Share of freshly published CVEs for which decision-relevant information is still missing at that point. Population: CVEs first observed within 24 hours of publication (a value already present at first observation counts as present by that time; the upper-bound error is at most 24 hours). Shows which inputs are missing when a decision framework such as SSVC is run on Day 0.
Read this first. The sentences are assembled mechanically from the figures in the sections below, with no hand-written interpretation. They update with every run.
Per-source fetch status. observed = a value was retrieved, absent = the fetch succeeded but no value is attached yet, fetch failed = the fetch errored (value unknown). Keeping these three apart is the core of an observational study. Failure rate and status are monitored per source here.
Actual intervals of the 3-hourly observation runs. GitHub scheduled workflows have been throttled since late August 2026; the fix is dispatch from a Cloudflare Worker (design 8.1). Values from skipped hours cannot be recovered, so the gaps are made visible here.
Status of the once-a-day workflows. Healthy: last success within 36 h and no consecutive failures. Degraded: 1 to 2 consecutive failures or 36 to 72 h. Down: 3 or more failures or over 72 h. Indexes use the index date as the success date (+24 h grace).
Share of CVEs with each signal attached within N days of publication (CVEs observed from right after publication; Kaplan-Meier estimate, so CVEs too young to reach N days and CVEs whose follow-up ended at graduation are treated as censored). Shows how many SSVC inputs (Exploitation / Automatable / Technical Impact) are in place on Day 0 and where CVSS comes from. Daily external databases (Red Hat VEX, Debian, GHSA, EUVD) are observed once a day: arrival is bounded by the end of that day, and CVEs already listed when observation began do not count as arrivals (reach reads lower than actual presence; it converges within 90 days of observation start).
X axis: time since CVE publication. Y axis: share of CVEs with the signal attached by then (CVEs observed from right after publication). Click the legend to toggle lines. The earlier a line rises, the sooner that signal arrives. The line counts arrivals at the first observation that showed the value (lower side); the light band extends to the value counted at the previous observation (lower end of the arrival interval). The true curve lies inside the band. The band is wide for CVEs registered before 2026-11-02 (their lower end is the registration time).
The direct answer to the research question. For each waiting time: the share of CVEs that had the signal by then (Kaplan-Meier) and the gain over the previous column, the time at which 50 / 80 / 90% are reached, and the point after which waiting longer adds little. Arrival uses the time of the first observation that showed the value, so shares are lower bounds and times are upper bounds. Waits shorter than 6 hours are below the resolution of the observation cadence (3 h by design, 6 to 8 h measured) and are not shown. Population: CVEs whose observation started within 24 hours of publication.
For the same signal, the time to arrival depends on the hour (UTC) and weekday the CVE was published. EPSS is a once-a-day model update, so a CVE published just after that boundary waits almost a full day for the next one. CISA-ADP enrichment may follow working hours, but the mix of CNAs also differs by hour and weekday (scheduled bulk publications), so this is not causal on its own. The observation cadence (6 to 8 hours measured) blurs hour-level differences. Population: CVEs whose observation started within 24 hours of publication.
For CVEs that received both of two signals: which came first, and by how many hours. A guide to "which signal is worth waiting for": CISA-ADP CVSS and SSVC land together in the same vulnrichment update, EPSS trails CNA CVSS by about a day because the model runs daily. A difference of 0 means both were first seen in the same observation run (simultaneous within the observation resolution). Population: CVEs first observed within 24 hours of publication.
By CVE publication month: share enriched at 24 hours / 7 days / 30 days (Kaplan-Meier). Lets you read how enrichment speed moved around policy changes (the NIST risk-based triage shift, CISA BOD 26-04, and so on). Population: CVEs first observed within 24 hours of publication; months with at least 200 CVEs. Recent months have many CVEs that have not yet reached 30 days; they are treated as censored (the number still at risk is shown).
By assigning CNA: share of CVEs with CVSS or SSVC attached at 24 hours / 7 days after publication. Whether the CNA ships CVSS itself, CISA-ADP fills the gap, or nothing arrives differs sharply by CNA. Population: CVEs first observed within 24 hours of publication whose assigner is recorded (assigner recorded since October 2026). CISA-ADP CVSS mostly lands on CVEs without CNA CVSS, so read that column as "filled by ADP".
After the triage shift: how much CVSS comes from the CNA, CISA-ADP, and NVD. NVD is currently withheld because this system queried only a narrow subset (see the note).
For each CVE, how long after publication each signal arrived (hours/days). Old CVEs marked "published before start" (2022 to 2025 and so on) appear because their records were recently updated and entered the change feed; they were published long ago and are excluded from the timing statistics.
Where each signal on this page comes from, how often it is fetched, and what its arrival time is measured by. The full catalog is section 4.11 of the design document.
| Signal | Source and cadence | Basis of the arrival time | Population |
|---|---|---|---|
| CVSS (CNA) | hourly cvelistV5 delta (runs every 3 h) | time of the first observation that showed it (upper bound); present at publication for most, so only presence is shown | all CVEs |
| CVSS (CISA-ADP), the 3 SSVC points | same (ADP container) | first observation that showed it (upper bound) and the previous observation (lower end) | all CVEs |
| CVSS (NVD), NVD analysis status | NVD cvehistory deltas (every 3 h) and the daily vulnStatus snapshot | NVD eventDate (claimed) | all CVEs (reach withheld, see the notes) |
| CPE | cvelistV5 (CNA and ADP) | first observation that showed it; presence only | all CVEs |
| EPSS | FIRST daily CSV (date-gated per run) | first observation that showed it (upper bound); one model update per day | all CVEs |
| KEV listing | CISA KEV catalog (every 3 h) and the kev-data git history | dateAdded (claimed) and first time seen | all CVEs |
| Red Hat VEX listing | VEX index changes.csv (daily) | end of the day the listing was observed (upper bound) | CVEs published from the ledger start (2026-11-02) |
| Debian tracker listing | security tracker JSON (daily) | same | published from 2026-11-02 |
| GitHub advisory (GHSA) | Advisory Database REST (daily, publication-date window) | GitHub published_at (claimed; 0 h if before CVE publication) | CVEs with a reviewed advisory (about 5% of all) |
| ENISA EUVD listing | CVE mapping dump (daily) | end of the day the listing was observed (upper bound) | published from 2026-10-19 |
| PSIRT (Red Hat), PoC (PoC-in-GitHub) | per-CVE queries with a budget | first observation that showed it | queried subset only; reach withheld (see the notes) |
| Detection signatures (TTODS: Greenbone, Notus, ET Open, nuclei, Metasploit, PoC-in-GitHub) | daily index fetch or git-history reconstruction (daily) | first day seen in the index, or the first-add commit time | all CVEs; derived tables distributed separately, not on this page |