Vulnerability guides
The terms that show up in every advisory and KEV alert, explained once, with primary sources linked and numbers taken from the 1,780 CISA-listed CVEs we track. These are explainers; we do not publish exploit code or attack steps.
What is the CISA KEV catalog?
The Known Exploited Vulnerabilities (KEV) catalog is a public list, maintained by the US Cybersecurity and Infrastructure Security Agency (CISA), of CVEs that CISA has evidence are being exploited in the wild. If a CVE is on it, attackers are using it against real systems.
What is EPSS, and how should you read it?
EPSS (Exploit Prediction Scoring System) is a model run by FIRST.org that gives each CVE a probability, between 0 and 1, that exploitation activity will be observed in the next 30 days. It is refreshed daily and is a forecast, not a severity rating.
CVSS v3.1 vs v4.0: what changed and what the score means
CVSS (Common Vulnerability Scoring System) is a FIRST.org standard that rates how severe a vulnerability is on a 0.0 to 10.0 scale. It describes the technical severity of the flaw, not how likely it is to be attacked or how much it matters in your environment.
How to prioritize patching with KEV, EPSS and CVSS
Work confirmed exploitation first (CISA KEV), then likelihood of exploitation (EPSS), then severity (CVSS), and let exposure decide ties: an internet-facing system you run beats an internal one with a higher score.
Zero-day vs n-day vulnerabilities
A zero-day is a vulnerability that is exploited, or publicly known, before the vendor has shipped a fix, so defenders have had zero days to patch. An n-day is one where a fix already exists and attackers exploit the gap between release and deployment.
CISA BOD 22-01 explained: KEV due dates
BOD 22-01, "Reducing the Significant Risk of Known Exploited Vulnerabilities", is a directive CISA issued in November 2021. It requires US federal civilian executive branch agencies to remediate every vulnerability in the KEV catalog by the due date attached to the entry.
CVE, NVD, CWE, CPE, KEV, EPSS: the acronyms, explained
CVE names a vulnerability, NVD enriches the record, CWE classifies the kind of weakness, CPE names the affected product, CVSS scores severity, EPSS estimates exploitation likelihood, and KEV lists what is confirmed exploited.
Looking for live data instead? Try the KEV tracker, thevendor hubs or the JSON API.