Observable state

Operations

Evidence availability, source freshness, declared gaps, and quality boundaries. Administrative controls remain private.

Verified snapshot within the publication window

Source acquisition and public publication are separate steps. The daily publication window is 36 hours, including validation time.

Evidence current throughOct 22, 2026, 6:07 PM UTCSnapshot evidence cutoff

Sources reporting4Declared sources in this snapshot

Status checkedOct 23, 2026, 1:48 AM UTCPublic safe-status observation

Declared sources

Provider freshness boundaries

Upstream publication lag is distinct from Cascade ingestion lag. Evidence gaps remain explicit and never imply safety.

CVE

CVE Program cvelistV5

Supported

Snapshot evidence cutoff: Oct 22, 2026, 5:17 PM UTC
Snapshot source high-water: Oct 22, 2026, 4:27 PM UTC
Latest acquired high-water: Oct 22, 2026, 4:27 PM UTC
Upstream lag: 9.4 hr
Cascade ingestion lag: 51 min
Snapshot build lag: 0 sec
Latest attempt: Oct 22, 2026, 5:16 PM UTC
Latest success: Oct 22, 2026, 5:17 PM UTC
Latest change: Oct 22, 2026, 5:17 PM UTC
Retained records: 413,038
Declared gaps: 0

EPSS

FIRST Exploit Prediction Scoring System

Supported

Snapshot evidence cutoff: Oct 22, 2026, 5:23 PM UTC
Snapshot source high-water: Oct 22, 2026, 12:00 PM UTC
Latest acquired high-water: Oct 22, 2026, 12:00 PM UTC
Upstream lag: 13.8 hr
Cascade ingestion lag: 6.0 hr
Snapshot build lag: 0 sec
Latest attempt: Oct 22, 2026, 5:20 PM UTC
Latest success: Oct 22, 2026, 5:57 PM UTC
Latest change: Oct 22, 2026, 5:57 PM UTC
Retained records: 394,415
Declared gaps: 77

KEV

CISA Known Exploited Vulnerabilities Catalog

Constrained

Snapshot evidence cutoff: Oct 22, 2026, 4:42 AM UTC
Snapshot source high-water: Oct 21, 2026, 2:04 PM UTC
Latest acquired high-water: Oct 21, 2026, 2:04 PM UTC
Upstream lag: 1.5 days
Cascade ingestion lag: 1.1 days
Snapshot build lag: 0 sec
Latest attempt: Oct 22, 2026, 5:20 PM UTC
Latest success: Oct 22, 2026, 5:20 PM UTC
Latest change: Oct 22, 2026, 4:42 AM UTC
Retained records: 1,754
Declared gaps: 0

NVD

NIST National Vulnerability Database

Supported

Snapshot evidence cutoff: Oct 22, 2026, 6:07 PM UTC
Snapshot source high-water: Oct 22, 2026, 2:00 PM UTC
Latest acquired high-water: Oct 22, 2026, 8:00 PM UTC
Upstream lag: 5.8 hr
Cascade ingestion lag: 4.4 hr
Snapshot build lag: 6.3 hr
Latest attempt: Oct 23, 2026, 12:17 AM UTC
Latest success: Oct 23, 2026, 12:26 AM UTC
Latest change: Oct 23, 2026, 12:26 AM UTC
Retained records: 413,040
Declared gaps: 93

Analytical quality details

Analytical quality

Data quality and source health

Aggregate policy cohorts are technical context rather than repeated record-level warnings.

Source assessments differ39,011

Closed reason instances with material eligible-source disagreement after origin and derivative deduplication.

Product mapping pending0

Admitted package, product, vendor, or advisory identities whose exact source mapping remains candidate or source-scoped.

Severity eligibility pending41,261

Closed reason instances where severity is not yet available from an eligible source.

Source refresh attention413,038

Closed stale, unavailable, or constrained provider-health reason instances; this is not a count of safe or unaffected CVEs.

Policy-deferred evidence0

Closed reason instances deliberately deferred by the active evidence policy.

Quality cohort boundaries

Reason metrics count closed factor-level reason instances and may include more than one instance for a CVE.
Mapping metrics cover only entities admitted by the active Train AB provider cohort.
Unknown and nonmembership states are not proof of safety.

Technical snapshot and refresh details

Generation IDgen-8d1f1688a36ae39650be68c8a776c6e7State active

Registry revisionpublic-core-20260726.3Server-declared source policy

Generation lag7.7 hrActive cutoff to status observation

Private scheduler · public status

Acquisition and generation jobs

These rows are observational only. Run-now, pause, resume, and rollback remain private operations.

CVE

cve-refresh

Evidence supported

Last attemptOct 22, 2026, 5:16 PM UTC

Last successOct 22, 2026, 5:17 PM UTC

Last changeOct 22, 2026, 5:17 PM UTC

Next plannedOct 23, 2026, 5:20 AM UTC

Queued source changeNone queued

Ordered admitted CVE delta releases reconciled successfully.

Mode: Ordered release metadata
Cadence: 12.0 hr ± 15 min
Last duration: 54.6 sec
Consecutive failures: 0
Provider high-water: Oct 22, 2026, 4:27 PM UTC
Last counts: Accepted new 139 · Delta assets 10 · Parsed items 4,448 · Metadata bytes 2,739,019 · Metadata pages 1 · Rejected safety 0 · Rejected schema 0 · Accepted revision 1,684 · Duplicate content 2,625 · Ignored out of scope 0 · Accepted deletion notice 0

Schedule public-core-schedule-20260927.1

KEV

kev-refresh

Evidence supported

Last attemptOct 22, 2026, 5:20 PM UTC

Last successOct 22, 2026, 5:20 PM UTC

Last changeOct 22, 2026, 4:42 AM UTC

Next plannedOct 23, 2026, 5:27 PM UTC

Queued source changeNone queued

The current admitted KEV artifact was already reconciled.

Mode: Conditional complete snapshot
Cadence: 1.0 days ± 30 min
Last duration: 304 ms
Consecutive failures: 0
Provider high-water: Oct 21, 2026, 2:04 PM UTC
Last counts: Source runs 0 · Fetched bytes 1,803,428

Schedule public-core-schedule-20260927.1

NVD

nvd-modified-refresh

Evidence supported

Last attemptOct 23, 2026, 12:17 AM UTC

Last successOct 23, 2026, 12:26 AM UTC

Last changeOct 23, 2026, 12:26 AM UTC

Next plannedOct 23, 2026, 6:34 AM UTC

Queued source changeNone queued

A coherent two-META NVD modified feed reconciled successfully.

Mode: Conditional snapshot
Cadence: 6.0 hr ± 15 min
Last duration: 551.3 sec
Consecutive failures: 0
Provider high-water: Oct 22, 2026, 8:00 PM UTC
Last counts: Accepted new 210 · Parsed items 29,107 · Fetched bytes 15,288,744 · Rejected safety 0 · Rejected schema 0 · Accepted revision 1,845 · Duplicate content 27,052 · Coherence attempts 1 · Coherence rollovers 0 · Ignored out of scope 0 · Accepted deletion notice 0

Schedule public-core-schedule-20260927.1

During a refresh constraint, CASCA continues serving the last verified snapshot. Administrative controls and private runtime details remain outside this public view.