How the cve.now Index works

What the Index ranks

The Index ranks the evidence that a CVE is being attacked, or can be attacked, now; it does not rank the worst damage a bug could do. A score rises with evidence: CISA or EPSS seeing exploitation, a working public exploit, a default setup reachable without a login, and software installed almost everywhere. Missing data is a gap, not a sign of safety: a part with no evidence scores 0, so a severe bug ranks low until its evidence is public. For example, CVE-2026-98432, a remote, unauthenticated use-after-free in the Linux kernel's IPv4 TCP code with a published remote code execution exploit, rated CVSS 9.8, scored 59 under version 2 and 69 under version 3 (as of November 3, 2026): its exploit counts as a public exploit (22 of 40), since it is not in CISA KEV, CISA has not rated it and its EPSS is under 1%.

The score

Every CVE gets a score from 0 to 100, the sum of five parts. Within a part only the strongest signal counts, so near-duplicate evidence (a KEV listing and an exploited-in-the-wild rating) does not stack. Exploitation carries the most weight because it is the best predictor of harm; CVSS is weighted low on purpose, since most CVEs are rated high.

Inputs and sources

• CISA Known Exploited Vulnerabilities catalog and CISA's SSVC decisions (exploitation, automatable, technical impact)
• FIRST EPSS, recorded when a CVE's exploitation probability first reaches 10%
• Public exploits: Exploit-DB, Metasploit modules, Nuclei templates and GitHub proof-of-concept repositories classified as working exploits
• CVSS from NVD, GitHub and CNA records; affected products, packages and fixed versions from the CVE List, OSV and GitHub advisories
• Package popularity: weekly downloads from npm, PyPI and crates.io, and dependent counts from Google's deps.dev (npm, PyPI, Go, Maven, crates.io, NuGet), refreshed weekly
• cve.now's advisory context: whether default setups are affected, and who can reach the bug

Exploit evidence: sources and detection

Each exploitation tier comes from a source cve.now reads on a schedule, detected this way:

• CISA KEV: the CVE is in the Known Exploited Vulnerabilities catalog.
• CISA SSVC: the Exploitation decision (active or poc) in CISA's Vulnrichment entry on the CVE record.
• Metasploit: a module in the Metasploit Framework repository lists the CVE in its references.
• Nuclei: a template in ProjectDiscovery's nuclei-templates repository is named for the CVE. cve.now records only that the template exists, not what it checks, so it counts as detection evidence: a template alone scores 10, and a template next to public exploit code scores 28, two independent public sources targeting the same bug.
• Exploit-DB: its index lists the CVE for an exploit. Its "verified" flag is not used: Exploit-DB has verified almost no exploits since 2020, so the flag no longer separates working exploits from untested ones.
• GitHub: PoC-in-GitHub lists a repository for the CVE. A repository counts as an exploit only when it is not a fork, its name or description says exploit, proof of concept or RCE, and it is not a scanner, checker, patch or mitigation tool; other repositories score nothing.
• FIRST EPSS: the day a CVE's exploitation probability first reaches 10%.
• Reference types are not scored on their own: a CVE record's "exploit" tag carries no review, and cve.now tags the exploits above the same way.

Two tiers are defined but not scored until a reliable source exists:

• Attacks seen outside CISA (35). Detection: VulnCheck KEV listing the CVE, a GreyNoise or Shadowserver tag naming it, or a vendor advisory that says exploitation was detected. Source: None yet: VulnCheck and GreyNoise need accounts and API keys, and vendor wording needs a checked quote like the advisory context.
• Working exploit described by a credible researcher (28). Detection: An oss-security post, a ZDI advisory, or a vendor or researcher write-up, linked from the CVE record, that says the exploit works and quotes how far it gets (for example remote code execution). Source: None yet: the CVE record's ADP references (where the oss-security links live) are not read today, and a link alone does not say the exploit works.

The boards

The week, month and year boards rank CVEs published or escalated in the last 7, 30 or 365 days. An escalation is being added to KEV, a public exploit appearing, or EPSS crossing 10%, so an older CVE can top this week's board. Boards are rebuilt by a scheduled job, and the technology and ecosystem filters rank within the same pool.

The all-time board is the hall of fame: every CVE the boards have scored, of any age, ranked by score alone. Beyond the past year's pool it includes every CVE ever listed in CISA KEV or with a Metasploit module.

Views

Rankings has three views of the same pool of CVEs. Exploited now is the cve.now Index above: it rewards confirmed exploitation, so CVEs in CISA KEV lead it. Worst case ranks what a CVE could do once exploited, without waiting for CISA. Trending ranks the CVEs gaining the most attention. Weekly archives, share cards and posts use Exploited now.

Worst case

Worst case ranks the same week, month, year and all-time pools by a score from 0 to 100:

100 × severity × (½ + ½ reach) × (½ + ½ exposure) × exploit maturity

• Severity, reach and exposure are the Index parts of the same names, each as a share of its maximum, so they follow any change to the Index.
• Exposure is read the worst way the facts allow: CISA's KEV and exploitation status are not needed, attacker details the advisory leaves unclear come from the CVSS vector, an unknown setup counts as default, and a bug reachable over the network with no login or user action counts as automatable unless CISA says otherwise. It is never lower than the Index's exposure.
• Exploit maturity is 1 when exploit code is public (Exploit-DB, Metasploit, a GitHub repo recorded as exploit code, KEV or CISA active exploitation), 0.8 for a proof of concept only (other GitHub PoC repos, a Nuclei template or CISA's PoC rating) and 0.6 with none.

Missing reach or exposure halves the score rather than zeroing it, so a severe bug with little known reach still ranks below one that hits everything. Ties go to the Index score.

Trending

Trending sorts every CVE the boards score, of any age, by new attention in the last 7 or 30 days. It is a sort, not a score: each row keeps its Index score, and attention never adds points. The sort adds up:

• New GitHub PoC repos: repos the sync first saw in the window, or growth in the repo count between scheduled runs, whichever is larger.
• New references added to the record in the window.
• The EPSS rise over the window, in whole percentage points, read from FIRST. CVEs listed above 10% today and the CVEs most likely to be moving are compared with their score at the start of the window.

Ties go to the total number of PoC repos, then the Index score. Growth is dated by the run that first sees it, so it starts counting when this view went live.

Provisional scores

A score is provisional for the first 72 hours after publication, and whenever an entry has neither advisory context nor a CISA SSVC decision. EPSS and exploit data often lag new CVEs by a day or more, so provisional scores usually rise.

Calibration

Each methodology version is checked against well-known CVEs, which should rank near the top of their year:

• CVE-2021-44228 (Log4Shell)
• CVE-2023-4966 (Citrix Bleed)
• CVE-2023-34362 (MOVEit Transfer)
• CVE-2024-3094 (xz backdoor)
• CVE-2024-6387 (regreSSHion)
• CVE-2024-5751 (LiteLLM remote code execution)
• CVE-2025-29927 (Next.js middleware bypass)
• CVE-2025-55182 (React Server Components remote code execution)

Known limitations

• Package popularity covers registry packages only. Software installed outside a package registry (appliances, operating systems, hosted products) still scores reach from the tracked technologies, graded by a small install-base table cve.now keeps in its code rather than measured install counts, and from Linux distributions, and RubyGems, Packagist and other registries without download or dependent stats score the major-ecosystem credit. deps.dev counts the packages that depend on a package's newest version, so a library most projects pin to an older line shows fewer dependents than it has.
• Exposure depends on advisory context. Without it, or when it cannot tell whether default setups are affected, the score falls back to the CVSS vector, which cannot tell a default setup from an unusual one.
• Exploit sources cover public exploits only. Private exploitation shows up only once CISA or EPSS reflects it.
• The score ranks CVEs, never vendors or companies.

Version history

• Version 1: exploitation 40, exposure 25, reach 20, severity 10, no patch 5.
• Version 2: reach also counts package popularity (weekly downloads and deps.dev dependents); the strongest reach claim counts.
• Version 3: the Index ranks evidence of attacks, not worst-case damage. Exposure reads the CVSS vector whenever advisory context is missing, cannot tell whether default setups are affected, or leaves who can reach the bug blank, so context never lowers a score. A public exploit with a Nuclei template scores 28, between a public exploit (22) and a Metasploit module (30), and the researcher write-up and outside-CISA tiers are defined for later. Reach grades tracked technologies by install base (20, 17 or 14) instead of giving each 20, and counts glibc.