CVE intelligencepages

Type a CVE identifier, vendor or product into the search box and the list filters as you type. The box also takes a query language, so a question can be asked precisely: vendor:cisco has:exploit -has:rule finds Cisco CVEs with public exploit code and no detection rule yet, epss:>90 -has:kev finds high-probability CVEs that CISA has not listed, and severity:critical actors:>=2 finds critical records attributed to more than one group. The example chips under the box are live queries — click one to run it.

They answer three different questions. CISA KEV is a statement of fact: this vulnerability has been exploited against real targets, and federal agencies have a remediation deadline for it. EPSS, from FIRST, is a probability that exploitation will be observed in the next 30 days — a forecast, not an observation. CISA's SSVC assessment is a stakeholder decision, not a severity score: it records exploitation status, whether an attack can be automated, and the technical impact. Each CVE page shows all three side by side, with the source named, so a reader can see when they disagree.

The NVD and MITRE records are the authoritative registry: identifier, description, scores, affected versions. CVE Radar keeps those and adds the evidence around them — public exploit repositories, exploit probability history, KEV listing and due dates, ransomware association, named threat actors, vendor remediation text, references, and the reporting that mentions the CVE. Every field on a page names where it came from, so the enrichment can be traced rather than trusted.

News polls public security outlets and links each story to the CVE identifiers it names, alongside proof-of-concept repositories filed against a CVE and posts discussing it — so a headline and the vulnerability record it is about are one click apart. Trends works from the whole published catalog rather than only the written-up pages: monthly publication volume, how quickly entries are added to the KEV catalog, and vendor, weakness and product rankings over the last twelve months.

It is free and needs no account, no card and nothing installed — every page, including the dashboards, is public. Continuous monitoring of the CVEs that affect your own assets, alerting and workflow integration are part of the SOCRadar platform.