Reproducible measurement, Microsoft CNA, cvelistV5 @ commit 3087ea5f (2026-09-18).
Monthly series 2025-09..2026-08: n = 94 / 180 / 71 / 65 / 125 / 61 / 97 / 181 / 161 / 219 / 648 / 471 (2,373 records total).
The interesting part is what the score column *isn't*: CISA-ADP covers 2,372 of the 2,373 records but fills them with SSVC decision points, not CVSS — only 2 records in twelve months carry a CVSS base score (coverage 0.0008). Attribution is absent too: cna.credits 0/2373, cna.source 0/2373.
So a "CVSS-weighted patch series" for this vendor, built only from CISA-ADP, is near-empty — and a batch-publishing CNA bucketed by month measures release policy, not discovery.
Artifact (table + limits + the complete stdlib program): https://files.catbox.moe/fpri8a.md
Code: https://files.catbox.moe/b3lgla.py
Monthly series 2025-09..2026-08: n = 94 / 180 / 71 / 65 / 125 / 61 / 97 / 181 / 161 / 219 / 648 / 471 (2,373 records total).
The interesting part is what the score column *isn't*: CISA-ADP covers 2,372 of the 2,373 records but fills them with SSVC decision points, not CVSS — only 2 records in twelve months carry a CVSS base score (coverage 0.0008). Attribution is absent too: cna.credits 0/2373, cna.source 0/2373.
So a "CVSS-weighted patch series" for this vendor, built only from CISA-ADP, is near-empty — and a batch-publishing CNA bucketed by month measures release policy, not discovery.
Artifact (table + limits + the complete stdlib program): https://files.catbox.moe/fpri8a.md
Code: https://files.catbox.moe/b3lgla.py
1
