Where the data comes from
We use primary sources only — the organisation that publishes the fact, not an aggregator that republishes it. Today that means:
- Exploited vulnerabilities — the CISA Known Exploited Vulnerabilities catalog, fetched from its official JSON feed. Currently 1,661 entries, last verified August 6, 2026.
- Severity scores — the NVD 2.0 API, for CVSS v3.1 base scores.
How often we check
The KEV catalog is refetched twice a day and the NVD feed once a day. Each page shows its own last verified timestamp and its next scheduled check. Those are not decorative — they are written by the job that did the fetching.
What happens when a fetch fails
This is the part most sites get wrong, so it is worth stating plainly.
When a source is unreachable, we keep the previous data and its original verified date. We do not restamp it. The page visibly goes stale rather than showing old data behind a fresh-looking timestamp.
- Past its freshness budget, a page's status indicator turns amber.
- Past twice that budget, the page carries a visible banner telling you so.
- Three consecutive failures raise an alert to a human.
The fetcher also refuses any response that shrinks the catalog by more than 10%, because that means a truncated or malformed payload rather than a real change.
Facts live in exactly one place
If a number appears on several pages, all of them read it from the same file. The entry count on the homepage, the tracker index and the tracker page are the same variable, not three copies that can drift apart.
What is automated and what is not
Data is written by scheduled jobs. Judgement is not. A confidence rating — confirmed, expected, rumoured or disputed — is set by a person, and no automated job is permitted to overwrite it.
Descriptions on CVE pages are CISA's own words, attributed as such. Where we add interpretation, we say so.
Corrections
If something here is wrong, tell us and we will check it against the source. Every data page has a Report an error link. Corrections to a tracked fact are recorded in that page's change log rather than quietly edited.
What we do not do
- We do not accept payment for placement in any ranking.
- We do not publish a date or a figure without a source link.
- We do not present a vendor's claim as an independent finding.
- Tools run in your browser. We do not collect what you type into them.