CVE-to-rule latency
How long it takes a rule to land after a CVE goes public. Generated by scripts/cve_latency.py from CHANGELOG.cves.md and docs/data/cve-published.json, and regenerated on every tag — do not edit by hand.
AgentAuditKit publishes no fixed CVE-response SLA; the 48-hour commitment was retired in PR #432. This is a measurement of what happened, not a promise about what will.
Summary
Response to newly disclosed CVEs — the 108 rows shipped within 30 days of publication:
| Metric | Days |
|---|---|
| Median | 1.0 |
| p90 (nearest-rank) | 7 |
| Fastest | 0 |
| Slowest | 12 |
These figures describe disclosures that reached a disposition, and as of 2026-09-25 none are open and undispositioned — so nothing is waiting outside them.
Separately, 5 deferred roadmap rows were picked up later, between 122 and 425 days after publication (median 141). They are listed in full below. They are not response times and are deliberately kept out of the figures above — mixing them would describe neither population.
Separately, 2 CVEs were already covered when NVD published them, by between 29 and 36 days: CVE-2026-53708, CVE-2026-55071. A rule written from a vendor advisory, or one general enough that the shape was already in the registry, is in place before NVD enrichment lands. There is no turnaround to measure, so these are kept out of the figures above rather than reported as a negative fastest response.
All populations together: 115 CVEs with a known publication date and shipping release.
Coverage of this measurement
| Population | Count |
|---|---|
| Measured (published date + shipping release known) | 115 |
| Shipped, but no published date on file | 4 |
| Adjudicated out of scope (no rule, so no latency) | 56 |
| Disclosed, open and not yet dispositioned | 0 (as of 2026-09-25) |
Excluded for want of a published date, so the figures above describe the measured set only: CVE-2026-55156, CVE-2026-55157, CVE-2026-77244, CVE-2026-77248. Run python scripts/cve_latency.py --refresh to fetch them.
Method
- Published is NVD's
publishedtimestamp, cached indocs/data/cve-published.json. - Shipped is the date of the
CHANGELOG.cves.mdsection carrying the CVE. A section marked(unreleased)is attributed to the next tagged release above it. - Days is calendar days,
shipped - published. A negative value means coverage landed before NVD published, which happens when a rule is written from a vendor advisory ahead of NVD enrichment, or when the shape was already covered generically. Those rows are a separate population and are excluded from the response figures: there is no turnaround to measure when the rule predates the disclosure. - A CVE appearing in several sections is counted from the earliest one that carried coverage.
- Disclosed, open and not yet dispositioned counts open
cve-responseissues on the tracker, minus any labelledcve-deferred— a deferral is a disposition with a date of its own, judged bycheck_cve_deferrals.py. These CVEs have no shipped date yet, so they are in none of the rows above. That is the point of printing them: without this row a disclosure left sitting appears nowhere on the page, and the median can only improve by waiting.python scripts/cve_latency.py --check-queuefails when this row disagrees with the tracker; it runs on the daily CVE cron and blocks no release. - p90 uses the nearest-rank method, so every reported figure is a latency that actually occurred.
Backlog rows
5 rows took more than 30 days — deferred roadmap items picked up later, not slow responses to a fresh disclosure. The population mixes watcher-driven triage with backlog catch-up, and the two answer different questions. Read the median and p90 as the response figure; read these as the backlog:
| CVE | Published | Rule shipped | Days |
|---|---|---|---|
| CVE-2025-6101 | 2025-06-16 | 2026-08-15 | 425 |
| CVE-2025-51482 | 2025-07-22 | 2026-08-15 | 389 |
| CVE-2026-4965 | 2026-03-27 | 2026-08-15 | 141 |
| CVE-2026-4964 | 2026-03-27 | 2026-08-15 | 141 |
| CVE-2026-30624 | 2026-04-15 | 2026-08-15 | 122 |
Rows
| CVE | Published | Rule shipped | Release | Days |
|---|---|---|---|---|
| CVE-2026-77254 | 2026-09-22 | 2026-09-25 | v0.6.8 | 3 |
| CVE-2026-77243 | 2026-09-22 | 2026-09-25 | v0.6.8 | 3 |
| CVE-2026-91988 | 2026-09-15 | 2026-09-24 | v0.6.8 | 9 |
| CVE-2026-63127 | 2026-09-16 | 2026-09-24 | v0.6.8 | 8 |
| CVE-2026-58483 | 2026-09-15 | 2026-09-24 | v0.6.8 | 9 |
| CVE-2026-58197 | 2026-09-18 | 2026-09-24 | v0.6.8 | 6 |
| CVE-2026-57134 | 2026-09-15 | 2026-09-24 | v0.6.8 | 9 |
| CVE-2026-54618 | 2026-09-17 | 2026-09-24 | v0.6.8 | 7 |
| CVE-2026-54504 | 2026-09-17 | 2026-09-24 | v0.6.8 | 7 |
| CVE-2026-54446 | 2026-09-17 | 2026-09-24 | v0.6.8 | 7 |
| CVE-2026-53957 | 2026-09-15 | 2026-09-24 | v0.6.8 | 9 |
| CVE-2026-50158 | 2026-09-17 | 2026-09-24 | v0.6.8 | 7 |
| CVE-2026-91932 | 2026-09-15 | 2026-09-19 | v0.6.7 | 4 |
| CVE-2026-91931 | 2026-09-15 | 2026-09-19 | v0.6.7 | 4 |
| CVE-2026-61568 | 2026-09-15 | 2026-09-19 | v0.6.7 | 4 |
| CVE-2026-61560 | 2026-09-15 | 2026-09-19 | v0.6.7 | 4 |
| CVE-2026-61559 | 2026-09-15 | 2026-09-19 | v0.6.7 | 4 |
| CVE-2026-59973 | 2026-09-15 | 2026-09-19 | v0.6.7 | 4 |
| CVE-2026-59971 | 2026-09-15 | 2026-09-19 | v0.6.7 | 4 |
| CVE-2026-57139 | 2026-09-15 | 2026-09-19 | v0.6.7 | 4 |
| CVE-2026-54549 | 2026-09-15 | 2026-09-19 | v0.6.7 | 4 |
| CVE-2026-53710 | 2026-09-15 | 2026-09-19 | v0.6.7 | 4 |
| CVE-2026-73497 | 2026-09-14 | 2026-09-16 | v0.6.6 | 2 |
| CVE-2026-73496 | 2026-09-14 | 2026-09-16 | v0.6.6 | 2 |
| CVE-2026-57124 | 2026-09-14 | 2026-09-16 | v0.6.6 | 2 |
| CVE-2026-55837 | 2026-09-14 | 2026-09-16 | v0.6.6 | 2 |
| CVE-2026-55253 | 2026-09-14 | 2026-09-16 | v0.6.6 | 2 |
| CVE-2026-55235 | 2026-09-14 | 2026-09-16 | v0.6.6 | 2 |
| CVE-2026-90898 | 2026-09-14 | 2026-09-14 | v0.6.5 | 0 |
| CVE-2026-90617 | 2026-09-14 | 2026-09-14 | v0.6.5 | 0 |
| CVE-2026-38924 | 2026-09-14 | 2026-09-14 | v0.6.5 | 0 |
| CVE-2026-88938 | 2026-09-10 | 2026-09-12 | v0.4.0 | 2 |
| CVE-2026-87913 | 2026-09-10 | 2026-09-12 | v0.4.0 | 2 |
| CVE-2026-87911 | 2026-09-09 | 2026-09-12 | v0.4.0 | 3 |
| CVE-2026-85025 | 2026-09-10 | 2026-09-12 | v0.4.0 | 2 |
| CVE-2026-81941 | 2026-09-10 | 2026-09-12 | v0.4.0 | 2 |
| CVE-2026-78575 | 2026-09-10 | 2026-09-12 | v0.4.0 | 2 |
| CVE-2026-78573 | 2026-09-10 | 2026-09-12 | v0.4.0 | 2 |
| CVE-2026-53937 | 2026-09-09 | 2026-09-09 | v0.3.99 | 0 |
| CVE-2026-9186 | 2026-09-04 | 2026-09-08 | v0.3.96 | 4 |
| CVE-2026-86439 | 2026-09-07 | 2026-09-08 | v0.3.96 | 1 |
| CVE-2026-85787 | 2026-09-04 | 2026-09-08 | v0.3.96 | 4 |
| CVE-2026-85620 | 2026-09-04 | 2026-09-08 | v0.3.96 | 4 |
| CVE-2026-81096 | 2026-08-27 | 2026-09-08 | v0.3.96 | 12 |
| CVE-2026-77822 | 2026-09-04 | 2026-09-08 | v0.3.96 | 4 |
| CVE-2026-18905 | 2026-09-04 | 2026-09-08 | v0.3.96 | 4 |
| CVE-2026-18489 | 2026-09-04 | 2026-09-08 | v0.3.96 | 4 |
| CVE-2026-18486 | 2026-09-04 | 2026-09-08 | v0.3.96 | 4 |
| CVE-2026-85166 | 2026-09-03 | 2026-09-04 | v0.3.94 | 1 |
| CVE-2026-81845 | 2026-08-28 | 2026-09-04 | v0.3.94 | 7 |
| CVE-2026-79743 | 2026-08-31 | 2026-09-04 | v0.3.94 | 4 |
| CVE-2026-84289 | 2026-09-01 | 2026-09-02 | v0.3.92 | 1 |
| CVE-2026-80347 | 2026-08-26 | 2026-09-02 | v0.3.92 | 7 |
| CVE-2026-19591 | 2026-09-01 | 2026-09-02 | v0.3.92 | 1 |
| CVE-2026-82456 | 2026-08-29 | 2026-08-31 | v0.3.91 | 2 |
| CVE-2026-55640 | 2026-08-25 | 2026-08-26 | v0.3.90 | 1 |
| CVE-2026-55637 | 2026-08-25 | 2026-08-26 | v0.3.90 | 1 |
| CVE-2026-55609 | 2026-08-25 | 2026-08-26 | v0.3.90 | 1 |
| CVE-2026-55557 | 2026-08-25 | 2026-08-26 | v0.3.90 | 1 |
| CVE-2026-55546 | 2026-08-25 | 2026-08-26 | v0.3.90 | 1 |
| CVE-2026-55532 | 2026-08-25 | 2026-08-26 | v0.3.90 | 1 |
| CVE-2026-78430 | 2026-08-24 | 2026-08-25 | v0.3.89 | 1 |
| CVE-2026-62674 | 2026-08-21 | 2026-08-22 | v0.3.87 | 1 |
| CVE-2026-53509 | 2026-08-21 | 2026-08-22 | v0.3.87 | 1 |
| CVE-2026-77073 | 2026-08-20 | 2026-08-21 | v0.3.85 | 1 |
| CVE-2026-77068 | 2026-08-20 | 2026-08-21 | v0.3.85 | 1 |
| CVE-2026-75149 | 2026-08-19 | 2026-08-21 | v0.3.85 | 2 |
| CVE-2026-54449 | 2026-08-20 | 2026-08-21 | v0.3.85 | 1 |
| CVE-2026-18482 | 2026-08-20 | 2026-08-21 | v0.3.85 | 1 |
| CVE-2026-75858 | 2026-08-18 | 2026-08-19 | v0.3.84 | 1 |
| CVE-2026-75857 | 2026-08-18 | 2026-08-19 | v0.3.84 | 1 |
| CVE-2026-50143 | 2026-08-18 | 2026-08-19 | v0.3.84 | 1 |
| CVE-2026-19984 | 2026-08-17 | 2026-08-17 | v0.3.81 | 0 |
| CVE-2026-55071 | 2026-09-21 | 2026-08-16 | v0.3.80 | -36 |
| CVE-2026-53708 | 2026-09-14 | 2026-08-16 | v0.3.80 | -29 |
| CVE-2026-73846 | 2026-08-14 | 2026-08-15 | v0.3.77 | 1 |
| CVE-2026-73845 | 2026-08-14 | 2026-08-15 | v0.3.77 | 1 |
| CVE-2026-73844 | 2026-08-14 | 2026-08-15 | v0.3.77 | 1 |
| CVE-2026-50027 | 2026-08-14 | 2026-08-15 | v0.3.77 | 1 |
| CVE-2026-49986 | 2026-08-14 | 2026-08-15 | v0.3.77 | 1 |
| CVE-2026-4965 | 2026-03-27 | 2026-08-15 | v0.3.79 | 141 |
| CVE-2026-4964 | 2026-03-27 | 2026-08-15 | v0.3.79 | 141 |
| CVE-2026-30624 | 2026-04-15 | 2026-08-15 | v0.3.77 | 122 |
| CVE-2025-6101 | 2025-06-16 | 2026-08-15 | v0.3.79 | 425 |
| CVE-2025-51482 | 2025-07-22 | 2026-08-15 | v0.3.79 | 389 |
| CVE-2026-73601 | 2026-08-13 | 2026-08-14 | v0.3.76 | 1 |
| CVE-2026-73498 | 2026-08-12 | 2026-08-14 | v0.3.76 | 2 |
| CVE-2026-73296 | 2026-08-12 | 2026-08-14 | v0.3.76 | 2 |
| CVE-2026-49857 | 2026-08-13 | 2026-08-14 | v0.3.76 | 1 |
| CVE-2026-49856 | 2026-08-13 | 2026-08-14 | v0.3.76 | 1 |
| CVE-2026-73222 | 2026-08-11 | 2026-08-12 | v0.3.74 | 1 |
| CVE-2026-72768 | 2026-08-11 | 2026-08-12 | v0.3.74 | 1 |
| CVE-2026-19516 | 2026-08-11 | 2026-08-11 | v0.3.73 | 0 |
| CVE-2026-19337 | 2026-08-09 | 2026-08-09 | v0.3.71 | 0 |
| CVE-2026-71433 | 2026-08-06 | 2026-08-08 | v0.3.71 | 2 |
| CVE-2026-48039 | 2026-08-07 | 2026-08-08 | v0.3.71 | 1 |
| CVE-2026-9077 | 2026-08-05 | 2026-08-06 | v0.3.71 | 1 |
| CVE-2026-8446 | 2026-08-05 | 2026-08-06 | v0.3.71 | 1 |
| CVE-2026-7646 | 2026-08-05 | 2026-08-06 | v0.3.71 | 1 |
| CVE-2026-67531 | 2026-08-06 | 2026-08-06 | v0.3.71 | 0 |
| CVE-2026-48168 | 2026-08-05 | 2026-08-06 | v0.3.71 | 1 |
| CVE-2026-18954 | 2026-08-05 | 2026-08-06 | v0.3.71 | 1 |
| CVE-2026-17626 | 2026-08-05 | 2026-08-06 | v0.3.71 | 1 |
| CVE-2026-17623 | 2026-08-05 | 2026-08-06 | v0.3.71 | 1 |
| CVE-2026-69263 | 2026-08-04 | 2026-08-05 | v0.3.71 | 1 |
| CVE-2026-69257 | 2026-08-04 | 2026-08-05 | v0.3.71 | 1 |
| CVE-2026-48121 | 2026-08-04 | 2026-08-05 | v0.3.71 | 1 |
| CVE-2026-18655 | 2026-08-03 | 2026-08-04 | v0.3.71 | 1 |
| CVE-2026-67336 | 2026-08-01 | 2026-08-02 | v0.3.66 | 1 |
| CVE-2026-67333 | 2026-08-01 | 2026-08-02 | v0.3.66 | 1 |
| CVE-2026-54785 | 2026-07-31 | 2026-08-01 | v0.3.65 | 1 |
| CVE-2026-12940 | 2026-07-30 | 2026-07-31 | v0.3.64 | 1 |
| CVE-2026-67425 | 2026-07-29 | 2026-07-30 | v0.3.63 | 1 |
| CVE-2026-63732 | 2026-07-23 | 2026-07-27 | v0.3.60 | 4 |
| CVE-2026-16584 | 2026-07-23 | 2026-07-27 | v0.3.60 | 4 |