Sources and method

Sources and attribution

• The CISA Known Exploited Vulnerabilities Catalog is CC0 1.0. No endorsement by CISA; we do not use its logo.
• The NVD API: This product uses the NVD API but is not endorsed or certified by the NVD. The NVD name identifies the source only.
• EPSS scores by FIRST are free and require no registration.

Page rule v1

When a CVE gets a page: it is in CISA KEV, AND (its CVSS base score is ≥ 9.0, from NVD or the CNA, OR KEV knownRansomwareCampaignUse is "Known"), AND it was added to KEV inside the publication window. The initial window is the trailing 365 days. KEV entries that are older or below the bar appear as rows only.

When a page is indexable (all must hold): an NVD record exists with a description; a CVSS vector exists; at least one CWE; an EPSS score; at least one reference tagged Vendor Advisory or Patch. Otherwise the page renders with noindex, follow and is left out of the sitemap and feeds. Daily cap: at most 15 new pages per routine run. The first backfill may raise the cap explicitly.

Reference filter

We keep references tagged Vendor Advisory, Patch, Mitigation, Release Notes, US Government Resource or Third Party Advisory. We exclude Exploit-tagged links, denylisted exploit hosts and paths containing PoC, exploit or Metasploit markers.

Updates and corrections

Missing values are shown as not listed, never as zero. The collector is intended for daily runs; this page records the latest completed collection, generated 2026-11-01.

For corrections, contact Meo Advisors.