CVE Update Analysis Report

Analyzing update patterns and velocity across 404,208 CVE records

Key Statistics

Total CVEs 404,208
CVEs with Updates 397,613 98.37%
Never Updated 6,595 1.63%
Average Updates 2.90
Median Updates 2
Median Time to Update 804 days 2.2 years
Updated Within 30d 24.6% 95,113 CVEs
Max Updates 6094

Update Distribution

Update Distribution

Distribution Table

Updates Count Percentage

Most Frequently Updated CVEs

The following CVEs have received the most updates since their initial publication:

Rank CVE ID CNA Updates Last Updated Update History
Top Updated CVEs

CVE Update Velocity Analysis

Analyzing time elapsed between CVE publication and metadata update (cveMetadata.dateUpdated) to understand response patterns and maintenance practices.

Update Velocity Statistics

CVEs with Time Data 385,982
Median Time to Update 804 days 2.2 years
Mean Time to Update 1,676 days 4.6 years
90th Percentile 5,445 days 14.9 years
Updated Within 24h 14.5% 56,141 CVEs
Updated Within 7d 22.2% 85,542 CVEs
Updated Within 30d 24.6% 95,113 CVEs
Updated Within 1y 37.0% 142,751 CVEs

Time-to-Update Distribution

Time to Update Distribution

Distribution of time elapsed from CVE publication to metadata update, showing response patterns across different time windows.

Longest Time to Metadata Update

These CVEs experienced the longest delays between publication and their most recent metadata update timestamp, providing insights into extended maintenance cycles:

Rank CVE ID CNA Published First Updated Time to Update Update History
1 CVE-1999-0472 mitre 1999-09-29 2026-10-09 27 years, 10 days View
2 CVE-1999-0024 mitre 1999-09-29 2026-10-09 27 years, 10 days View
3 CVE-1999-0792 mitre 2000-02-04 2026-10-09 26 years, 248 days View
4 CVE-1999-0516 mitre 2000-02-04 2026-10-09 26 years, 248 days View
5 CVE-2000-0147 mitre 2000-02-16 2026-10-09 26 years, 236 days View
6 CVE-1999-0073 mitre 1999-09-29 2026-03-08 26 years, 160 days View
7 CVE-1999-0632 mitre 2000-02-04 2026-05-28 26 years, 114 days View
8 CVE-1999-0524 mitre 2000-02-04 2026-05-28 26 years, 114 days View
9 CVE-1999-0517 mitre 2000-02-04 2026-05-28 26 years, 114 days View
10 CVE-1999-0511 mitre 2000-02-04 2026-05-28 26 years, 114 days View

Supporting Visualizations

Cumulative Distribution

Cumulative Distribution

Cumulative distribution showing the fraction of CVEs at or below each update count.

Commits Over Time

Commits Over Time

Monthly commit activity with 12-month rolling average.

Update Distribution (Log Scale)

Update Distribution Log Scale

Update frequency distribution on a logarithmic scale for better visibility of outliers.

Analysis Methodology

  • Analysis compares each CVE JSON file's internal cveMetadata.dateUpdated value with the latest Git commit timestamp for that file.
  • Default mode (FAST) uses an aggregated git log across the cves/ tree for speed; use --indepth for authoritative per-file history (slower).
  • A mismatch is only flagged when the internal dateUpdated is later than the latest Git commit by more than the configured tolerance (default 3600 seconds), or when an internal date exists but no Git history is found for a file.
  • Update frequency is defined as updates = max(0, totalGitCommits - 1), so 0 means the CVE JSON was created and never changed afterwards.

Technical Details

CVEs Analyzed
404,208
Scan Mode
FAST
Elapsed Time
41.15s
Date Tolerance
3600s
Date Mismatches
0