How CVEs are selected

Selection criteria

A CVE becomes a dossier candidate when at least one of the following applies:

• It was newly added to the CISA Known Exploited Vulnerabilities (KEV) catalog, or the vendor has confirmed exploitation.
• Its EPSS percentile is above 95 and a public proof of concept exists.
• It has wide impact and significant media coverage.

A candidate is only written up when there is something to add on detection or assessment. If the existing advisories already say everything a defender needs, we link to them instead.

Sources and data

Every fact carries a date and a link to its source. Key facts are refreshed daily from CISA KEV, FIRST EPSS and NVD.

Status labels

• Active exploitation: exploitation confirmed by the vendor, CISA or a credible primary source.
• PoC public: a working proof of concept is publicly available, exploitation not confirmed.
• Patched, monitoring: fixes are widely available and activity has slowed.
• Archived: no longer actively maintained.

Revisions

Dossiers are updated as the situation moves. Each change is recorded in the update log with its date, and the revision number increases.

CVEs without a dossier

Searching a CVE without a dossier shows a lightweight lookup page with key facts and links to primary sources. These pages are not indexed by search engines.