Method

Priority labels

Every published page gets one label: Act now, High, or Watch. The label is computed from stored fields. If the stored label does not match this rule, the build fails.

Act now if the primary CVE is in the CISA Known Exploited Vulnerabilities catalog on the dated snapshot we store, or if the page records confirmed in-the-wild exploitation (the exploited field is true).

High if the page is not Act now, and any of these hold: the page records sourced exploitation attempts only; the stored CVSS base score is 9.0 or higher; the stored EPSS percentile is 90 or higher.

Watch if none of those hold. Internet-exposure figures appear in the block when a public figure is already on the page. They do not change the label.

How scores are sourced

CVSS is taken from the NVD CVE 2.0 API. If NVD published its own score, that is the score we store and we label the scorer NVD. If NVD only republishes a CNA metric, we store that metric and label the scorer CNA. The source date is the calendar day of the NVD lastModified field. The checked date is the day we fetched the record.

EPSS is taken from the FIRST EPSS API at api.first.org/data/v1/epss. We store the score, the percentile, and the model date the API returns. If the API has no entry, the page shows No EPSS score yet. We do not fill a number.

KEV status, dateAdded, and dueDate come from the CISA KEV JSON catalog. We store the catalogVersion of the snapshot we fetched. If the primary CVE is not in that catalog, the block says Not listed and keeps the checked date.

Confirmed versus vendor-claimed

Confirmed exploitation means the page exploited field is true: the CVE is in CISA KEV, or a vendor or government source stated in-the-wild compromise. That is the Act now path.

Sourced attempts means exploited is attempts: public reports of exploit attempts or scanning, without a confirmed compromise on this page. That is a High input, not Act now.

Vendor-claimed not-affected, under investigation, and none currently known affected stay on impact rows and require a vendor statement object. They are not priority inputs. Until a statement exists, the row stays no-statement-yet.

Detection coverage and tested status

The coverage table has one row each for Sigma, Splunk SPL, Microsoft Sentinel KQL, Elastic, Suricata, and YARA. Available means this page already publishes a rule in that format. Tested means at least one of those rules has a public source that states the rule was validated. We do not invent tested status.

Rules we write (origin vuln2shell) stay Untested, including any conversion of a CC0 rule we already publish, which is labelled Converted, untested. We do not publish new detection rules on this site except those conversions.

Each page also offers machine-readable feeds: the full page as JSON, IOCs already on the page as CSV, and a STIX 2.1 bundle with a vulnerability object, indicators from those IOCs, and references. Feeds include only what the page already states.

Corrections

Email hello@vuln2shell.com with the page name and a public source link we can open. That is the bar for a wrong score, date, KEV row, exploitation label, or detection tested mark.

When a correction is accepted, it is dated in that page's What changed box. We only use public sources. We do not accept or publish exploit code.