Stats
Two views: what is happening now (ransomware leak-site claims, new Cybersecurity and Infrastructure Security Agency (CISA) Known Exploited Vulnerabilities (KEV) entries, and news volume), and what the tracker's own history shows about how exploitation behaves.
Ransomware leak-site activity is based on unverified claims.
Jump to tracker historyHeadline statistics
This site build contains 10,525 stories. It includes 2,624 vulnerability news stories.
255 leak-site claims have been posted this month, 2 CISA KEV catalog additions have been made this month, and 2 stories have been published today.
- This month's leak-site claims255Unverified claimsDown from 1,371 last month
- Top group this monthN0n30 unverified claimsDown from 159 last month
- CISA KEV additions this month2Catalog additionsDown from 36 last month
- Stories today22026-11-06 UTCDown from 88 last month
Monthly totals compare the month to date with the previous calendar month. Stories today compares the same calendar date one month earlier. No value is projected.
Current state
Ransomware leak-site activity for month to date through 2026-11-06 02:47 UTC is based on unverified claims. This view also includes new CISA Known Exploited Vulnerabilities (KEV) additions for month to date through 2026-11-06 02:47 UTC and story volume for 2026-10-07 through 2026-11-06 UTC.
7 further claims carry no date and are not shown in the monthly bars.
Data coverage · 2026-11-01 through 2026-11-06 (month to date) · Showing 12 of 47 series, representing 68.6% of all dated, non-excluded ransomware claims in the stated month.
Window: 2026-11-01 through 2026-11-06 (month to date)
Coverage: Showing 12 of 47 series, representing 68.6% of all dated, non-excluded ransomware claims in the stated month.
Download complete numbers (JSON)Unclassified: sector classification is pending, the available evidence did not support a confident sector, or the source never states one.
Data coverage · 2026-11-01 through 2026-11-06 (month to date) · Showing 9 of 23 series, representing 76.9% of all dated, non-excluded ransomware claims in the stated month.
Window: 2026-11-01 through 2026-11-06 (month to date)
Coverage: Showing 9 of 23 series, representing 76.9% of all dated, non-excluded ransomware claims in the stated month.
Download complete numbers (JSON)11,434 claims across the 10 complete months both years have, versus 7,050 in 2025 (up 62%).
| Month | 2026 | 2025 |
|---|---|---|
| January | 905 | 695 |
| February | 993 | 1,004 |
| March | 1,221 | 813 |
| April | 1,062 | 665 |
| May | 1,000 | 501 |
| June | 1,026 | 521 |
| July | 1,105 | 622 |
| August | 1,518 | 550 |
| September | 1,233 | 654 |
| October | 1,371 | 1,025 |
| November (month to date) | 255 (month to date) | 773 |
| December | Not yet reached | 1,006 |
Dated leak-site claims this tracker collected per group for 2026-10-30 through 2026-11-05, Coordinated Universal Time (UTC), compared with 2026-10-23 through 2026-10-29.
How these are counted
The last column counts claims dated in the 24 hours before the data export; a claim stored with a date but no time counts when that date is today or yesterday. Claims are unverified, claims without a disclosure date are left out of every column, and "unknown" collects claims with no attributed group.
| Group | Claims, latest 7 days | Prior 7 days | Change | Last 24 hours |
|---|---|---|---|---|
| The Gentlemen | 38 | 54 | Down 30% | 1 |
| N0n | 29 | 18 | Up 61% | 10 |
| Qilin | 27 | 42 | Down 36% | 2 |
| Soul | 25 | 0 | Up from none in the prior 7 days | 0 |
| Safepay | 18 | 9 | +9 from 9 | 0 |
| Medusalocker | 17 | 0 | Up from none in the prior 7 days | 0 |
| Akira | 15 | 6 | +9 from 6 | 4 |
| Brain Cipher | 11 | 0 | Up from none in the prior 7 days | 0 |
| Braincipher | 11 | 0 | Up from none in the prior 7 days | 0 |
| Leakeddata | 10 | 7 | +3 from 7 | 2 |
Showing 10 of 65 groups with a dated claim in these windows, ordered by claims in the latest 7 days, so groups that went quiet sort last. Download the data (JSON).
Dated leak-site claims this tracker collected per sector for 2026-10-30 through 2026-11-05, Coordinated Universal Time (UTC), compared with 2026-10-23 through 2026-10-29.
How these are counted
The last column counts claims dated in the 24 hours before the data export; a row stored with a date but no time counts when that date is today or yesterday. Claims are unverified, claims without a disclosure date are left out of every column, and "Unclassified" collects rows whose sector this tracker has not matched to its sector list, including rows whose source never states one.
| Sector | Claims, latest 7 days | Prior 7 days | Change | Last 24 hours |
|---|---|---|---|---|
| Manufacturing | 53 | 37 | Up 43% | 4 |
| Technology | 34 | 28 | Up 21% | 7 |
| Healthcare | 34 | 35 | Down 3% | 1 |
| Business & Professional Services | 33 | 24 | Up 38% | 1 |
| Retail | 26 | 17 | Up 53% | 6 |
| Education | 17 | 14 | Up 21% | 2 |
| Financial Services | 15 | 17 | Down 12% | 2 |
| Construction & Engineering | 15 | 21 | Down 29% | 0 |
| Legal | 12 | 12 | No change | 1 |
| Unclassified | 42 | 35 | Up 20% | 2 |
Showing 10 of 24 sectors with a dated claim in these windows, ordered by claims in the latest 7 days, so sectors that went quiet sort last, except Unclassified, which is always last. Download the data (JSON).
Data coverage · latest 12 observed addition months, 2025-12 through 2026-11; complete stored source history begins 2021-11 · Showing 12 of 61 months, representing 17.2% of all CISA KEV entries with a stored addition month.
Window: latest 12 observed addition months, 2025-12 through 2026-11; complete stored source history begins 2021-11
Coverage: Showing 12 of 61 months, representing 17.2% of all CISA KEV entries with a stored addition month.
Download complete numbers (JSON)Data coverage · trailing 30 × 24 hours ending 2026-11-06; grouped by UTC date. Complete stored item history begins 2014-01-24.
Window: trailing 30 × 24 hours ending 2026-11-06; grouped by UTC date. Complete stored item history begins 2014-01-24.
Coverage: Showing 1 of 1 series, representing 100.0% of all stored items dated inside the trailing window.
Download complete numbers (JSON)Ransomware claim data is unverified: RansomLook (CC BY 4.0), with ransomware.live as a failover, credited and linked as its terms require (Source: Ransomware.live).
What the tracker's history shows
The tracker's history asks one question: how exploitation behaves. Each of its 8 parts use a committed query with its sample size, date range, and sources stated. A part below the minimum sample size is left out, and none of this is model output.
Severity does not predict exploitation
Many Common Vulnerabilities and Exposures (CVE) records attackers are actively exploiting carry only a Medium Common Vulnerability Scoring System (CVSS) severity, so a triage on severity alone would deprioritise them.
18.4%1,063 of 5,781 known-exploited CVEs with a known CVSS severity carry only MediumData coverage · point-in-time aggregate over the stored corpus as of 2026-11-06
Window: point-in-time aggregate over the stored corpus as of 2026-11-06
Coverage: Showing 1 of 1 series, representing 100.0% of the complete eligible population stated by this finding.
Download complete numbers (JSON)18.4% of known-exploited CVEs with a known CVSS severity (1063 of 5781) carry only a Medium CVSS severity, so severity alone would under-prioritise them.
Time from disclosure to exploitation
Once a CVE record publishes, the gap before it is listed as actively exploited is short. A catalog listing lags the first real attack, so the patch-ahead window a defender actually had was shorter still.
37.8%2,148 of 5,682 known-exploited CVEs were listed as exploited within 7 days of CVE publication (median gap 80 days; 33.6% on or before the day the record published)Data coverage · 1997-07-01 to 2026-11-05
Window: 1997-07-01 to 2026-11-05
Coverage: Showing 1 of 1 series, representing 100.0% of the complete eligible population stated by this finding.
Download complete numbers (JSON)Across 5682 known-exploited CVEs with both dates, the median gap from CVE publication to the first exploited-catalog listing is 80 days. 2148 (37.8%) were listed within 7 days of publication, and 1908 (33.6%) on or before the day the CVE record itself published. A catalog listing lags first in-the-wild use, so the real warning time was shorter.
Which source lists a CVE first
Across these vulnerability sources, one usually lists a CVE before the others; the lead time is how much warning that source buys you.
CVE published before CISA KEV listing (NVD publication)CVE published before VulnCheck KEV listing (NVD publication)VulnCheck KEV leads CISA KEVENISA and CISA KEV: same dayData coverage · source-pair event dates stated on each complete series; aggregate generated 2026-11-06
Window: source-pair event dates stated on each complete series; aggregate generated 2026-11-06
Coverage: Showing 4 of 4 qualifying series, representing 100.0% of all pairwise observations in source pairs that cleared the sample floor.
Download complete numbers (JSON)The median EPSS score on file just before CISA added these CVEs to KEV was 1%. Counted only where a snapshot exists within the seven days before the listing; beyond the 90-day daily retention that is a weekly snapshot, so the score can be up to seven days older than the listing.
Attacker techniques
A handful of ATT&CK techniques account for most exploited CVEs, so detections aimed at them cover the most ground.
Data coverage · point-in-time aggregate over the stored corpus as of 2026-11-06 · Showing 5 of 46 series, representing 63.3% of all stored distinct CVE-to-exploitation-technique mappings.
Window: point-in-time aggregate over the stored corpus as of 2026-11-06
Coverage: Showing 5 of 46 series, representing 63.3% of all stored distinct CVE-to-exploitation-technique mappings.
Download complete numbers (JSON)Among exploited CVEs with a technique mapping, the most common exploitation techniques are: T1190 (Exploit Public-Facing Application) on 154 CVEs, T1068 (Exploitation for Privilege Escalation) on 40 CVEs, T1078 (Valid Accounts) on 34 CVEs.
Where exploitation concentrates
Known exploitation is not spread evenly. The shares below state how much of it sits with a few vendors, and, where the data clears the sample floor, on internet-facing edge products and in known ransomware use.
Data coverage · point-in-time aggregate over the stored corpus as of 2026-11-06 · Showing 5 of 2007 series, representing 22.7% of known-exploited CVEs with a source-published vendor.
Window: point-in-time aggregate over the stored corpus as of 2026-11-06
Coverage: Showing 5 of 2007 series, representing 22.7% of known-exploited CVEs with a source-published vendor.
Download complete numbers (JSON)The top 5 vendors account for 1279 of 5642 known-exploited CVEs with a source-published vendor (22.7%), led by Microsoft (701), Apple (155), Adobe (151). Vendor spellings are folded to one canonical name, so a vendor split across spellings is counted once; rows with no source-published vendor are excluded from the denominator.
203 of 5644 known-exploited CVEs (3.6%) affect a product on the tracker's curated internet-facing crosswalk (firewalls, virtual private network gateways, and edge routers, the same list that gates the exposure axis). The crosswalk is deliberately small and conservative, so an unmatched CVE usually means the product is not curated, not that it is safe.
CISA flags 361 of 1768 CISA KEV entries with an ingested ransomware judgment (20.4%) as known ransomware campaign use. This is CISA's own published flag; 'Unknown' means CISA has not confirmed use, not that none exists.
Score thresholds: coverage and workload
For the exploited CVEs the tracker holds pre-listing Exploit Prediction Scoring System (EPSS) history on, each row states how many an act-at-threshold policy would have flagged before the listing, and what share of the scored CVEs that policy marks for action at the latest stored scores.
Read: a higher first bar is better, and a lower second bar is less work.
EPSS at or above 0.01EPSS at or above 0.05EPSS at or above 0.1EPSS at or above 0.2EPSS at or above 0.5CVSS 7.0 or higher (comparison)Data coverage · pre-listing sample 2024-11-12 to 2026-11-04; effort population at latest stored snapshot 2026-11-06. Stored EPSS history begins 2024-11-11; daily points retain 90 days and thin to weekly through 730 days.
Window: pre-listing sample 2024-11-12 to 2026-11-04; effort population at latest stored snapshot 2026-11-06. Stored EPSS history begins 2024-11-11; daily points retain 90 days and thin to weekly through 730 days.
Coverage: Showing 6 of 6 series, representing 100.0% of all configured threshold series; every row states its own CVE denominator.
Download complete numbers (JSON)Across 372 CISA KEV CVEs with an EPSS score on file within the seven days before their listing date, acting at EPSS 0.1 or above would have flagged 30.1% before the listing while marking 8.9% of the 105787 snapshot-scored CVEs for action at the latest stored scores (2026-11-06). The pre-listing score is the last stored snapshot within the seven days before the listing day; beyond the daily retention window that is a weekly snapshot. The CVSS comparison row is measured over the 104873 CVEs with a stored CVSS score, at their current scores (a different denominator, stated on the row). EPSS model versions changed inside this window (v4 on 2025-03-17), shifting scores on the epoch day(s).
Products past end of life
Some known-exploited CVEs affect products with versions already past end of life, where no patch is coming for those versions.
399Known-exploited CVEs linked to lifecycle-mapped products with past-end-of-life versions. This is a product-level signal, not proof that each CVE's affected version is past end of life. Mapping coverage is partial: 399 CVEs, 6.9% of known-exploited CVEs, map to the crosswalkData coverage · point-in-time aggregate over the stored corpus as of 2026-11-06
Window: point-in-time aggregate over the stored corpus as of 2026-11-06
Coverage: Showing 1 of 1 series, representing 100.0% of the complete eligible population stated by this finding.
Download complete numbers (JSON)What the data cannot show
Most tracked CVEs carry no direct ATT&CK technique mapping, so the technique picture above is a floor, not the whole of what attackers do.
0.2%419 of 170,236 tracked CVEs carry a direct MITRE Engenuity CTID technique mappingData coverage · point-in-time aggregate over the stored corpus as of 2026-11-06
Window: point-in-time aggregate over the stored corpus as of 2026-11-06
Coverage: Showing 1 of 1 series, representing 100.0% of the complete eligible population stated by this finding.
Download complete numbers (JSON)419 of 170236 tracked CVEs (0.2%) carry a MITRE Engenuity CTID technique mapping; the rest reach ATT&CK context only through an associated actor, if any.