Methodology & About

CVERadar tracks vulnerabilities that matter to defenders: ones attackers are known to exploit, ones with public exploit code, plus new critical CVEs as NVD publishes them. It is built and maintained by LayerLogix, a managed IT and cybersecurity provider in Texas.

How the top 100 is chosen

CISA KEV entries ranked by FIRST EPSS score (desc), ties broken by KEV dateAdded (most recent first) then CVE id. Snapshot taken 2026-10-21.

1. Start from every CVE in the CISA Known Exploited Vulnerabilities (KEV) catalog, so every entry has confirmed exploitation in the wild.
2. Rank by the FIRST EPSS probability of exploitation activity in the next 30 days (highest first).
3. Break ties by the KEV date added (newest first), then CVE id.

EPSS is refreshed on every update, so the scores shown can move after the snapshot; the top 100 list itself is re-ranked only when the seed is re-run.

Which CVEs are on the site

A CVE enters CVERadar when, within the last two years (730 days), it is exploited in the wild or has public exploit code:

• Exploited in the wild: added to the CISA KEV catalog or to VulnCheck KEV in the window (date added).
• Metasploit module: an exploit or auxiliary module in the Rapid7 Metasploit Framework references the CVE, with a module disclosure date in the window.
• Exploit-DB: an Exploit-DB entry lists the CVE, published in the window.
• Public PoC: proof-of-concept repositories on GitHub (from the nomi-sec/PoC-in-GitHub dataset), first seen in the window and meeting the quality bar below.

Only CISA KEV and VulnCheck KEV are described as "exploited in the wild". Metasploit, Exploit-DB and GitHub PoCs mean exploit code is public, which is a strong signal but not proof of attacks. Each CVE page shows every source with its date, and the earliest date across sources as first exploit evidence seen. New CVEs are stamped with the date they appeared; CVEs added by a backfill keep their real date (KEV date added, else first exploit evidence, else NVD publication), so old evidence never shows up as today's news.

The site also posts new CVSS v3 CRITICAL CVEs as NVD publishes them, and refreshes EPSS, KEV status and exploitation evidence for every CVE on each update.

GitHub PoC quality bar

Public PoC repositories are noisy: many are empty, copies, scanners or fakes, and some carry malware. A CVE counts as having a public PoC only when its repositories (forks and archived repositories excluded) include one with at least 10 stars, or come from at least 3 different GitHub accounts. Several repositories from one account count once. CVERadar never links to PoC code without a "verify before running" warning, and PoC-only CVEs get a lighter page (no game board) to keep the site fast.

Fix guides

When a CVE newly shows exploitation in the wild, a Metasploit module or an Exploit-DB entry (not PoC-only), the blog gets a step-by-step fix guide at /blog/<cve-id>/. Guides are built from the sourced data only: fixed versions come from NVD CPE data, links from vendor-tagged NVD references and CISA KEV notes, and commands are limited to checking the installed version, applying the vendor update and generic hunting steps. When no fixed version is published, the guide says to apply the latest vendor update and links the advisory; it never guesses a version or patch number.

Threat level

A 0-100 score for the game meter: CVSS/10 × 50 + EPSS × 30 + exploitation points + 5 if known ransomware use, capped at 100 (CVSS defaults to 5 when missing). Exploitation points use the strongest evidence only: 15 exploited in the wild (CISA KEV or VulnCheck KEV), 10 Metasploit module, 7 Exploit-DB entry, 4 public PoC meeting the quality bar. It is a CVERadar convenience score, not an official rating.

MITRE ATT&CK mappings

• CTID-mapped (solid cards, green label): from the MITRE Center for Threat-Informed Defense Mappings Explorer KEV dataset (kev-07.28.2025, ATT&CK 16.1). These include the mapper's comments.
• Inferred (dashed cards, amber label): when no CTID mapping exists, CVERadar infers likely techniques from the CWE and from description keywords (e.g. CWE-78 OS command injection → T1190 + T1059). These are heuristics and are labelled as such on every page.
• Technique names, tactics and mitigations come from MITRE ATT&CK Enterprise STIX data v20.0.

Defend the Chain (the game)

Each CVE page lays its techniques across the ATT&CK tactics. Pick a technique, then choose a defence. Correct answers are the ATT&CK mitigations MITRE links to that technique (plus "apply the vendor fix" for exploitation techniques); wrong answers are real mitigations for other techniques. Correct picks lower the threat meter and earn XP; wrong picks raise the threat. It works with keyboard and screen readers, and animations stop when your system asks for reduced motion.

Remediation

Fix guidance comes from the CISA KEV required action, fixed versions derived from NVD CPE data, and NVD references tagged Patch, Vendor Advisory or Mitigation. Anything not specific to the CVE is labelled Generic guidance. Always confirm against the vendor advisory before acting.

Machine-readable feed

Every CVE on the site is also published as JSON at /data/exploited.json (schema 1, sorted by CVE id): severity, CVSS, EPSS, KEV dates and ransomware flag, in-the-wild sources, Metasploit module names, Exploit-DB ids, PoC counts, first exploit evidence date, threat level, ATT&CK technique ids and fixed versions, refreshed with each data update. New fields may be added; a breaking change bumps the schema number.

Data sources

• CISA KEV catalog (version 2026.10.23)
• VulnCheck KEV via the VulnCheck community API (enabled once an API token is configured)
• Exploit-DB by OffSec (public files_exploits.csv from the official GitLab repository)
• Rapid7 Metasploit Framework module metadata (db/modules_metadata_base.json)
• GitHub proof-of-concept repository data from nomi-sec/PoC-in-GitHub
• NIST National Vulnerability Database CVE API 2.0. This product uses data from the NVD API but is not endorsed or certified by the NVD.
• FIRST Exploit Prediction Scoring System (EPSS) API
• MITRE ATT&CK® and MITRE CTID Mappings Explorer

Last data update: 2026-10-25T04:32:13.713Z

Exploitation window since 2024-10-25: CISA KEV 555, VulnCheck KEV 0, Metasploit 238, Exploit-DB 511, public PoC 761 CVEs (a CVE can appear under several sources).