How the data works

CVSS: supplied severity

CVSS is supplied severity from record metrics, not a prediction. The displayed primary metric uses valid original CNA CVSS base metrics only, preferring version 4.0, then 3.1, then 3.0, then 2.0, choosing the highest published base among scenarios and labeling it the worst CNA-provided scenario. ADP-only scores stay visible as secondary metrics and are never silently promoted. A CVE with no valid CNA metric is unscored, not low severity. CVSS v2-only is legacy-scored and is not called critical. Do not treat different CVSS versions as calibrated alike.

KEV: known-exploitation evidence

KEV membership means the CVE is listed in the accepted CISA known-exploited catalog snapshot. Absence means not listed in the accepted snapshot, not proof of no exploitation. The date shown is the catalog addition date, not proven first exploitation or current attack volume.

EPSS: dated forecast

EPSS is a dated forecast of observed exploitation activity over the next 30 days, with a score date and model version. The percentile is a relative position among scored CVEs, so a 96th percentile is not a 96% exploitation probability. A missing current row is unknown, never zero and never silently replaced with an older score. Real zero remains known. Model changes can move scores without changed CVE conditions, so cross-model movement is not read as rising threat. EPSS is not social popularity, severity, an exploit count, or organization-specific risk.

The three signals stay distinct. Multiplying CVSS by EPSS or mixing them with weights does not create a calibrated probability or risk score, so this site never computes one.

How the signals relate ?

Default priority

Compare these keys in order, stopping at the first difference: 1. KEV member before not listed in the accepted KEV snapshot. 2. Within that tier, EPSS present before unknown. 3. Within scored records, EPSS probability descending (actual zero remains scored). 4. Known publication timestamp before unknown. 5. Publication timestamp descending. 6. CVE ID ASCII ascending.

Known exploited

KEV members only. KEV dateAdded descending, then CVE ID ASCII ascending. EPSS is not a sort key here.

Highest forecast

Known EPSS only. Raw EPSS probability descending, known publication before unknown, publication descending, CVE ID ASCII ascending. KEV membership is not a sort key here. Display uses display_probability_percent = 100 * epss and display_percentile = 100 * percentile.

New critical

Let T be the stored UTC publication cutoff. Include publication times in [T - 30d, T) with primary modern CVSS v2 excluded and base 9.0 or above. Order publication descending, then CVE ID ASCII ascending. Unknown, legacy-only, and ADP-only primary cases are ineligible, not low severity. No mixed-version numeric severity ordering is implied.

Rising forecast

Let d be the accepted current EPSS UTC score date. Require observations on exactly d and d-7 calendar days with the same model version. delta_pp = 100 * (epss[d] - epss[d-7]). Include positive changes only. Order delta percentage-points descending, current raw probability descending, CVE ID ASCII ascending. Missing dates and model transitions are ineligible, never interpolated or zeroed. This is a forecast movement list, not social popularity or observed exploitation telemetry.

Visitor pages and the public API read accepted local snapshots only. Only the ingestion worker fetches upstream. Each publication pins exact source revisions and dates, observation times, the ranking policy version, and the eligible cohort.

CVE List V5: official list, updated about every 7 minutes from the official CVE Services API (a stated cadence, not a maximum-latency guarantee). Target refresh here is hourly. Publication and update chronology come from record dates, not ingestion time.

CISA KEV: full catalog snapshot with catalogVersion, dateReleased, count, and entries carrying cveID, dateAdded, vendorProject, product, and due dates. Target refresh here is hourly with conditional requests where supported.

FIRST EPSS: full daily compressed CSV; columns are cve, epss, percentile, with the leading comment giving model_version and score_date. Target refresh here is daily after expected publication. Historical analysis uses dated historical files or retained daily observations, never the assumption that the moving current-file URL preserves past versions.

A locally computed hash identifies bytes; it is not a publisher authenticity signature. Reimporting identical bytes or revisions yields the same normalized result without duplicates. A successful unchanged check updates health, not record-modified dates.

CVE List V5

The CVE usage license authorizes reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute and requires that copies reproduce MITRE copyright designation and this license. It is no-charge reuse, not CC0. Public display and derived ordering are supported subject to these conditions. Retain the full applicable license and notice in distributed data and on this attribution page.

CISA KEV

The KEV database is distributed under the Creative Commons 0 1.0 License. You may use this data in any lawful manner. Linked third-party content keeps its own terms.

No endorsement or marks

Catalog reuse grants neither use of CISA or DHS marks nor implied endorsement. Avoid implying upstream endorsement.

FIRST EPSS

FIRST says scores are published daily, free of charge, with no registration required. The services terms grant a limited, revocable license for distribution only for vulnerability disclosure, cybersecurity incident response, or preventative cybersecurity uses with notices retained.

EPSS attribution

The FAQ requests attribution in products and publications. This page is that attribution: forecasts come from FIRST EPSS, with score date and model version shown beside every value.

FIRST terms clarification before monetization

A preventative dashboard appears aligned with the permitted uses; blanket permission for every commercial arrangement is not established. Before ads, paid access, resale, or other commercialization, recheck every source and clarify FIRST terms. Hosting and database costs are separate from data fees either way.

Not legal advice

These are dated findings from 2026-10-24, not legal advice. Source terms can change; link to vendor advisories rather than copying their prose, logos, or exploit code.

Recheck before launch

Recheck terms before launch and before adding monetization. Before release, verify coverage and operations, link and excerpt behavior, and changed terms.

Retained cohort: 397835 published records, 1762 KEV-listed, 397508 EPSS-scored, 0 with unknown publication dates. These are observed counts, not completeness claims.

Not promised: social popularity or most-talked-about lists (no validated source selected); guaranteed nickname search such as PHP2Shell (only indexed text matches, curated aliases would be separate editorial work); complete unpublished-reservation counts (the public corpus does not enumerate all reserved IDs); severity for every CVE (metrics, titles, languages, products, and aliases are not universally populated, so absence stays unknown); exact parity with any other tracker projection (snapshot disagreement illustrates dating, not a systematic defect).

Severity filters use primary CNA metrics only; ADP-only, legacy-only, and unscored cases stay separate. Date and join gaps stay visible with coverage shown. Missing publication dates go to an explicit unknown bucket. Corrections and rejections update derived views, and historical totals can change. Do not estimate all unpublished reservations, annual counts from ID numbers, or total worldwide exploitation.

Before release, and again before any monetization, recheck each item with its check date recorded: CVE Terms of Use (copyright designation and license reproduced); CISA KEV CC0 1.0 terms (marks and third-party links excluded); FIRST EPSS data access, FAQ attribution, and services terms (preventative-use scope and retained notices); every notice on this page still present verbatim; failed-feed behavior verified (last-known-good served with a visible stale warning); coverage and operations measured rather than claimed.