Vulnerabilities and patches

The effective Common Vulnerability Scoring System (CVSS) score uses a strict precedence: the National Vulnerability Database (NVD) score when present (latest version, v4.0 then v3.1, v3.0, and v2.0), else the CVE Numbering Authority (CNA) score from the CVE record, else the Authorized Data Publisher (ADP) score. A CNA or ADP score is labeled with a chip beside the version chip; once NVD publishes its analysis the score is replaced and relabeled. Priority is a tier first and a rank within that tier, never a raw sum, so the number is tier major: the five tiers ascend Track, Track*, Attend, Act, and Act now, and any Act now item outranks any Act item, so a quiet high severity CVE can never outrank one that is actively exploited and internet facing. The tier is set by exploitation first, on a single ladder from proof of concept up through active and ransomware use that the Known Exploited Vulnerabilities (KEV) catalogs and the CISA Vulnrichment exploitation signal feed rather than stack, then a Stakeholder Specific Vulnerability Categorization (SSVC) style decision computed by this tracker, whose foundation is the CISA Vulnrichment program's published SSVC judgments wherever they have been ingested for the CVE, with the automatability and technical impact inputs derived here from CVSS only where no CISA judgment is stored (those two inputs are labeled with their source on the CVE panel), then exposure, then Exploit Prediction Scoring System (EPSS) probability. The exploitation ladder, exposure, and End of Life only ever raise the tier above what that SSVC decision implies, never lower it. Exposure counts as open only when the attack vector is Network and the product is a curated internet facing class such as a firewall, a virtual private network gateway, or an edge router, never from Network alone. End of Life raises the tier by at most one step, and only when the product is both internet facing exposed and actively exploited, never on its own. Within a tier, the rank draws on exploitation, EPSS, whether that EPSS score has been rising over the last thirty days, CVSS, technical impact, the weakness class the CWE identifier names, how mature the public exploit is, exposure, KEV due date proximity, news mentions, KEV corroboration, whether the flaw reaches beyond the affected component, and how many privileges an attacker needs, each counted once. Reaching beyond the component means exploiting it affects resources outside its own security authority. CVSS version 3 states that as Scope; version 4 removed Scope and replaced it with three measures of the impact on a system beyond the vulnerable one, so we read whichever the record provides, and both earn the same amount. When the keyed exposure sources are enabled, the within tier rank also reflects observed mass exploitation, the count of threat internet protocol addresses, and the observed internet facing instance count from Shodan, a blast radius signal that never sets the exposure gate, each likewise a small within tier nudge that never changes the tier itself. The All Tracked view filters on a published-date window: a segment shows only CVEs published within it, so the default view shows what is genuinely new rather than years-old maximum-priority entries; Movers is unchanged. The Published column shows only a date an authority stated (NVD or the CVE record); a CVE tracked here without one shows a dash, with the first-tracked date in the dash's tooltip, and sorts below every dated row. The window segments filter on the CVE's published date, whatever its provenance; recent movement on older CVEs, such as a fresh KEV addition to an old CVE, appears in Movers, not in the windows.

Status values. active: Exploitation in the wild is confirmed by a tracked signal: a ransomware-linked KEV entry, or the CISA Vulnrichment SSVC Exploitation decision point reported as Active. That is one CISA decision point, not a full CISA assessment; the SSVC-style verdict on the CVE panel is computed by this tracker, and its automatability and technical impact inputs are labeled with their source. kev-listed: In an exploitation catalog (CISA KEV, VulnCheck KEV, or ENISA EUVD), meaning exploitation has been observed, without a tracked ransomware link or newer active signal. Dash: Tracked from news, advisories, or scoring feeds with no exploitation signal from any catalog yet.

Due: Due dates are CISA Binding Operational Directive remediation deadlines for US federal agencies, and a useful prioritization signal for everyone else. Rows due within the next 14 days carry a subtle accent; past-due rows render plainly, since most of the catalog is long past its federal deadline and the actionable set is what is still upcoming. PoC: a public proof of concept referenced by the CVE record itself, linking to that single reference. EPSS: EPSS (Exploit Prediction Scoring System) is the probability that a vulnerability will be exploited in the wild within the next 30 days, shown here as a percentage.

What gets tracked. A CVE enters this table when an exploitation catalog lists it (CISA KEV, VulnCheck KEV, or ENISA EU KEV), when GitHub publishes a critical or high severity advisory for it, or when it ships in a Microsoft Patch Tuesday release within the last twelve months. Azure Linux package advisories from those releases are the one documented exception: they stay on the Patch Tuesday page but join this table only when the operator enables them.