# $ZERODAY · Software holes under attack

Software flaws the US Cybersecurity and Infrastructure Security Agency added in a month to its catalog of flaws attackers are known to be using. Counted from December 2021, the first full month after the catalog's first load.

| Field | Value |
| --- | --- |
| Newest complete period | Oct 2026: 36 flaws, score 27, Normal |
| Source | CISA, Known Exploited Vulnerabilities catalog (https://www.cisa.gov/known-exploited-vulnerabilities-catalog) |
| Terms | US government work, public domain. |
| Cadence | Monthly. CISA adds entries any day; a month prints once it has ended. |
| Grade | reference |
| Rulebook | Rulebook v0.2, 2026-10-04 |

## Settlement

Why this grade: A federal agency's own catalog, read in full. A venue can count it directly. CISA has removed an entry when its CVE was withdrawn, which lowers a month already printed; the record keeps the revision.
What it costs to move: Not practical. An entry is added by CISA after it confirms attacks.
When the source is late: A month stays open until it ends and the catalog is read. A month with no entries is 0. A month the catalog can never be read for is void.
Precision: Whole catalog entries whose date added falls in the month.

## As first published, and the proof

Not on-chain yet. The newest complete period goes on-chain with the daily proof at 12:40 UTC.

## Last 30 complete periods

| Period | Level | Change | Band |
| --- | ---: | ---: | --- |
| Oct 2026 | 36 flaws | -16.3% | Normal |
| Sep 2026 | 43 flaws | +38.7% | Elevated |
| Aug 2026 | 31 flaws | +19.2% | Normal |
| Jul 2026 | 26 flaws | +13.0% | Quiet |
| Jun 2026 | 23 flaws | +9.5% | Quiet |
| May 2026 | 21 flaws | -32.3% | Quiet |
| Apr 2026 | 31 flaws | +19.2% | Normal |
| Mar 2026 | 26 flaws | -7.1% | Quiet |
| Feb 2026 | 28 flaws | +64.7% | Normal |
| Jan 2026 | 17 flaws | -15.0% | Quiet |
| Dec 2025 | 20 flaws | +81.8% | Normal |
| Nov 2025 | 11 flaws | -64.5% | Quiet |
| Oct 2025 | 31 flaws | +93.8% | Elevated |
| Sep 2025 | 16 flaws | +6.7% | Quiet |
| Aug 2025 | 15 flaws | -25.0% | Quiet |
| Jul 2025 | 20 flaws | 0.0% | Quiet |
| Jun 2025 | 20 flaws | -16.7% | Quiet |
| May 2025 | 24 flaws | +60.0% | Normal |
| Apr 2025 | 15 flaws | -53.1% | Quiet |
| Mar 2025 | 32 flaws | +18.5% | Elevated |
| Feb 2025 | 27 flaws | +92.9% | Elevated |
| Jan 2025 | 14 flaws | -12.5% | Quiet |
| Dec 2024 | 16 flaws | -27.3% | Quiet |
| Nov 2024 | 22 flaws | +29.4% | Normal |
| Oct 2024 | 17 flaws | -32.0% | Quiet |
| Sep 2024 | 25 flaws | +31.6% | Normal |
| Aug 2024 | 19 flaws | +35.7% | Quiet |
| Jul 2024 | 14 flaws | +55.6% | Quiet |
| Jun 2024 | 9 flaws | -35.7% | Quiet |
| May 2024 | 14 flaws | +40.0% | Quiet |

JSON: https://tickerz.com/api/indices/zeroday

## Asked often

**How many software vulnerabilities are being exploited right now?** 36 software flaws were added in Oct 2026 to the US Cybersecurity and Infrastructure Security Agency's catalog of flaws attackers are known to be using.

**Where does the $ZERODAY number come from?** Tickerz reads it from CISA, Known Exploited Vulnerabilities catalog. Monthly. CISA adds entries any day; a month prints once it has ended. Each number is kept as it was first published, with a timestamped proof, and any later revision is shown beside it.

**Can I download the $ZERODAY data?** Yes, free and with no key: the full history as JSON at https://tickerz.com/api/indices/zeroday and every period as CSV at https://tickerz.com/api/indices/zeroday/history.csv.

## Name a number

Name a number you want counted. Within 48 hours it is a ticker, or you get the plain reason it cannot be built. POST https://tickerz.com/api/indices/requests with {"counts": "...", "source_url": "..."}, or the MCP tool name_a_number. Answers: https://tickerz.com/x#x-request

## For agents

- JSON API, no key: https://tickerz.com/docs (OpenAPI: https://tickerz.com/openapi.json)
- MCP server, Streamable HTTP, no key: https://tickerz.com/mcp
- Site summary: https://tickerz.com/llms.txt (everything in one file: https://tickerz.com/llms-full.txt; agent instructions: https://tickerz.com/agents.md)
- Signed numbers, every feed and The Tape: https://oracle.tickerz.com (each signed number with its recount: https://tickerz.com/signed)
- Plain answers about prediction market data: https://tickerz.com/answers
- Any page here in Markdown: send Accept: text/markdown, or open /md/<path>.

The Activity score says how unusual trading is, not whether an asset is good. It is not a price signal: whether it predicts returns is measured live at https://tickerz.com/evidence. Not advice.