Question 1

What is a CVE?

Accepted Answer

A CVE (Common Vulnerabilities and Exposures) is a public identifier, such as CVE-2026-12345, for a specific security vulnerability. The CVE Program run by MITRE and CISA assigns the ids, and the National Vulnerability Database (NVD) adds severity scores and affected products.

Question 2

How is this CVE list ranked?

Accepted Answer

By default it sorts by exploit likelihood: vulnerabilities exploited in the wild (CISA KEV) first, then the EPSS exploit probability, then a priority score that weighs CVSS severity, whether a fix exists and how recent the CVE is. You can also sort by newest, most critical or recently updated.

Question 3

What is EPSS, the exploit odds shown next to the severity?

Accepted Answer

EPSS is the Exploit Prediction Scoring System from FIRST.org. It estimates the probability that a CVE is exploited in the next 30 days and is recalculated daily. A score of 62% means a 62% modelled chance.

Question 4

What does Drop everything mean?

Accepted Answer

A CVE is marked this way when it is critical (CVSS 9.0 or higher) and either exploited in the wild with a real chance of more, or very likely to be exploited (EPSS 40% or more). These are the ones to read first.

Question 5

Where does the data come from, and how often is it updated?

Accepted Answer

From public sources: the CVE.org record feed (every 5 minutes), the NVD API (every 15 minutes), the CISA KEV catalog (hourly) and FIRST EPSS scores (daily). This site is not affiliated with CVE.org, MITRE, CISA or NIST.

The internet is broken right now.