Data source
pwn.watch
pwn.watch is an independent tracker of security incidents. It publishes no license, so we keep only the fields we count, such as severity, patch status, tags and CVE ids, and not its text. We use it for context around the Security signal.
Supporting context; these measurements do not directly affect the score.
Incident data from pwn.watch by @thekitze. We count records and publish our own analysis.
Visit the sourceBackground for: SecurityLicense: No license published
Incidents854
Still live174
Unpatched14
AI tooling31
What the data shows
Computed from every record, as of Nov 1, 2026.
- The archive is two datasets in one. Before October 2026, 87% of incidents come from the CISA list. In October 2026, 142 of 160 do not, so that month’s spike reflects wider coverage, not a surge in attacks.
- Coverage of the CISA list is complete for 2024 and 2025 but not for the other years: 78% of 2023 and 66% of 2026. Counting those incidents would wrongly suggest a fall in 2026.
- Severity labels shifted too: 49% of CISA-listed incidents from 2025 are marked critical, against 7% from 2026.
- 12 of the 31 incidents tagged AI started in October 2026. That is too recent, and too affected by the coverage change, to call a trend.
- 83% of incidents have a fix. 14 are unpatched and 72 are partly patched.
Coverage by year
| Year | Incidents | On the CISA list | CISA vulnerabilities covered |
|---|---|---|---|
| 2023 | 131 | 116 | 145 of 187 (78%) |
| 2024 | 165 | 149 | 186 of 186 (100%) |
| 2025 | 230 | 203 | 245 of 245 (100%) |
| 2026 | 328 | 151 | 185 of 282 (66%) |
Incidents by category
| Category | Incidents |
|---|---|
| Patch now | 697 |
| Breaches and attacks | 116 |
| Supply chain | 41 |
Limitations
- Its counts are not comparable over time because coverage changed, so they do not feed the headline number.
- Records are written and categorized by the site, and can change after publication.
- Patch dates are only present on a small share of records, so time to patch cannot be measured.