Skip to main content
cve.nowby Sazabi
Leaderboard

How the cve.now Index works

Methodology version 2. A fixed formula, run on the data on each entry page, with no hand-picked rankings.

The score

Every CVE gets a score from 0 to 100, the sum of five parts. Within a part only the strongest signal counts, so near-duplicate evidence (a KEV listing and an exploited-in-the-wild rating) does not stack. Exploitation carries the most weight because it is the best predictor of harm; CVSS is weighted low on purpose, since most CVEs are rated high.

Exploitationup to 40

  • 40Listed in CISA's Known Exploited Vulnerabilities catalog
  • 35CISA rates exploitation as active
  • 30Metasploit module published
  • 22Public exploit on Exploit-DB or GitHub
  • 20EPSS exploitation probability reached 10%
  • 15CISA rates a proof of concept as public
  • 10Nuclei detection template published

Exposureup to 25

  • 15Exploited in the wild, or vulnerable in default setups
  • 10No login or user action needed per the CVSS vector, when no advisory context exists
  • 5Vulnerable only in specific setups
  • +10Plus: CISA rates exploitation automatable
  • +7Plus: reachable over the network without a login
  • +3Plus: reachable over the network with a login

Reachup to 20

  • 20Affects one of the technologies cve.now tracks
  • 20Affected package downloaded 10M+ times a week, or with 100k+ dependents
  • 161M+ downloads a week, or 10k+ dependents
  • 12100k+ downloads a week, or 1k+ dependents
  • 810k+ downloads a week, or 100+ dependents
  • 10Affects a package in a major ecosystem (npm, PyPI, Go, Maven, crates.io and others)
  • 10Shipped in major Linux distributions

Severityup to 10

  • 0–10CVSS base score (0 to 10), or the source's stated rating when there is no score
  • +1Plus: CISA rates the technical impact total

No patchup to 5

  • 5No fixed version listed by any source

Inputs and sources

  • CISA Known Exploited Vulnerabilities catalog and CISA's SSVC decisions (exploitation, automatable, technical impact)
  • FIRST EPSS, recorded when a CVE's exploitation probability first reaches 10%
  • Public exploits: Exploit-DB, Metasploit modules, Nuclei templates and GitHub proof-of-concept repositories classified as working exploits
  • CVSS from NVD, GitHub and CNA records; affected products, packages and fixed versions from the CVE List, OSV and GitHub advisories
  • Package popularity: weekly downloads from npm, PyPI and crates.io, and dependent counts from Google's deps.dev (npm, PyPI, Go, Maven, crates.io, NuGet), refreshed weekly
  • cve.now's advisory context: whether default setups are affected, and who can reach the bug

The boards

The week, month and year boards rank CVEs published or escalated in the last 7, 30 or 365 days. An escalation is being added to KEV, a public exploit appearing, or EPSS crossing 10%, so an older CVE can top this week's board. Boards are rebuilt by a scheduled job, and the technology and ecosystem filters rank within the same pool.

The all-time board is the hall of fame: every CVE the boards have scored, of any age, ranked by score alone. Beyond the past year's pool it includes every CVE ever listed in CISA KEV or with a Metasploit module.

Provisional scores

A score is provisional for the first 72 hours after publication, and whenever an entry has neither advisory context nor a CISA SSVC decision. EPSS and exploit data often lag new CVEs by a day or more, so provisional scores usually rise.

Calibration

Each methodology version is checked against well-known CVEs, which should rank near the top of their year:

Known limitations

  • Package popularity covers registry packages only. Software installed outside a package registry (appliances, operating systems, hosted products) still scores reach from the tracked technologies and Linux distributions, and RubyGems, Packagist and other registries without download or dependent stats score the major-ecosystem credit. deps.dev counts the packages that depend on a package's newest version, so a library most projects pin to an older line shows fewer dependents than it has.
  • Exposure depends on advisory context. Without it, the score falls back to the CVSS vector, which cannot tell a default setup from an unusual one.
  • Exploit sources cover public exploits only. Private exploitation shows up only once CISA or EPSS reflects it.
  • The score ranks CVEs, never vendors or companies.

Version history

  • Version 1: exploitation 40, exposure 25, reach 20, severity 10, no patch 5.
  • Version 2: reach also counts package popularity (weekly downloads and deps.dev dependents); the strongest reach claim counts.