About & FAQ
Who we are and how we collect, score, and present vulnerability data.
Last updated: April 2026
About vuln.today
Mission
vuln.today is a daily vulnerability intelligence platform for security teams and defenders. We aggregate, enrich, and prioritize CVEs from 17 authoritative sources to help you decide what to patch first.
Every day, dozens of new CVEs are published. Most are noise. vuln.today combines CVSS severity, EPSS exploitation probability, CISA KEV status, POC availability, and patch monitoring into a single priority score with clear decision labels: Emergency, Act Now, This Week, This Month, or Monitor.
Data Sources
vuln.today pulls data from 17 authoritative sources including NVD, CVE.org (MITRE), CISA KEV, EPSS, Exploit-DB, GitHub Advisory Database, VulDB, MISP Galaxies, MITRE ATT&CK, CISA Advisories, ENISA EUVD, Ubuntu Security, Debian Security Tracker, Vulners, and vendor advisory feeds (Red Hat, Chrome, HeroDevs).
CVE data is fetched hourly. EPSS and KEV catalogs are refreshed daily at 06:00 UTC.
Creator
vuln.today is built and maintained by Sebastian Obara, a security engineer focused on vulnerability management, threat intelligence automation, and building tools that help defenders stay ahead of emerging threats.
Contact
For questions, feedback, or data inquiries: [email protected]
Methodology & Pipeline
vuln.today is a daily vulnerability intelligence platform for security teams and defenders. We aggregate, enrich, and prioritize CVEs from 17 authoritative sources to help you decide what to patch first.
Data Pipeline
What Is AI-Generated?
- Technical analysis & risk assessment
- Executive summaries (CRITICAL/HIGH only)
- Affected product/vendor tags
- Attack technique classification
- Critical Watch daily selection & reasoning
- Related CVE grouping
- CVSS score & vector (NVD)
- EPSS exploitation probability (FIRST.org)
- KEV status (CISA)
- POC/exploit availability (Exploit-DB, GitHub, VulDB)
- Patch status (NVD, vendor advisories)
- CWE classification (NVD/MITRE)
Update Frequency
Severity Levels & CVE Properties
Each CVE is classified by CVSS score into a severity level. The level determines which features and enrichments are available on the detail page.
- Summary & technical context
- Risk assessment & exploit scenario
- Affected products & remediation
- CVSS vector breakdown + radar chart
- Priority Score calculation
- Executive View (Why It Matters)
- Recommended Action (24h)
- Business Impact assessment
- Compensating Controls
- Vendor status (Ubuntu/Debian)
- MITRE ATT&CK mapping
- Summary & technical context
- Risk assessment & exploit scenario
- Affected products & remediation
- CVSS vector breakdown + radar chart
- Priority Score calculation
- Executive View (Why It Matters)
- Recommended Action (24-48h)
- Business Impact assessment
- Compensating Controls
- Vendor status (Ubuntu/Debian)
- MITRE ATT&CK mapping
- Summary & technical context
- Risk assessment & exploit scenario
- Affected products & remediation
- CVSS vector breakdown + radar chart
- Priority Score calculation
- Executive View
- Recommended Action
- Business Impact
- Compensating Controls
- Vendor status (Ubuntu/Debian)
- MITRE ATT&CK mapping
- Summary & technical context
- Risk assessment & exploit scenario
- Affected products & remediation
- CVSS vector breakdown + radar chart
- Priority Score calculation
- Executive View
- Recommended Action
- Business Impact
- Compensating Controls
- Vendor status (Ubuntu/Debian)
- MITRE ATT&CK mapping
CVEs without a CVSS score yet (NVD hasn't assigned severity). Basic description available, enrichments added once severity is published.
Decision Labels
Each CVE gets an actionable label based on severity, exploitation signals (KEV, EPSS, POC), and patch availability. Labels help prioritize remediation effort.
Key Indicators
CVSS Score
Common Vulnerability Scoring System v3.1. Rates vulnerability severity on a 0–10 scale based on attack vector, complexity, required privileges, user interaction, scope, and impact (confidentiality, integrity, availability).
Source: NVD (NIST)
EPSS Score
Exploit Prediction Scoring System. Estimates the probability (0–100%) that a vulnerability will be exploited in the wild within the next 30 days. Updated daily.
Source: FIRST.org
Priority Score
Composite score (0–235) combining multiple threat signals into a single number for ranking CVEs.
CISA KEV
Known Exploited Vulnerabilities catalog maintained by CISA (U.S. Cybersecurity and Infrastructure Security Agency). Inclusion means the vulnerability has been observed being actively exploited in the wild.
Updated daily from CISA
POC (Proof of Concept)
Indicates a public proof-of-concept exploit exists. Detected from Exploit-DB, GitHub, VulDB, and cve-search sightings. A public POC significantly increases exploitation probability.
Patch Status
Whether an official fix is available. Detected from NVD references tagged as "Patch", vendor advisories (Ubuntu USN, Debian DSA), and GitHub security advisories.
Executive View
Available for CRITICAL and HIGH severity CVEs only. Provides a management-oriented assessment for risk owners and CISOs.
Why It Matters
Non-technical explanation of the vulnerability's business significance – what's at risk and why it matters for the organization.
Recommended Action
Specific, timeboxed remediation steps. CRITICAL: within 24h. HIGH: within 24-48h. Includes patch instructions or workarounds.
Business Impact
Assessment of potential operational, financial, and reputational impact. Rated as low, medium, high, or severe.
Compensating Controls
Interim mitigations when a patch is not yet available or cannot be applied immediately (e.g., WAF rules, network segmentation, access restrictions).
Data Confidence
Measures how many independent sources confirm information about a CVE. More sources = higher confidence in the data accuracy.
Counted sources: NVD/CVE.org (base), EPSS, ENISA EUVD, vendor advisories (Ubuntu/Debian), MISP Galaxies, MITRE ATT&CK, CISA, Exploit-DB, GitHub, VulDB.
Data Sources
We aggregate data from multiple authoritative vulnerability databases and feeds, updated hourly.
Security Dashboard
Priority-based view for security teams. Available at /dashboard. Configurable time range: 7, 14, 30, or 90 days.
KPI Summary
Patch Now
CVEs in CISA KEV catalog, sorted by Priority Score. These are actively exploited and require immediate remediation.
Priority Distribution
Bar chart showing CVE count in each Priority Score bucket: Low (0-40), Medium (40-80), High (80-120), Critical (120+).
Priority Table
All CVEs sorted by Priority Score descending. Shows severity, CVSS, EPSS, indicators (KEV/POC/FIX), and publication date. Filterable by severity, KEV, POC, or unpatched.
Oldest Unpatched CRIT/HIGH
CRITICAL and HIGH CVEs without a patch, sorted by age (days open). Highlights remediation gaps requiring attention.
Vulnerability Trends & Charts
Interactive trend analysis available at /trends. Switchable time range: 30d, 90d, YTD, All.
KPI Summary
Charts
CVEs per Day (by Severity)
Stacked area chart showing daily CVE volume split by CRITICAL, HIGH, MEDIUM, LOW. Reveals spikes and patterns in disclosure activity.
Severity Distribution
Doughnut chart showing proportion of CVEs at each severity level for the selected period.
Top CWE Weaknesses
Horizontal bar chart of the most common weakness types (CWE). Shows which vulnerability classes dominate (e.g. XSS, SQLi, buffer overflow).
EPSS vs CVSS Scatter
Bubble chart plotting CVSS score (X) vs EPSS probability (Y). Bubble size indicates KEV status. Color-coded by severity. Identifies CVEs with high exploitation likelihood but lower CVSS, or vice versa.
Vendor Trends (Monthly)
Line chart tracking CVE volume per vendor over months. Shows which vendors have increasing or decreasing vulnerability counts.
Technique Trends (Monthly)
Line chart tracking attack technique frequency over months (e.g. XSS, SQL Injection, Buffer Overflow). Reveals shifts in attack surface.
Risk Indicators Over Time
Stacked area chart of daily POC, KEV, and Patch availability counts. Shows how risk posture evolves over time.
Patch Response Time
Line chart showing monthly average days between CVE publication and patch availability. Measures industry patch velocity.
Patch Gap by Severity
Bar chart comparing average patch response time across severity levels. CRITICAL CVEs should be patched faster than LOW.
MITRE ATT&CK Tactics
Bar chart showing CVE distribution across ATT&CK tactics (Initial Access, Execution, Privilege Escalation, etc.). Maps vulnerabilities to attacker behavior.
Weekly Digest
Published every Monday at 07:00 UTC. Summarizes the previous week's vulnerability landscape.
Included in digest:
- Total CVEs published that week
- Breakdown by severity (Critical/High/Medium/Low)
- Top CVEs by Priority Score
- New KEV additions
- CVEs with public exploits (POC)
- Most affected vendors & technologies
- Week-over-week trends
Update schedule:
- New CVEs fetched every hour
- Modified CVEs updated every hour
- EPSS & KEV refreshed daily at 06:00
- Weekly digest generated Monday 07:00
ZDI Advisories
vuln.today tracks Zero Day Initiative advisories - both published and upcoming. Upcoming advisories represent vulnerabilities reported to vendors with a 120-day disclosure deadline.
Upcoming
Advisories where the vendor has been given a deadline to release a patch. These are pre-disclosure - no CVE ID yet, limited technical details.
- ZDI-CAN ID, vendor, CVSS score
- Disclosure deadline and days remaining
- Researcher attribution
- AI-generated context summary
Published
Advisories where the deadline has passed or the vendor has released a fix. Full technical details and CVE IDs are available.
- ZDI ID, linked CVE ID
- Full description and analysis
- CVSS vector breakdown
- Tags and technique classification
Advisories past their disclosure deadline where the vendor has not released a patch. These represent the highest risk - the vulnerability exists but remains unpatched.
Homepage Integration
The homepage shows two ZDI sections: a collapsible timeline with all upcoming dates (requires login to expand), and a dedicated card section showing advisories from the nearest disclosure date. Both are toggleable via the layout gear menu.
Homepage Layout Customization
Logged-in users can customize the homepage layout using the gear icon () in the stats bar. Preferences are saved to your account and persist across sessions.
Sections
Toggle visibility of major homepage sections:
- Critical Watch hero card
- Trend Chart box
- ZDI Timeline
- Weekly Report
- ICT Providers at Risk
- Vendor / Technique filters
CVE Sections
Control which CVE grouping sections are visible:
- Act Now
- Critical
- ZDI Upcoming Boxes
- High
- Medium / This Week
- Monitor
Chart Tabs & Filter Pills
Fine-grained control over individual elements:
- Chart tabs: 7-Day Trend, Attack Techniques, OWASP, Top Vendors, Trending
- Filter pills: CRITICAL, HIGH, MEDIUM, LOW, Act Now, POC, KEV, PATCH, Unpatched
Chart auto-rotation skips hidden tabs.
RSS Feeds
Public RSS feeds for integrating vuln.today into your existing tools. Available at /rss.
CVE Feed
Latest 50 published CVEs. Filterable by severity, decision label, KEV status, and POC availability.
ZDI Feed
Latest 50 ZDI advisories. Filterable by status (upcoming, published, overdue) and severity.
Both feeds support RSS 2.0 and work with Feedly, Inoreader, Slack RSS bots, SIEM connectors, and automation tools (n8n, Zapier, Make).
Stack Monitoring
Define your technology stack at /my/stack and get automatic vulnerability matching. Requires login.
- Add products with name and optional version
- System matches CVEs using CPE and NVD version ranges
- Get alerts when new CVEs affect your stack
- Scan results show matching CVEs with severity and status
- On-demand scan via API
- Automated alerts on new matches
- Version-aware matching (e.g. "nginx 1.24" vs "nginx 1.25")
- Integrates with Slack and Jira notifications
Search
Full-text search across all CVEs, tags, and vendors. Available from the search bar in the navigation.
- CVE ID (e.g. CVE-2026-1234)
- Product name and version (e.g. "nginx 1.24")
- Vendor name (e.g. "Microsoft")
- Keywords from descriptions
- CWE ID (e.g. CWE-79)
When you search with a version number, the system uses CPE data and NVD version ranges to find CVEs that actually affect your specific version - not just keyword matches.
Regulatory Compliance (NIS2 & DORA)
The /compliance module helps security teams track vulnerabilities relevant to EU regulatory frameworks – NIS2 and DORA. It surfaces CVEs that matter for compliance, tracks ICT provider risk, and provides a workflow for documenting remediation actions.
All compliance classification is purely algorithmic – based on existing CVE data (severity, CWE, tags, EPSS, KEV, patch status).
Three Tabs
What Requires Login?
- Browse Regulatory Triage – all CVEs, filters, KPIs, “Why flagged?”
- Browse ICT Providers – view all providers, categories, risk metrics
- Workflow panel – create/edit compliance actions
- My Actions tab – personal action list
- CSV audit export
- Send to Slack
- Watch / unwatch ICT providers
When Is a CVE Regulatory-Relevant?
The EU Network and Information Security Directive. A CVE is flagged as NIS2-relevant when all conditions are met:
- Severity is CRITICAL or HIGH
- Internet-facing (CWE or attack technique) OR affects a third-party ICT provider
- Evidence strength is not “weak”
Digital Operational Resilience Act – focused on financial sector ICT risk. A CVE is flagged as DORA-relevant when:
- Severity is CRITICAL or HIGH
- Affects a third-party ICT provider (matched by product tags)
Evidence Strength
Measures how confident we are that a CVE poses real-world risk. Used to filter out low-confidence NIS2 flags.
In CISA KEV, EPSS >30%, or 5+ independent sources confirming the vulnerability
Public PoC available, EPSS >5%, or 3+ independent sources
No exploitation signals, low source count – excluded from NIS2 relevance
Risk Signals
Each compliance CVE can carry one or more signal badges indicating specific risk factors:
KPI Cards
Six metrics displayed at the top of the Triage page. All count only CRITICAL and HIGH published CVEs within the selected time window (7/14/30/90 days).
Filters & Sorting
- NIS2 – only NIS2-relevant CVEs
- DORA – only DORA-relevant CVEs (ICT provider dependency)
- Both – CVEs relevant to either framework (default)
- Internet-facing – edge-exposure CVEs only
- Third-party – ICT provider CVEs only
- Exploited – KEV or PoC available
- Unpatched – no fix available
7, 14, 30, or 90 days. Controls which CVEs appear and how KPIs are calculated.
- Priority – composite Priority Score (default)
- CVSS – severity score
- EPSS – exploitation probability
- Newest – publication date
CVE Card in Triage
Each CVE in the triage list is displayed as a card with three sections:
- CVE ID (link to detail page)
- Workflow status button (logged in)
- Owner & due date preview
- AI summary or description excerpt
- NIS2 / DORA badges
- Signal badges (edge-exposure, etc.)
- Provider name badges
- KEV / PoC indicator badges
- Expandable “Why flagged?”
- CVSS – color-coded by severity
- EPSS – exploitation probability (%)
- Priority – composite score (0–235)
Compliance Actions (Workflow)
For each flagged CVE you can create a compliance action to track remediation progress. Actions are personal (per user) and accessible from both the Triage page (inline panel) and the dedicated My Actions tab.
- Owner – who is responsible (e.g. “security-team”, “devops”)
- Due date – remediation deadline (YYYY-MM-DD)
- Notes – free-text field for context, decisions, or references
- Status – workflow state (see below)
- Create/update action from inline workflow panel in Triage
- Remove action (delete) from My Actions or inline panel
- Export as CSV – includes action fields alongside CVE data (max 500 rows)
- Send to Slack – post CVE details to a configured webhook (rate limit: 10 per minute)
One action per CVE per user. Changes auto-save. Status can be updated inline via dropdown on both Triage and My Actions pages.
ICT Provider Tracking
The ICT Providers tab tracks 85+ third-party technology providers across 14 categories. This supports DORA Article 28 requirements for ICT third-party risk management.
- CVE count – published CVEs in the selected time window
- Top severity – highest severity level among those CVEs
- Patch rate – percentage of CVEs with a fix available
- KEV count – how many are actively exploited (CISA KEV)
- Watch providers relevant to your organization
- Watched providers appear in a dedicated section at the top
- Their CVEs are flagged as “third-party ICT” in Triage
- Unwatch anytime to remove from your tracked list
Provider Detail Page
Click any provider name on the ICT Providers list to open a detailed risk assessment page. The detail page answers four questions: Is this provider a problem today? Why? Which CVEs hurt? What to do?
Page sections- KPI tiles – 6 key metrics: Open CVEs, Exploited, KEV, Unpatched, No Workaround, Internet-facing
- Why risky now – narrative explanation plus signal badges with counts (KEV, Exploited, Unpatched, Mgmt Plane, Public PoC, No Workaround, Internet-facing)
- Top Risky CVEs – top 10 CVEs by priority score with decision label, severity, signals, patch status, exploitation, and recommended action
- Risk Breakdown – three-column analysis: By Exposure (internet-facing, mgmt plane, identity/auth, internal), By Exploitability (known exploited, PoC, high EPSS, remote unauth, local), By Remediation (patch available, no patch, workaround, no workaround)
- Affected Services – CVEs grouped by product/service family within the provider (collapsible sections)
- Recommended Actions – algorithmically generated checklist based on risk data (rule-based)
- CSV Export – download all provider CVEs as CSV for audit evidence (requires login)
Watched providers can be classified as Critical, Important, or Standard – a per-user setting that reflects how essential this provider is to your organization.
ICT Providers at Risk (Homepage)
When providers have active risk signals, a compact “ICT Providers at Risk” box appears on the homepage below Critical Watch. It shows the top 4 most impacted providers with their KEV count, unpatched CVEs, and internet-facing exposure. Clicking a provider opens the detail page.
Visible to all users (no login required). Appears only when at least one provider has KEV, unpatched CRITICAL/HIGH, or exploited CVEs in the last 30 days.
CSV Audit Export
Export filtered compliance data as a CSV file (up to 500 rows) for audit documentation or import into GRC tools. Available from the Triage page (requires login).