NVD · last 7 days · 0 records
New CVEs
Everything published in the last 7 days, newest first. P1 to P4 is the triage priority: whether it is exploited, weaponized or likely to be. Where NVD has not scored a CVE yet, the reporting organization's score is shown.
| CVE | Triage | Exploit | Description | Published |
|---|---|---|---|---|
| Nothing matches this filter. | ||||
How to read this page
- P1 to P4
- Our patch priority. P1 patch now: confirmed exploited in the wild (CISA KEV, or CISA reports active exploitation). P2 this week: a Metasploit module or Nuclei template exists, it ranks in the top 25 likely next, or EPSS is 50% or more. P3 schedule: public exploit code, EPSS 10% or more, or CVSS 9+. P4 routine: no exploitation signal yet. The reason is always shown next to the label.
- Weaponization ladder
- Five squares, left to right: GitHub PoC, ExploitDB entry, Nuclei template, Metasploit module, exploited in the wild (red). Each step lowers the skill needed to attack: a Nuclei template means anyone can scan the internet for it, a Metasploit module means anyone can exploit it with one command.
- EPSS
- FIRST's Exploit Prediction Scoring System: the estimated probability that a CVE is exploited in the next 30 days, from observed attack data. The percentile compares it with every other CVE. It measures likelihood, not impact.
- KEV
- CISA's Known Exploited Vulnerabilities catalog: CVEs with reliable evidence of exploitation in the wild. The due date is binding for US federal agencies and a useful upper limit for everyone else.
- CVSS
- Severity if exploited, 0 to 10. We read the vector into plain words: where the attacker must be (network, adjacent, local), whether a login or user action is needed, and what is impacted. Severity is not likelihood: most critical CVEs are never exploited.