Nimstead Pulse
Released. Exploited.
Nimstead Pulse shows how many CVEs are published each month, which appear on CISA’s known-exploited list, and how long after disclosure they are listed.
LiveUpdated dailyOpen source · MITNo sign-up
Choose your question
The whole CVE feed, tied to what gets exploited.
NVD and CISA's KEV list are usually read separately. Pulse joins every KEV listing back to the CVE's publication date, so you can see the time between disclosure and inclusion in KEV. A listing date is not the date exploitation began.
400,944CVEs tracked on 6 Nov 2026, rejected ones excluded
1,769confirmed exploited, from CISA's KEV list
232median days from publication to KEV listing, across every listing
- Overview
- CVEs published per month against new KEV listings, with the year-on-year change in plain words.
- Exploitation
- Every KEV listing, how many days it came after publication, and which ones are linked to ransomware.
- Severity and EPSS
- How CVSS severity compares with what actually gets exploited, plus a watchlist of high-EPSS CVEs not yet in KEV.
- Vendors and weaknesses
- Which vendors and CWE types produce the most CVEs, and the most exploited ones.
- This week
- What CISA newly listed, what's due, and the fresh Critical and High CVEs with the highest EPSS.
- Your CVEs
- Paste a scanner export or a list of IDs and get it ranked by exploitation evidence.
Any CVE ID also opens its own record: dates, CVSS, EPSS, weakness and KEV status. Every figure copies as a PNG for slides or downloads as CSV.
The sources
Public sources. Their limits on the page.
Pulse rebuilds every day at 14:30 UTC, after the EPSS and NVD updates. Every number cites its source and the time of the feed it came from.
- NVD
- Every CVE: published date, status, CVSS, CWE, vendor and product
- CISA KEV
- Exploited in the wild: date added, due date, ransomware use
- FIRST EPSS
- The probability of exploitation activity in the next 30 days
What to keep in mind
- NVD has a backlog. Many recent CVEs have no score or product data yet, and Pulse shows how many.
- KEV is one list of exploited CVEs. It doesn't claim to be complete.
- EPSS is a probability. A high score is a reason to look, and a low one isn't a guarantee.
- Counts use the NVD publication month. The current month is partial and is shaded in charts.
Private by design
Your list stays in your browser.
A list of the CVEs that affect you says a lot about your estate. Pulse never sees it.
- Same requests for everyone. Checking a list downloads the full CVE index, the same files for every visitor, so the requests reveal nothing about what's on it.
- Nothing saved. The list lives in the page's memory. It never goes into storage, the URL or the browser history.
- Locked down. The page's security policy only allows requests to Pulse itself. There are no analytics or third-party scripts, and the fonts come from Pulse too.
The details, and the rule that keeps it this way, are in the README.
Pulsea Nimstead product
Open Pulse.
No account and no install. The code is MIT-licensed; the Nimstead name and marks are not.
Pulse was partly Alex Early's idea.