Vulnerabilities and patches

The effective Common Vulnerability Scoring System (CVSS) score uses NVD's latest version when present, otherwise CNA, ADP, then ENISA EUVD. A non-NVD score is labeled until NVD publishes its analysis. The number is the tier's base (Track 100, Track* 200, Attend 300, Act 400, and Act now 500) plus a 0 to 99 rank inside that tier. A lower-tier CVE can never outrank a higher-tier CVE. A CISA KEV listing or other confirmed exploitation sets an Act floor; ransomware association sets Act now. The Stakeholder-Specific Vulnerability Categorization (SSVC) verdict can set Track through Act. Its automatable and technical-impact foundation is the CISA Vulnrichment judgment where published, with a CVSS fallback; that verdict sets the base tier. Exploitation, open-exposure, and end-of-life modifiers can raise that tier and never lower it. A public exploit or elevated Exploit Prediction Scoring System (EPSS) result can set Track*. Open internet exposure raises an actively exploited or ransomware-associated item one tier and otherwise leaves it unchanged. End of Life raises an actively exploited item by at most one step and has no effect without active exploitation or ransomware association. Within a tier, the rank draws on exploitation, EPSS, whether that EPSS score has been rising over the last thirty days, CVSS, technical impact, the weakness class the CWE identifier names, how mature the public exploit is, exposure, CISA KEV due date proximity, news mentions, tracked catalog corroboration, whether the flaw reaches beyond the affected component, and how many privileges an attacker needs, each counted once. Reaching beyond the component means exploiting it affects resources outside its own security authority. CVSS version 3 states that as Scope; version 4 removed Scope and replaced it with three measures of the impact on a system beyond the vulnerable one, so we read whichever the record provides, and both earn the same amount. When the keyed exposure sources are enabled, the within tier rank also reflects observed mass exploitation, the count of threat internet protocol addresses, and the observed internet facing instance count from Shodan, a blast radius signal that never sets the exposure gate, each likewise a small within tier nudge that never changes the tier itself. All Tracked filters by published date; recent movement on an older CVE appears in Movers. If no authority published a date, the cell says so, shows first-tracked ingest provenance separately, and sorts below dated rows.

Status values. active: Exploitation in the wild is confirmed by a tracked signal: a ransomware-linked catalog entry, or the CISA Vulnrichment SSVC Exploitation decision point reported as Active. That is one CISA decision point, not a full CISA assessment; the SSVC-style verdict on the CVE panel is computed by this tracker, and its automatability and technical impact inputs are labeled with their source. listed by a tracked exploitation catalog: Listed by a tracked exploitation catalog (CISA KEV, VulnCheck KEV, or ENISA EUVD), meaning exploitation has been observed, without a tracked ransomware link or newer active signal. No tracked exploitation signal: Tracked from news, advisories, or scoring feeds with no exploitation signal from any tracked catalog yet.

Due: Due dates are CISA Binding Operational Directive remediation deadlines for US federal agencies, and a useful prioritization signal for everyone else. Rows due within the next 14 days carry a subtle accent; past-due rows render plainly, since most of the catalog is long past its federal deadline and the actionable set is what is still upcoming. PoC: a public proof of concept referenced by the CVE record itself, linking to that single reference. EPSS: An Exploit Prediction Scoring System (EPSS) percentage is the global 30-day exploitation probability in the wild, not specific to you. Do not read it as a complete risk score or as evidence about your environment or impact.

Detection and validation: Sigma rule, Atomic test, Nuclei template, and Metasploit module badges report mapped metadata availability. They do not change priority.

What gets tracked. A CVE enters this table when an exploitation catalog lists it (CISA KEV, VulnCheck KEV, or ENISA EU KEV), when GitHub publishes a critical or high severity advisory for it, or when it ships in a Microsoft Patch Tuesday release within the last twelve months. Azure Linux package advisories from those releases are the one documented exception: they stay on the Patch Tuesday page but join this table only when the operator enables them.