What's exploited and loud this week

How the radar is read

Coverage, up

How loud the security press is about the CVE. Every story counts, secondary outlets count less than primary sources, and every mention fades with a 7-day half-life. Plotted as a percentile among the CVEs on the radar that have any coverage: halfway up means louder than half of them. CVEs no one wrote about sit in the hatched strip at the base; they are here for their exploitation alone.

Exploitation, across

How real the exploitation is, not only how likely. From the right: in CISA KEV (confirmed exploited, the one fact in magenta), exploitation reported by the news, a public PoC reported by the news, and otherwise the EPSS probability. The key and the axis show only the steps present this week. Within a step, cells spread across a band so they don't stack: higher EPSS leans right, the rest is only spacing. A CVE with EPSS alone is never counted as exploited, however likely: it sits on the left half, on a square-root scale so the many low values stay apart. A cell's colour is its level: magenta for KEV, the ramp for EPSS, which never reaches magenta.

Held back for now

The exploit flag in CVE records counts vendor statements such as "not aware of any public exploit" as exploits, so it places no cell until that data is fixed. A PoC counts only when the news reports one.

What makes the radar

About 70% of the cells are CVEs in the news; the rest are the most exploited of everything else, including ones nobody is writing about yet. Replaying July and August, news coverage and reported exploitation were the strongest early signals: this selection caught about 7 in 10 of the CVEs CISA added to KEV the following month.

Act-now order

The fused threat score: a weighted sum of signals, each fading over time. Exploitation weighs most and fades slowly (a KEV listing and reported exploitation ×3, a first exploit or Metasploit module ×2, a PoC, scanner template or EPSS jump ×1; 90-day half-life). News attention (7 days) and interest on cve.tools, meaning views, searches and explainer requests (14 days) and watches (30 days), add on top.