HOW IT WORKS

Every vulnerability scanner you own rates almost everything critical. This one asks a sharper question: “is anyone actually exploiting it?”

RANKED BY WHAT IS HAPPENING

These two are in the database right now. Sorted by CVSS, the first one leads. Sorted by what is being exploited today, the second one leads — by a wide margin.

39ELEVATED

CVE-2026-19478

GitLab has remediated an issue in GitLab CE/EE affecting all versions

CVSS: 9.4
EPSS: 60.2%
RANSOMWARE: no

Severe on paper. Quiet in the wild.

96CODE RED

CVE-2019-7481

SonicWall SMA100

CVSS: 7.5
EPSS: 99.9%
RANSOMWARE: YES

Mid-range severity. Everybody is using it.

THREE SIGNALS, IN ORDER OF HONESTY

The score is 0–100, built from three public sources. They are weighted by how much each one actually tells you about your Tuesday.

CISA KEV

Is it already happening?+40, plus 10 more for ransomware

CISA's Known Exploited Vulnerabilities catalogue lists what has been seen in use against real targets. Observed, in the wild, on the record. It is the single strongest thing anyone can say about a vulnerability, so it outweighs everything else here combined.

EPSS

How likely is it to start?up to +25

FIRST.org's Exploit Prediction Scoring System gives the probability a vulnerability will be exploited in the next 30 days, trained on what actually got exploited historically. It is the best available answer to “should I worry about this one yet”.

CVSS

How bad would it be?up to +15, plus 10 for reachability

The severity score every scanner already shows you. It describes the worst case, and the two signals above describe what is likely — which is why they carry more of the weight here. Network-reachable, no-auth, no-interaction adds a little more.

WHAT THE NUMBER MEANS

0–19STEADYIt's Tuesday.
20–39ELEVATEDBacklog it.
40–59RACINGThis one's on the roadmap now.
60–79SPIKINGCancel your afternoon.
80–94CRITICALCancel your weekend.
95–100CODE REDWake people up.

Everything in CISA KEV starts at 48, because confirmed exploitation alone is worth most of the range. The lower two bands belong to vulnerabilities still waiting on evidence of use.

AND THEN A HUMAN OVERRULES IT

The maths opens the question and a person closes it. Anything published here has been read by someone who can drag the marker wherever they think it belongs — and when they do, the meter says so, in the open, with a HAND‑TUNED mark. A pre-auth flaw in something that fronts your whole estate can deserve 80 on the day it drops, weeks before it reaches any catalogue.

That is the difference between this and a feed. The machine watches 1749 vulnerabilities so you can read three. The short list is short because somebody decided it should be.