Security
Known exploitation, probabilistic risk and composition shifts that change triage.
What deserves triage first — and why?
Known exploitation (KEV), estimated probability (EPSS), potential impact (CVSS) and weakness composition remain separate. The page helps prioritize investigation; it does not turn probability into proof of exploitation.
What to investigate first
First: vulnerabilities with known exploitation in CISA KEV. Then: HIGH/CRITICAL outside KEV with EPSS ≥ 50%. Novelty determines order before EPSS and CVSS — with no invented score.
How the queue is ordered
Operational priority from NVD × CISA KEV × FIRST EPSS. The first band is known exploitation; the second is high probability without KEV confirmation. Order within each band, with no invented score: first by novelty window (≤30d, ≤90d, ≤1y, earlier — a newly added KEV counts as novelty), then by EPSS, then by CVSS. High-EPSS classics stay visible but no longer hold the top by age alone.
One type of flaw appears more often among cases with a high chance of attack
CWE-119 appears in 83 of 391 · 21.2% HIGH/CRITICAL CVEs with an identified CWE and EPSS ≥ 50% outside KEV, versus 39 of 568 · 6.9% comparable KEV CVEs. This is a composition difference, not a forecast of KEV entry.
Severity of new vulnerabilities · 30d
Severity describes potential impact; priority comes from crossing it with known exploitation and probability.
Rows add up to 14,130 CVEs published in 30 days · volume context, not risk ranking. “No CVSS”: NVD records not yet scored for severity.
Most severe flaws with the highest chance of attack
Severity (CVSS) vs predicted exploitation probability (EPSS). KEV (red) is confirmed exploitation.
Flaws already being used in attacks
Recent additions to the CISA KEV catalog, with real publication date when available.