API offers no list of all assigners (/api/assigners/names returns seven names), so the list is a choice made in euvd/build_stats.py. A vendor that uses a CSIRT as its CNA appears under the CSIRT.
Ranking3. Where European assigners stand
/api/search?assigner=... totals over all years, the European CNAs above against some of the largest global ones.
Scroll sideways for the whole chart.
What you seeBars on a logarithmic scale, European assigners in blue and global ones in grey. MITRE has issued 116,857 records; the largest European assigner here, Siemens (DE), 1,875. The 13 European assigners listed together account for 1.6% of the EUVD's 404,107 records.
Limits: A logarithmic scale makes small numbers visible but shrinks large differences: each grid step is ten times the one before. The global list is a selection, not the complete top.
Profile4. CERT@VDE (DE) in detail
/api/search?assigner=CERTVDE, all 818 records, with the EUVD record fields datePublished, baseScore, epss and vendor.
Record
Vendor
CVSS
EPSS
EUVD-2021-20236
Geutebrück
7.2
95.77%
EUVD-2023-23926
WAGO
9.8
81.91%
EUVD-2021-20235
Geutebrück
9.8
81.34%
EUVD-2021-20241
Geutebrück
7.2
68.58%
EUVD-2021-20246
Geutebrück
7.2
59.55%
What you seeCERT@VDE (DE) assigns records in the EUVD, as CNA CERTVDE: 818 in all. Left: records by year of publication, 201 in 2026 so far. Middle: the vendors they cover, led by PHOENIX CONTACT, CODESYS, MB connect line. Right: severity; the largest group is high (7-8.9). None of the records is flagged as exploited. The table lists the records with the highest EPSS, the modelled chance of exploitation.
Limits: Assigning a CVE is not the same as reporting an exploited vulnerability: a CNA coordinates disclosure for the vendors it covers. A high EPSS is a prediction, not evidence of exploitation. 71 records carry no publication date and are left out of the yearly count. Profiled here: CERT@VDE (DE), CERT Polska (PL), INCIBE-CERT (ES), CIRCL (LU); the list is set in euvd/build_stats.py.
Profile5. CERT Polska (PL) in detail
/api/search?assigner=CERT-PL, all 548 records, with the EUVD record fields datePublished, baseScore, epss and vendor.
Record
Vendor
CVSS
EPSS
EUVD-2025-4586
arc53
9.3
17.09%
EUVD-2024-32371
Phoniebox
8.7
14.57%
EUVD-2024-34048
CTFd
5.3
11.58%
EUVD-2026-72024
MikroTik
9.2
6.45%
EUVD-2026-72029
MikroTik
9.2
6.39%
What you seeCERT Polska (PL) assigns records in the EUVD, as CNA CERT-PL: 548 in all. Left: records by year of publication, 289 in 2026 so far. Middle: the vendors they cover, led by OpenSolution, GNU, CGM. Right: severity; the largest group is medium (4-6.9). 4 of them are flagged as exploited. The table lists the records with the highest EPSS, the modelled chance of exploitation.
Limits: Assigning a CVE is not the same as reporting an exploited vulnerability: a CNA coordinates disclosure for the vendors it covers. A high EPSS is a prediction, not evidence of exploitation. 0 records carry no publication date and are left out of the yearly count. Profiled here: CERT@VDE (DE), CERT Polska (PL), INCIBE-CERT (ES), CIRCL (LU); the list is set in euvd/build_stats.py.
Profile6. INCIBE-CERT (ES) in detail
/api/search?assigner=INCIBE, all 1,177 records, with the EUVD record fields datePublished, baseScore, epss and vendor.
Record
Vendor
CVSS
EPSS
EUVD-2021-33942
TP-Link
9.8
72.38%
EUVD-2024-1739
Dolibarr
9.1
34.52%
EUVD-2022-34362
Grandstream
9.8
5.84%
EUVD-2022-34329
Grandstream
9.8
5.45%
EUVD-2023-54616
ManageEngine
6.6
3.25%
What you seeINCIBE-CERT (ES) assigns records in the EUVD, as CNA INCIBE: 1,177 in all. Left: records by year of publication, 224 in 2026 so far. Middle: the vendors they cover, led by Cups Easy, AndSoft, Janobe. Right: severity; the largest group is medium (4-6.9). None of the records is flagged as exploited. The table lists the records with the highest EPSS, the modelled chance of exploitation.
Limits: Assigning a CVE is not the same as reporting an exploited vulnerability: a CNA coordinates disclosure for the vendors it covers. A high EPSS is a prediction, not evidence of exploitation. 5 records carry no publication date and are left out of the yearly count. Profiled here: CERT@VDE (DE), CERT Polska (PL), INCIBE-CERT (ES), CIRCL (LU); the list is set in euvd/build_stats.py.
Profile7. CIRCL (LU) in detail
/api/search?assigner=CIRCL, all 235 records, with the EUVD record fields datePublished, baseScore, epss and vendor.
Record
Vendor
CVSS
EPSS
EUVD-2026-41753
cve-search
9.2
1.43%
EUVD-2026-74805
n/a
10
1.08%
EUVD-2026-70510
MISP
9.5
0.87%
EUVD-2026-64888
RansomLook
8.7
0.8%
EUVD-2026-84496
MISP
5.1
0.76%
What you seeCIRCL (LU) assigns records in the EUVD, as CNA CIRCL: 235 in all. Left: records by year of publication, 235 in 2026 so far. Middle: the vendors they cover, led by MISP, flowintel, RansomLook. Right: severity; the largest group is medium (4-6.9). None of the records is flagged as exploited. The table lists the records with the highest EPSS, the modelled chance of exploitation.
Limits: Assigning a CVE is not the same as reporting an exploited vulnerability: a CNA coordinates disclosure for the vendors it covers. A high EPSS is a prediction, not evidence of exploitation. 0 records carry no publication date and are left out of the yearly count. Profiled here: CERT@VDE (DE), CERT Polska (PL), INCIBE-CERT (ES), CIRCL (LU); the list is set in euvd/build_stats.py.
The 1,752 EUVD entries flagged as exploited and the KEV catalogues behind them, CISA KEV and the EU KEV: how many arrive, and how long after publication. Colours: CISA KEV only, both catalogues, EU KEV only.
Time series8. Known-exploited additions per month
/api/kev/dump (documented): one entry per CVE with its earliest date across CISA KEV and EU KEV, refreshed daily by ENISA.
Scroll sideways for the whole chart.
What you seeEach bar is one month, split by which catalogue lists the CVE; the dashed line marks the SRP go-live month. CISA dominates: 1,679 of 1,752 entries are in CISA's catalogue only, 73 are also or only in the EU KEV. The last full month, September 2026, added 49. The tall bars at the start are CISA building up its catalogue in 2021 and 2022, not surges.
Limits: The month of the earliest date, not of the latest listing. It says what is flagged as exploited, not how it reached ENISA; nothing in this chart can show SRP reporting.
Time series9. Daily additions, recent weeks
The same dump, by day, 15 Aug 2026 to 13 Oct 2026.
Scroll sideways for the whole chart.
What you seeOne bar per day with at least one addition; the dashed line is the SRP go-live (11 Sep 2026) when it falls in the window. 81 additions on 29 of 60 days. Most days without a bar are weekends.
Limits: A day without a bar is a day without additions, not missing data. Daily counts are small and noisy; do not read a trend out of a few days.
Distribution10. How long after publication was an entry flagged?
EUVD record datePublished against exploitedSince, for entries flagged in the last 12 months (313 entries).
Scroll sideways for the whole chart.
What you seeBars count entries by the gap between publication in the EUVD and the day they were flagged as exploited. The largest group is same day (62 entries); 56 waited more than a year. The median gap is 14 days.
Limits: "Before publication" means flagged before the EUVD record existed, usually a record created late. The gap measures when an entry was flagged, not when exploitation began.
Comparison11. Who is faster: the EUVD or the KEV catalogues?
EUVD record datePublished against exploitedSince (the earliest KEV date), for every exploited entry flagged since October 2024 (568 entries), by month of flagging. Months with fewer than 5 entries are left out.
Scroll sideways for the whole chart.
What you seeTop: per month, how many entries were in the EUVD first, on the same day, or flagged by a KEV catalogue first; the EUVD was first for 79%. Bottom: the gap in days, bars for the median and hollow dots for the mean. Over the period the median is 17.5 days and the mean 498: a few entries waited years, which pulls the mean up, so the median is the fairer "average". Since the go-live (35 entries) the median is 3 and the mean 474.
Limits: The gap runs from the EUVD record to the first KEV listing: how long an entry waited in the EUVD before being flagged, not which source knew first, since a vulnerability may have been public elsewhere earlier. A change in the gap is an observation; the chart cannot say why it changed.
Change12. How often do exploited entries change?
EUVD records: dateUpdated of the exploited entries per day, last 30 days. Also available through fromUpdatedDate in /api/search.
Scroll sideways for the whole chart.
What you seeEach bar is the number of exploited entries the EUVD edited that day (scores, references, advisories, product data): 144 edits in 30 days, most on 1 Oct 2026 (41).
Limits: Editing activity on the record, not a change in whether something is exploited. A change in the exploited status itself shows up only by comparing daily snapshots, which this monitor keeps.
The EU KEV, the catalogue ENISA keeps with the EU CSIRTs Network, against CISA's, and the entries whose dates fit an early notification. None of this shows the reporting route; the background is in EU-KEV.md.
Comparison13. EU KEV against CISA: who lists a vulnerability first
/api/kevEntries/batch (undocumented): the day each catalogue added every entry the EU KEV lists. Shown: the entries the EU KEV added since 15 Jun 2026.
Scroll sideways for the whole chart.
What you seeOne row per entry, newest at the top. A gold dot is the EU KEV date, a blue dot the CISA date, joined by a grey line; a triangle at the left edge means CISA listed it before the window. In the last 90 days (31 entries in both catalogues) the EU KEV was first for 10, on the same day for 10 and later for 11; the median gap is 0 days. Before that (30 entries) CISA was first for 26, with a median of 283 days: the EU KEV largely added older CISA entries. Rows with only a gold dot are not in CISA's catalogue.
Limits: The EU KEV is not the SRP. Its dates go back to 17 Jan 2025, and no entry carries an EU KEV date in the ten days from the go-live. An entry the EU KEV listed after the go-live and CISA did not, or did later, is a candidate for an SRP origin, nothing more. The date is when the catalogue added the entry, not when the vulnerability was reported.
Indication14. Candidates: entries flagged after the go-live
From the previous panel: EU KEV date on or after the go-live, and CISA either absent or later. The same rule as candidate in euvd/exploited.json.
Entry
CVE
EU KEV
CISA KEV
EU KEV source
Why it qualifies
EUVD-2026-92065
CVE-2026-88779
2026-10-02
2026-10-04
CSIRTs Network
EU KEV first, CISA 2 days later
EUVD-2026-90081
CVE-2026-102490
2026-09-30
2026-10-02
NCSC-NL
EU KEV first, CISA 2 days later
EUVD-2026-90080
CVE-2026-102489
2026-09-30
2026-10-02
NCSC-NL
EU KEV first, CISA 2 days later
EUVD-2026-75010
CVE-2026-85103
2026-09-25
not listed
CSIRTs Network
EU KEV only
EUVD-2026-84555
CVE-2026-87902
2026-09-23
2026-09-25
NCSC-NL
EU KEV first, CISA 2 days later
What you seeA list rather than a chart: each row is an entry and the reason it qualifies. 5 entries qualify today.
Limits: The criteria are mechanical. A candidate may well have come from the vendor, a CSIRT or a researcher outside the SRP; no public source records the reporting route. The monitor applies the same rule only to the entries in its window (euvd/exploited.json), this panel to every EU KEV entry, so the two can differ for a day when the EU KEV adds a back-dated entry.
Sources15. Who reports into the EU KEV
/api/kevEntries/batch (undocumented): the originSource of every EU KEV entry, the body that brought it in. Spellings are merged (for example cnw and CNW).
What you seePairs of bars per source: grey before the go-live, gold from 11 Sep 2026. Appearing only after the go-live: NCSC-NL (3), CSIRT-IE (2). The table lists every entry added since the go-live with its source.
Limits: The origin is who brought the entry into the EU KEV, not how the vulnerability first reached anyone; a CSIRT can learn of exploitation in many ways besides an SRP notification. Still the most direct pointer the public data offers towards the SRP, because CRA notifications go to a national CSIRT.
The vendors behind the exploited entries, their severity against the modelled likelihood of exploitation, and how CISA rates urgency and ransomware use.
Ranking16. Which vendors are flagged most often
EUVD records: the vendor on each exploited entry, by exploitedSince; the last 90 days against the 90 days before.
Scroll sideways for the whole chart.
What you seePairs of bars per vendor: the last 90 days in blue, the 90 days before in grey. n/a leads with 10. Newly frequent (at least twice the count of the period before): Fortinet, Linux, JFrog, MikroTik, checkpoint, WordPress. "n/a" is entries without a vendor name.
Limits: Counts are entries, not incidents, and one product family can contribute many CVEs. The KEV dump has no vendor field, so this uses the per-entry records.
Scatter17. Severity against likelihood of exploitation
EUVD records of the 103 entries flagged in the last 90 days: CVSS base score and EPSS (the EUVD's own epss field).
Scroll sideways for the whole chart.
What you seeEach dot is one recently flagged vulnerability. Horizontal: CVSS severity. Vertical: EPSS, the modelled chance of exploitation in the next 30 days. 29 entries are critical (CVSS 9+) but had an EPSS under 10% (red): critical flaws the model rated unlikely, yet they are exploited.
Limits: EPSS is a prediction. These entries are already exploited, so low values show misses of the model, not errors in the data. EPSS changes daily; the chart shows the value at the last run.
Time series18. How urgently CISA wants new entries fixed
CISA KEV catalogue (dateAdded, dueDate, forensicTriage), entries added in the last 24 months, by month.
Scroll sideways for the whole chart.
What you seeEach bar splits a month's new entries by the remediation window CISA set for US federal agencies: 3 days, 7, 14, 21. Hollow dots count entries marked for forensic triage. In the last three full months 78% of new entries got three days. Forensic triage first appears in July 2026 and covers 72% of the entries added since.
Limits: These are deadlines for US federal agencies, not for anyone in the EU; they show how CISA rates urgency, not how dangerous a flaw is in Europe. forensicTriage refers to BOD 26-04 and is absent for older entries.
Profile19. Ransomware use and weakness types
CISA KEV catalogue: knownRansomwareCampaignUse by year added, and the cwes field across all 1,739 entries.
What you seeLeft: the share of entries CISA knows to be used by ransomware groups, by year added: 27% in 2021, 11% in 2026. Right: the most frequent weakness types, led by Improper input validation, OS command injection, Out-of-bounds write.
Limits: "Known" ransomware use is added as CISA learns of it, so recent years are low partly because that knowledge has not arrived yet. One entry can carry several weakness types, and older entries often carry none.
Shadowserver's honeypot sensors as the EUVD serves them: which exploited entries the sensors see, how hard they are attacked today, whether a rise lasts, and whether the sensors saw attacks before the KEV listing. 332 of 1,752 exploited entries have sensor data.
Coverage20. How much of the exploited list do sensors see?
The same honeypot endpoint, checked for all 1,752 exploited entries, grouped by the year they were flagged.
Scroll sideways for the whole chart.
What you seeBars show the share of entries per year that have honeypot data: 19% overall, highest for 2024 (28%), lowest for 2022 (14%).
Limits: Absence from the sensors does not mean an entry is not attacked, only that the sensors do not emulate it. Edge devices and web applications dominate what sensors see.
Honeypot21. Honeypot activity per entry: today against the usual level
/api/honeypotObservations/batch (undocumented, used by the EUVD frontend): Shadowserver sensor connections in the last 24 hours and averages over 7, 30 and 90 days.
Scroll sideways for the whole chart.
What you seeEach row is one exploited vulnerability the sensors see attacked, the 16 busiest. The four dots, left to right on a logarithmic scale, are the 90-, 30- and 7-day averages and today (filled); a filled dot far right of the others is a jump; “Burst or campaign?” below shows how concentrated it is. Red rows carry the EUVD's own UPTICK flag (16 of the rows shown; 185 of all 238 entries with counts), grey is steady, green declining.
Limits: Connection counts from sensors, not victims and not the reporting route. Only 332 of 1,752 exploited entries appear in the sensors at all. The EUVD keeps no history of these counts; the daily record started by this monitor is in “Do upticks last?” and in the last panel.
Honeypot22. Burst or campaign? Connections against source addresses
The same endpoint, today: connections1d and uniqueIps1d for every exploited entry the sensors saw attacked.
Scroll sideways for the whole chart.
UPTICKsteadydeclining
#
Entry
CVE
Vendor and product
Connections
Addresses
1
EUVD-2026-14546
CVE-2026-3055
Citrix Citrix NetScaler ADC and NetScaler Gatew
19,117
80
2
EUVD-2022-43955
CVE-2022-40684
Fortinet FortiOS, FortiProxy, and FortiSwitchMana
16,735
16
3
EUVD-2018-5323
CVE-2018-13379
Fortinet FortiOS
10,342
28
4
EUVD-2020-29070
CVE-2020-8193
Citrix Citrix ADC, Citrix Gateway, Citrix SDWAN
3,547
14
5
EUVD-2023-24377
CVE-2023-20198
Cisco Cisco IOS XE
3,497
287
6
EUVD-2022-44326
CVE-2022-41082
Microsoft Exchange
659
523
7
EUVD-2014-8198
CVE-2014-8361
Realtek Realtek SDK
838
391
8
EUVD-2025-18497
CVE-2025-5777
Citrix Citrix NetScaler
3,021
85
9
EUVD-2021-12905
CVE-2021-26084
Atlassian Confluence
2,703
27
What you seeEach dot is one exploited vulnerability the sensors saw attacked today (238). Further right means more connections, higher up more distinct source addresses; both scales are logarithmic. Dots low and far right are hammered by a few sources: 6 entries had over 1,000 connections from fewer than 20 addresses, the most Fortinet FortiOS, FortiProxy, and FortiSwitchMana (CVE-2022-40684: 16,735 connections from 16). Dots high up are scanned broadly. Red carries the EUVD's UPTICK flag; a ring marks a surge as this monitor defines it (21 broad today). The numbered dots are listed below the chart.
Limits: Connections and addresses as Shadowserver's sensors count them on one day. A few addresses can be one research scanner or one botnet node; many addresses can be a botnet or a crowd of scanners. The chart shows how concentrated the traffic is, not who sent it or why.
History23. Do upticks last?
euvd/history.jsonl: the connections, source addresses, trend flag and 30-day average this monitor records for every entry each day, because the EUVD keeps no history.
Scroll sideways for the whole chart.
What you seeOne row per entry that reached ten times its 30-day average from ten or more addresses, or was in a surge, on any of the last 7 recorded days (134 entries; the 20 with the most such days are shown). One column per day. The colour is that day's connections against the entry's 30-day average, pale around the usual level and dark at 20 times and more; a dot marks the UPTICK flag. 6 entries were at that level on three recorded days in a row, the persistent surges this monitor reports.
Limits: Starts with the monitor's record. Days recorded before 9 October 2026 hold only connection counts, so their cells are blank. A missing column is a day the monitor did not run. UPTICK compares one day with the 7-day average (inferred from the data, not documented), so one flag alone is a one-day burst.
Timing24. Did the sensors see it before the KEV listing?
The honeypot observations' firstSeenAt (the first day the sensors recorded attempts against the CVE) against exploitedSince, which for nearly every entry is the day CISA listed it.
Scroll sideways for the whole chart.
Entry
CVE
Vendor
Flagged
EU KEV
First seen by sensors
Sensors
EUVD-2026-89950
CVE-2026-76504
Cisco
2026-09-30
-
2026-10-09
9 days after
EUVD-2026-87958
CVE-2026-88771
Citrix NetScaler
2026-09-27
2026-09-27
2026-09-29
2 days after
EUVD-2026-84375
CVE-2026-93616
checkpoint
2026-09-22
2026-09-22
2026-09-26
4 days after
EUVD-2026-76779
CVE-2026-85706
GitLab
2026-09-11
-
2026-10-08
27 days after
What you see332 exploited entries have a first sighting. 33 were first seen on 23 Jun 2022, the first day of the sensors' record, so their sighting may be older; they are left out of the bars. Of the other 299, 36 were seen before the entry was flagged (19 within 30 days before), 2 on the day and 261 after. The table lists the 4 entries flagged since the go-live.
Limits: A first sighting is the first day Shadowserver's sensors recorded attempts against the CVE. Sensors learn new vulnerabilities over time, so "after" can mean the sensor came late, not the attacks. Neither date says how the vulnerability reached ENISA.
What this monitor records itself, every day, because the EUVD keeps no history of it.
History25. The monitor's own daily record
euvd/history.jsonl: one line per day written by this monitor, because the EUVD keeps no history of these values: size of the exploited set, size of the EUVD, entries seen by the honeypot sensors, their connections and the number flagged UPTICK.
Scroll sideways for the whole chart.
What you see7 days recorded, 7 Oct 2026 to 13 Oct 2026. The exploited set went from 1,747 to 1,752 entries; honeypot connections across all entries from 95,708 to 102,558 a day; the EUVD flagged 185 entries UPTICK on the last day.
Limits: Starts on the day the monitor began recording; nothing before that can be reconstructed. A missing day means the monitor did not run, not that nothing happened.