About

How this site works

5105 Intel rebuilds every hour from 15 primary sources and correlates them: CVEs with exploits, detections and the actors using them; actors with their targets, techniques and malware; news with all of the above. Every source, its terms and the method behind each feature are listed below.

Who runs this

5105 Intel is built and maintained by Lakshitha Prabhath, a lead penetration tester and bug bounty hunter. It started as the feed I wanted for my own work: what attackers are actually using, and what defenders can do about it, without paywalls.

Portfolio inquiry@5105.site

Sources

15 feeds, refreshed hourly

Source	What it provides here	Terms	Status
CISA Known Exploited Vulnerabilities	Confirmed in-the-wild exploitation, required actions, deadlines, ransomware use, vendor advisories	Public domain (US government)	Pending
NIST National Vulnerability Database	New CVEs, CVSS, CWE, affected products and version ranges, references	Public domain. This product uses data from the NVD API but is not endorsed or certified by the NVD.	Pending
CVE.org (cvelistV5)	CVE records for older CVEs, vendor version data, CISA SSVC assessments, weakness names	CVE Terms of Use	Pending
FIRST EPSS	Daily probability of exploitation for every CVE, and 30-day history	Free to use with attribution to FIRST	Pending
Metasploit Framework	Exploit modules per CVE: rank, checks, targets, authors	BSD-3-Clause	Pending
Exploit Database	Published exploits per CVE: type, platform, author, verification	GPL-2.0 or later	Pending
Nuclei templates	Scanner templates per CVE	MIT	Pending
PoC-in-GitHub	Public proof-of-concept repositories per CVE, with creation dates	CC0-1.0	Pending
Sigma rules	Detection rules mapped to CVEs and ATT&CK techniques	Detection Rule License 1.1 (rules credited to their authors)	Pending
MITRE ATT&CK Enterprise	Groups, software, techniques, campaigns, detection strategies, mitigations	ATT&CK Terms of Use (free with attribution)	Pending
MISP threat-actor galaxy	Actor aliases, origin, and the Council on Foreign Relations tracker fields (sponsor, victims, target categories)	CC0-1.0 / BSD-2-Clause	Pending
ransomlook.io	Victims posted on ransomware leak sites, last 30 days	Public API. Leak-site links are not republished.	Pending
Have I Been Pwned	Every public breach with accounts affected and data exposed	CC BY 4.0	Pending
8 security news publishers	Headlines and publisher teasers, tagged with the CVEs, actors and vendors they mention	Headlines link to the publisher; articles are not republished	Pending
Natural Earth via world-atlas	Country shapes for the maps	Public domain data, ISC-licensed package	Pending

Methods

Triage P1 to P4
Every CVE gets a patch priority from evidence of exploitation, not severity alone: P1 exploited, P2 weaponized or likely next, P3 public exploit code or high EPSS, P4 no signal yet. The reason is shown with every label.
Weaponization ladder
Tracks each CVE from disclosure through GitHub PoC, ExploitDB, Nuclei template and Metasploit module to confirmed exploitation, with the date of each step.
Early warning and track record
Ranks CVEs outside KEV by the signals that usually come before exploitation. Every CVE entering the top 25 is logged with a timestamp, and the track record counts how many CISA later confirmed and how many days earlier we flagged them.
KEV blind spots
Heavily weaponized CVEs that CISA has never listed: the gaps in KEV-driven patching.
Exploitability in plain words
CVSS vectors are read into who can exploit a CVE (network or local, login or not, user action or not) and what that means for exposure.
Detection fallback
When no CVE-specific Sigma rule exists, each CVE points to the ATT&CK techniques its exploitation falls under, with their detection strategies, rules and mitigations.
Evidence for every link
Links between actors, countries and industries show where they come from: a quoted sentence from ATT&CK or MISP, or an entry in the CFR tracker.
Hunting guides
For each actor and malware family: initial-access techniques, Sigma coverage of its techniques, detection gaps and the mitigations that cover the most of its behaviour.
Estimated ransomware sectors
Victims are classified by the first industry their published description names. These are estimates and are labelled as such.

Exports

CSV and JSON, rebuilt hourly

Likely next (early warning)
CSV JSON
Weaponized in the last 7 days
CSV JSON
Weaponized but not in KEV
CSV JSON
Added to KEV in the last 30 days
CSV JSON
All CVEs published in the last 7 days
CSV JSON

News sources

Exploit code is listed so defenders can assess and test exposure; only test systems you are authorised to test. Attribution, origin and sector data come from public sources and can be wrong or out of date; each link shows its evidence so you can judge it. Ransomware victim names come from criminal leak sites and are shown without links.

How to read this page

P1 to P4: Our patch priority. P1 patch now: confirmed exploited in the wild (CISA KEV, or CISA reports active exploitation). P2 this week: a Metasploit module or Nuclei template exists, it ranks in the top 25 likely next, or EPSS is 50% or more. P3 schedule: public exploit code, EPSS 10% or more, or CVSS 9+. P4 routine: no exploitation signal yet. The reason is always shown next to the label.
Weaponization ladder: Five squares, left to right: GitHub PoC, ExploitDB entry, Nuclei template, Metasploit module, exploited in the wild (red). Each step lowers the skill needed to attack: a Nuclei template means anyone can scan the internet for it, a Metasploit module means anyone can exploit it with one command.
EPSS: FIRST's Exploit Prediction Scoring System: the estimated probability that a CVE is exploited in the next 30 days, from observed attack data. The percentile compares it with every other CVE. It measures likelihood, not impact.
KEV: CISA's Known Exploited Vulnerabilities catalog: CVEs with reliable evidence of exploitation in the wild. The due date is binding for US federal agencies and a useful upper limit for everyone else.
CVSS: Severity if exploited, 0 to 10. We read the vector into plain words: where the attacker must be (network, adjacent, local), whether a login or user action is needed, and what is impacted. Severity is not likelihood: most critical CVEs are never exploited.
CISA SSVC: CISA's own assessment in the CVE record: exploitation "none", "poc" (public proof of concept) or "active" (seen in attacks).
Likely next: CVEs outside KEV ranked by signals that usually come before exploitation. Each entry into the top 25 is logged, and the track record counts how many CISA later confirmed.
Evidence: Every link between an actor and a country or industry shows where it comes from: a quoted sentence from MITRE ATT&CK or the MISP galaxy, or an entry in the Council on Foreign Relations Cyber Operations Tracker. Links without a quote come from that tracker's lists.
Estimated sector: Ransomware victims are classified by the first industry named in the description the group publishes. Posts with too little detail stay unclassified.