How 5105 Intel ranks, correlates and explains threats

Roughly a hundred new CVEs get published every day. Nobody can patch on that schedule, and sorting by CVSS alone doesn’t help much: a large share of new CVEs score 7.0 or higher, and well under 1% are ever confirmed exploited. This site ranks by evidence of real-world use instead, and shows the evidence behind every claim.

Triage: P1 to P4

Every CVE gets a patch priority, with the reason printed next to it:

P1, patch now. Confirmed exploited: listed in CISA’s Known Exploited Vulnerabilities catalog, or CISA’s own assessment in the CVE record says exploitation is active.
P2, this week. Weaponized for mass use (a Metasploit module or a Nuclei template exists), ranked in the top 25 likely next, or EPSS of 50% or more.
P3, schedule. Public exploit code exists, EPSS is 10% or more, or CVSS is 9 or higher.
P4, routine. No exploitation signal yet.

The weaponization ladder

Disclosure is only the start. Each CVE page shows the dates it climbed each step: a public PoC on GitHub, an ExploitDB entry, a Nuclei template (anyone can scan the internet for it), a Metasploit module (anyone can exploit it with one command), and finally confirmed exploitation. Weaponized this week lists every CVE that climbed a step in the last seven days.

Early warning, with a track record

The likely next list ranks recently disclosed CVEs that are not in KEV yet by the signals that usually come first: working exploit code, scanner templates, a rising EPSS score and press coverage. Every CVE that enters the top 25 is logged with a timestamp. When CISA later adds one to KEV, the track record shows how many days earlier it was flagged, and KEV additions that were never flagged count as misses.

The same page lists KEV blind spots: older CVEs with Metasploit modules or Nuclei templates and high exploitation odds that CISA’s catalog still does not include. If patching is driven by KEV alone, these are the gaps.

Context on every CVE

Each CVE page answers the questions asked at triage time:

Who can exploit it, read from the CVSS vector: over the network or only locally, with or without a login, with or without a user clicking something.
What to patch: affected and fixed versions from NVD and the vendor’s CVE record, vendor advisories, and CISA’s required action and deadline.
How to detect it: CVE-specific Sigma rules where they exist. Where they don’t, the ATT&CK techniques its exploitation falls under, with their detection strategies and mitigations.
Who uses it: threat actors, malware and campaigns that ATT&CK links to the CVE, and news coverage.

Threat actors, with evidence

Actor profiles merge MITRE ATT&CK with the MISP threat-actor galaxy. Every link between an actor and a country or industry shows where it comes from: a quoted sentence from ATT&CK or MISP, or an entry in the Council on Foreign Relations Cyber Operations Tracker. Each profile also has a hunting guide: how the actor gets in, how much of its behaviour public Sigma rules cover, the detection gaps, and the mitigations that blunt the most of its techniques.

Using it in a SOC

Start with the analyst briefing on the overview: what CISA confirmed, what got weaponized and what is likely next this week.
Work the P1 list, then P2. Each CVE page says which versions to patch and how to detect exploitation.
For the actors that target your industry or country, deploy the rules from their hunting guides and plan custom detection for the gaps.
Pull the CSV or JSON exports into tickets or a SIEM lookup.

Notes like this one are where I’ll write up the incidents worth more than a headline.