EPSS had scores for 329,934 CVEs as of May 1, 2026.

The CISA KEV catalog contained 1,587 entries as of May 1, 2026.

High-risk vulnerabilities (flaws that are both severe and highly exploitable) increased 36% year-over-year.

63% of mid-sized AppSec teams (11–50 members) that use SCA cite the inability to verify if vulnerabilities are exploitable in production as their biggest pain point.

60% of ASPM platform users say issues are still ranked by theoretical severity instead of real exposure or exploitability.

73% of SCA users lack visibility into whether flagged vulnerabilities are exploitable in production.

58% of large AppSec teams (50 members or more) that use SCA cite the inability to verify if vulnerabilities are exploitable in production as a major pain point.

38% of small AppSec teams (1–10 members) that use SCA cite the inability to verify if vulnerabilities are exploitable in production as their biggest pain point.

97% of API vulnerabilities can be exploited with a single request.

98% of API vulnerabilities are easy or trivial to exploit.