Not in KEV yet · re-ranked hourly
Likely next
CVEs that CISA has not confirmed as exploited, but that show the signals that usually come first: working exploit code, scanner templates, a rising EPSS score, press coverage. Every CVE that enters the top 25 is logged with a timestamp, and the track record below shows how many CISA later confirmed and how early.
0Flagged, then confirmed by CISA
-Median days of warning
-KEV additions we flagged first
0CVEs flagged since launch
Ranking
Top 50| # | CVE | Ladder | Signals | EPSS | Score | Vulnerability |
|---|
KEV blind spots
Weaponized, never listedOlder CVEs with Metasploit modules or Nuclei templates and high exploitation odds that CISA's catalog still does not list. If your patching is driven by KEV alone, these are the gaps.
| CVE | Ladder | Signals | EPSS | Vulnerability |
|---|
Confirmed after we flagged them
- No flagged CVE has been added to KEV yet. Tracking started at launch; outcomes appear here as CISA updates its catalog.
Method
Each CVE outside KEV gets a score from public signals:
- Exploit code: Metasploit 30, Nuclei 20, ExploitDB 12, GitHub PoC 10 (capped at 45)
- EPSS probability × 30, plus up to 10 when it rose over the last week
- New exploit in the last 14 days: 10. Disclosed in the last 90 days: 8
- News coverage: 4 per story, up to 12
- CISA SSVC "active": 15, "poc": 4. CVSS 9+: 5
- Only CVEs disclosed in the last 180 days, or with a new exploit in the last 30, can rank here
How to read this page
- Weaponization ladder
- Five squares, left to right: GitHub PoC, ExploitDB entry, Nuclei template, Metasploit module, exploited in the wild (red). Each step lowers the skill needed to attack: a Nuclei template means anyone can scan the internet for it, a Metasploit module means anyone can exploit it with one command.
- EPSS
- FIRST's Exploit Prediction Scoring System: the estimated probability that a CVE is exploited in the next 30 days, from observed attack data. The percentile compares it with every other CVE. It measures likelihood, not impact.
- KEV
- CISA's Known Exploited Vulnerabilities catalog: CVEs with reliable evidence of exploitation in the wild. The due date is binding for US federal agencies and a useful upper limit for everyone else.
- CISA SSVC
- CISA's own assessment in the CVE record: exploitation "none", "poc" (public proof of concept) or "active" (seen in attacks).
- Likely next
- CVEs outside KEV ranked by signals that usually come before exploitation. Each entry into the top 25 is logged, and the track record counts how many CISA later confirmed.