How this page is built.

How we rank "matters most"

Each CVE gets points from public signals. A CVE with 50 points or more, and activity in the last 30 days, goes on the list:

• Exploited in the wild: on CISA's Known Exploited Vulnerabilities list (100 points, 30 more if added in the last 30 days, 10 more if used in ransomware), or active exploitation reported through CISA's SSVC enrichment (60). A public proof of concept adds 15.
• Likely to be exploited: an EPSS probability of 50% or more (40), 10% or more (25), 1% or more (5).
• Severity: CVSS 9.0 or higher (25), 7.0 or higher (10).
• Urgent agency advisory: a CERT-EU advisory, a CERT-FR alert, an NCSC-NL advisory rated high probability and high damage, a BSI advisory rated kritisch, or NCSC-UK news naming the CVE (30 each, up to 100). Other advisories add 5 each, up to 15. Roll-up advisories that cover more than 10 CVEs don't count, because they say little about each one.
• Interim mitigation: a PrivacySafe patch for the CVE (20).

The list is ordered by those points plus a freshness bonus: up to 40 for activity today (a new CVE, a new KEV listing or a new focused advisory), fading to nothing after 10 days. That keeps this week's news above a KEV entry from three weeks ago.

Ranking is a starting point, not a verdict for your environment. A medium-severity flaw in software you run on the internet can matter more to you than a critical one in software you don't use.

The analyst view

For CVEs on the "matters most" list, an analyst briefing is written with AI (Anthropic's Claude) from the facts on that page only: the official description, scores, advisories and fixes. It covers what the flaw is, the impact on a business, the MITRE ATT&CK techniques an attack would most likely use, the steps to fix it, and a verdict:

• Red alert: exploited in the wild and reachable over the network without a password or a user clicking anything. Act today if you run the product.
• Patch within days: exploited but needs access or a user action first, or critical and open to the network but not yet seen exploited.
• Routine patching: everything else. Handle it in your normal patch cycle.

Each briefing also says who should treat it as a red alert and who can wait. Technique IDs come from a fixed list of real ATT&CK techniques. Briefings are labelled, reviewed when we can, and never replace the vendor's advisory.

What's covered

• Every CVE the NVD lists as published in the last 30 days (16,702 right now), plus every CVE on CISA's exploited list (1,754).
• Advisories from the last 30 days from CERT-EU, CERT-FR, NCSC-NL, NCSC-UK and BSI CERT-Bund.
• Fixes from the GitHub Advisory Database, PrivacySafe security-patches, NVD references tagged as patches and vendor bulletins cited by CERT-FR.

Sources and licences

We don't republish text from sources whose licence doesn't clearly allow it. For NCSC-NL and BSI we show the headline, rating and CVE numbers and link to the original. Advisories from BSI, CERT-FR and NCSC-NL are shown in English: their fixed phrasing is translated by rules and anything else by AI (Anthropic's Claude). They are marked "Translated from", with the original title on hover. Some agencies, such as the Canadian Centre for Cyber Security, CERT/CC and JPCERT/JVN, don't allow commercial republishing, so they aren't included.

Corrections

Spotted something wrong or missing? Email hello@cyfenced.com. To report a vulnerability in Cyfenced itself, see our responsible disclosure policy.

Last refresh: 22 Oct 2026, 23:38 UTC. KEV catalogue version 2026.10.21. EPSS model_version:v2026.06.15,score_date:2026-10-22T12:00:12Z.