Skip to content
feed: live
>_0dayNews
$ track-record

Were we right, and were we early?

Any tracker can mirror CISA's KEV catalog after the fact. This page checks whether our own reporting existed before CISA's official confirmation — computed directly from our publish dates against CISA's listing dates, not asserted. The query that generates this page is public; see the methodology note below.

97%
of qualifying CVEs covered before or on CISA's KEV date
115
hand-written CVE entries now confirmed KEV

Fastest calls on record

CVEEditorWe publishedCISA listed KEVLead time
CVE-2026-88771+ Patch & DefenseSeptember 27, 2026September 27, 2026same day
CVE-2026-88772+ Patch & DefenseSeptember 27, 2026September 27, 2026same day
CVE-2026-65660+ Patch & DefenseSeptember 25, 2026September 25, 2026same day
CVE-2026-67279~ AnalysisSeptember 25, 2026September 25, 2026same day
CVE-2026-5430+ Patch & DefenseSeptember 24, 2026September 24, 2026same day
CVE-2026-93616~ AnalysisSeptember 22, 2026September 22, 2026same day
CVE-2026-93952~ AnalysisSeptember 22, 2026September 22, 2026same day
CVE-2026-94127~ AnalysisSeptember 22, 2026September 22, 2026same day
CVE-2026-7273+ Patch & DefenseSeptember 21, 2026September 21, 2026same day
CVE-2025-39682+ Patch & DefenseSeptember 18, 2026September 18, 2026same day
CVE-2025-39964+ Patch & DefenseSeptember 18, 2026September 18, 2026same day
CVE-2026-53266+ Patch & DefenseSeptember 18, 2026September 18, 2026same day
CVE-2026-58704+ Patch & DefenseSeptember 16, 2026September 16, 2026same day
CVE-2026-76460~ AnalysisSeptember 16, 2026September 16, 2026same day
CVE-2026-76461~ AnalysisSeptember 14, 2026September 14, 2026same day
~/track-record --methodology

What's counted: only CVE entries a named editor actually wrote, that are currently confirmed KEV or exploited-in-wild, and where we have both our own publish date and CISA's official KEV-listing date (kevDateAdded) to compare.

What's excluded: the roughly 1,600 CVE entries oursync process auto-backfilled directly from CISA's own catalog, to fill out the KEV tracker. Those entries' publish dates are mechanically set to CISA's own listing date — including them would inflate this number for free, so they're not counted.

What "lead time" does and doesn't mean: a large lead-time number sometimes means we happened to cover a CVE for general disclosure reasons long before CISA later confirmed active exploitation on it — not that we predicted the exploitation. Either way, the claim is narrow and literal: our reporting existed, and was accurate, before CISA's official confirmation. Dates are shown in full above so you can judge each one yourself.