A free, openly-licensed dataset of 208 vulnerabilities from our verified corpus — each row joins the NVD record, CISA KEV status and deadlines, FIRST EPSS score, and the deterministic NVD-to-KEV lag into one timeline. It is the raw material behind our exploitation-timing and vendor studies, published so anyone can reproduce or extend them.
License & citation
defend.network’s original contributions — the selection, verification, exploitation classification and derived fields (days_nvd_to_kev, first_briefed) — are licensed CC BY 4.0. Upstream data keeps its own terms: NVD and CISA KEV are US-Government public domain; FIRST EPSS (epss_score, epss_percentile) is included with attribution per FIRST’s terms and is not sublicensed.
defend.network (2026). Exploited Vulnerability Timeline Dataset. https://defend.network/research/dataset.html. CC BY 4.0.
Fields
| Field | Source | Description |
|---|---|---|
| cve | identifier | CVE identifier. |
| nvd_published | NVD | Date the CVE was published to the U.S. National Vulnerability Database. |
| nvd_last_modified | NVD | Date the NVD record was last modified. |
| cvss_version | NVD | CVSS version of the base score. |
| cvss_score | NVD | CVSS base score (0–10). |
| cvss_severity | NVD | CVSS qualitative severity (LOW/MEDIUM/HIGH/CRITICAL). |
| cvss_vector | NVD | Full CVSS vector string. |
| cwe | NVD | CWE weakness identifier(s); pipe-separated in CSV. Sparse until NVD analysis completes. |
| epss_score | FIRST EPSS | EPSS probability (0–1) of exploitation in the next 30 days. |
| epss_percentile | FIRST EPSS | EPSS percentile rank (0–1). |
| vendor | NVD CPE | Vendor from the NVD CPE match (authoritative, not an editorial label). |
| product | NVD CPE | Product from the NVD CPE match. |
| in_kev | CISA KEV | Whether the CVE is in the CISA Known Exploited Vulnerabilities catalog. |
| kev_date_added | CISA KEV | Date CISA added the CVE to the KEV catalog. |
| kev_due_date | CISA KEV | BOD 22-01 federal remediation due date. |
| kev_ransomware | CISA KEV | CISA flag: known to be used in ransomware campaigns. |
| days_nvd_to_kev | derived | kev_date_added minus nvd_published, in days (null if not applicable). Negative = KEV-listed before NVD publication. |
| first_briefed | defend.network | Date this CVE first appeared in a defend.network daily briefing (null if never). |
Provenance & scope
Every field is taken directly from an authoritative source — NVD (severity, CWE, dates, CPE product), CISA KEV (exploitation status, deadlines, ransomware flag) and FIRST EPSS (probability) — or deterministically derived from them (the lag). No value is AI-generated; the editorial classification layer is excluded by design.
Scope: the 208 CVEs in our verified corpus (117 of them in CISA KEV), not the full 1694-entry KEV catalog. Snapshot as of 2026-09-04; regenerated as the corpus grows.