Trends
How the numbers move over months and years: first the whole web from NVD, CISA and Have I Been Pwned, then the AI records. Every number and bar opens its list.
CVEs, exploitation and breaches
CVEs published per year
Every CVE NVD published, by year since 1999; the open year is hatched. A column opens that year's search on NVD.
NVD · fetched 2026-11-13 16:43Z · public domain · this product uses data from the NVD API but is not endorsed or certified by the NVD
CVEs in AI software, per quarter
Records here that name a CVE in an AI framework, model server, agent tool or AI product, by quarter of first report since 2016, exploited or not. A column opens the records.
gcdradar.vercel.app dataset · CC BY-SA 4.0 · CVE records from NVD and the GitHub Advisory Database
Exploited in the wild, per month
Additions to CISA's Known Exploited Vulnerabilities catalog by month, the part known to be used by ransomware in red. A column opens the month's additions.
CISA KEV · fetched 2026-11-13 21:19Z · CC0
Accounts exposed in breaches, per month
Accounts in verified breaches Have I Been Pwned added each month; spam lists, stealer logs and malware dumps are left out. A column opens the month's breaches.
Have I Been Pwned · fetched 2026-11-13 06:24Z · CC BY 4.0
Days from publication to exploitation
For the CVEs CISA listed as exploited within a year of their publication, the days between NVD publication and KEV listing: the median per year of listing, with the share listed within a week in the tooltip. Older backlog listings are left out. Falling columns mean exploitation follows disclosure faster. Of the 116 CVEs CISA listed in the last 90 days, 24 were listed the day they were published and 58 within a week.
CISA KEV joined to NVD publish dates · fetched 2026-11-13 21:19Z · CC0 and public domain
Most likely to be exploited
The ten CVEs published in the last two weeks with the highest EPSS score, the probability of exploitation in the next 30 days. A code opens NVD; a description opens our record when we have one.
- CVE-2026-75869Zohocorp ManageEngine DDI Central versions below 6301 is affected by an authorization bypass and PowerShell command injection vulnerability that allowed…8.8
- CVE-2026-123158CVE-2026-1231588.1
- CVE-2026-77690CVE-2026-776908.8
- CVE-2026-116606An authentication bypass in Barracuda Email Security Gateway versions earlier than 9.4.0.030 allows an unauthenticated remote attacker to invoke a…9.3
- CVE-2026-12507Zohocorp ManageEngine AssetExplorer versions below 7860, ServiceDesk Plus versions below 15290, ServiceDesk Plus MSP versions below 15150, and SupportCenter…9.1
- CVE-2026-111560CVE-2026-1115608.6
- CVE-2026-120490On Scalable Platforms, an administrator with permissions to edit and install the Access Control Policy and NAT rules can create a NAT rule that redirects…3.8
- CVE-2026-121943CVE-2026-1219436.3
- CVE-2026-124002XWEB EVO versions 5.2.3 through before 5.7.0 contains a pre-authentication OS command injection vulnerability that allows unauthenticated remote attackers to…9.3
- CVE-2026-119742CVE-2026-1197428.6
EPSS scores by FIRST (first.org/epss) · fetched 2026-11-14 07:20Z · attribution requested
Attack typesincidents in the last 7 days
our records- Exploited vulnerabilities404
- Data breaches & leaks225
- Attacks on AI models & agents2121
- Malware & botnets115
- Espionage & state actors71
- Phishing, fraud & deepfakes74
- Ransomware & extortion60
- Supply chain44
- Other65
AI counts the incidents where AI was the target or the weapon. Disclosed CVEs without exploitation are left out.
Attack surfaceexploited, by technology, 90 days
CISA KEV- Enterprise & web apps4714
- Network edge & VPN3410
- Operating systems173
- Remote access & IT tools61
- AI stack30
- Browsers31
- OT & IoT11
- Other55
One square per CVE CISA listed as exploited; bright ones were listed in the last 30 days.
Trends in AI security
The AI records charted over time: attacks on AI systems and AI-enabled attacks, counted once each and linked to their reporting. Disclosed CVEs with no confirmed exploitation are tracked apart.
How AI shows upthis week's incidents, by the role AI played
our records · CISA KEV7 days, every lane
One dotted line per two incidents. Attacks on AI mostly hit open-weight models (17) and frameworks and tooling (16). Disclosed CVEs without exploitation are left out of the flow and counted as the weak link.
incidents in the last 24 months, +348% on the period before
real-world (severity 3–4) · disclosed CVEs, tracked apart
Incidents, month by month
By incident date, December 2024 to November 2026, a trend of +1.69 a month. The bracketed months are provisional.
Seven families of incident
Each family's share, month-by-month shape and change against the window before. Every count and month opens its incidents.
The families, largest first
Share of the window, the months on each family's own scale, the count and its change on the 24 months before.
- Deepfake/socialDeepfakes & social engineering171% up
- AI offenseAI-powered offense1233% up
- Supply chainSupply chain & poisoning239% up
- InjectionPrompt injection & jailbreaks362% up
- Agent hijackAgent hijackingnew
- ExposureData & model exposure413% up
- Infra vulnsInfrastructure vulnerabilities1900% up
- OtherOther175% up
Movers
Largest change first: where each family stood in the 24 months before, and where it stands now.
- Deepfake/social171% up
- AI offense1233% up
- Agent hijacknew
- Injection362% up
- Supply chain239% up
- Exposure413% up
- Infra vulns1900% up
- Other175% up
Shape, severity, targets
Which families dominate, how much harm each has done and who they hit. Every count and bar opens its incidents.
The shape of the threat
last 24 months 24 months before. Square-root scale, so the small families still show.
How bad, by family
Bar length is the count; the % did harm (severity 3–4). Disclosed: a flaw reported as news.
- Deepfake/social98% harmful
- AI offense65% harmful
- Supply chain26% harmful
- Injection15% harmful
- Agent hijack27% harmful
- Exposure37% harmful
- Infra vulns55% harmful
- Other36% harmful
Who is hit, by what
Incidents naming each target (one can name several), and the families that hit it most.
- IndividualsDeepfake/socialAI offense
- Enterprise deploymentAI offenseAgent hijack
- Framework / toolingInjectionSupply chain
- Open-weight modelSupply chainInjection
- OpenAIAgent hijackAI offense
- AnthropicAI offenseAgent hijack
- Not applicableAI offenseInjection
- GoogleAI offenseInjection
Also hitMicrosoftMetaAmazonxAIMistralApple
Products, agents and the standards
The AI products attacks named, the incidents involving AI agents, and the window in OWASP and MITRE ATLAS terms.
Is my stack hit?
every product →Attacks on AI systems that name the product, and its CVEs in the window.
Agentic AI watch
Agents or their tools turned on their users; one incident can sit in several rows.
- Incidents involving AI agents1500% up
- Steered by prompt injection700% up
- Poisoned tools, skills or packagesnew
- Data or credentials taken750% up
- Through an MCP server or SDKnew
- Agents run by attackersnew
- CVEs disclosed in agent tooling—
OWASP Top 10 for LLM Applications
The 2025 list in its own order; a code opens the entry on owasp.org.
- LLM01Prompt Injection515% up
- LLM02Sensitive Information Disclosure342% up
- LLM03Supply Chain933% up
- LLM04Data and Model Poisoning600% up
- LLM05Improper Output Handling0—
- LLM06Excessive Agency1500% up
- LLM07System Prompt Leakage0—
- LLM08Vector and Embedding Weaknesses0—
- LLM09Misinformation0—
- LLM10Unbounded Consumption350% up
of incidents map to an entry; deepfakes and AI-as-weapon attacks map to none.
MITRE ATLAS techniques
Release 2026.09, most incidents first; an id opens the technique on atlas.mitre.org.
- AML.T0073Impersonation144% up
- AML.T0088Generate Deepfakes144% up
- AML.T0053AI Agent Tool Invocation1500% up
- AML.T0051LLM Prompt Injection433% up
- AML.T0052Phishing271% up
- AML.T0010AI Supply Chain Compromise640% up
- AML.T0015Evade AI Model54% up
- AML.T0043Craft Adversarial Data54% up
- AML.T0054LLM Jailbreak1600% up
- AML.T0016.002Obtain Capabilities: Generative AI140% up
AlsoExternal Harms: AI Intellectual Property Theft
Vulnerabilities, tracked separately
CVEs for AI tools with no confirmed exploitation: attack surface, not attacks. None counts above until it is exploited.
Most disclosures, by product
moreThe incident flow, from attack to target, and AI bot traffic on the web
On AI or by AI, into a family, onto its targets
Every incident in the window from its type through its family onto the targets it names.
The flow
Ribbon width is the count. The right column counts target mentions, so an incident naming two targets is in both.
The bots on the wire
Not incidents: Cloudflare Radar's weekly reading of automated web traffic and the AI crawlers behind it, as background for the counts above.
Top AI crawlers · share of AI-bot traffic
- Googlebot25.9%
- ClaudeBot12.4%
- Applebot9.1%
- Meta-ExternalAgent7.8%
Why they crawl · declared purpose
- Mixed Purpose42%
- Training42%
- Search12%
- User Action3%
- Undeclared1%
Source: Cloudflare Radar, last 7 days to 2026-11-11 (CC BY-NC 4.0). Context only: not incidents, never added to the counts.