Exploit race
Who gets there first — the public exploit or the KEV addition? One point per KEV vulnerability: days to exploit vs. days to addition (from publication).
Exploit vs. addition
Below the diagonal, the exploit came before the KEV addition.
Medians by year of publication
Median days to exploit and to KEV addition, and the share of "exploit first".