Which of these are attackers actually using?
Paste a vulnerability scan, an advisory, or a plain list of CVE identifiers. We check each one against CISA's known-exploited catalogue, ransomware campaign links, and EPSS exploitation probability, then rank by evidence rather than by CVSS. Most high-severity vulnerabilities are never exploited, so a list sorted by severity buries the few that are.
Why not just sort by CVSS?
CVSS describes how bad a vulnerability would be if someone exploited it. It says nothing about whether anyone has. Only a small fraction of published CVEs are ever exploited in the wild, so a queue sorted by CVSS spends most of its effort on vulnerabilities nobody is attacking, while a mid-scoring one under active exploitation waits behind them.
What the three signals mean
CISA KEV is a catalogue of vulnerabilities confirmed exploited in the wild. If something is on it, the argument about whether it is theoretical is over. Entries flagged as ransomware-linked have been used in ransomware campaigns specifically, which is the strongest reason to move first.
EPSS is a probability, updated daily, that a vulnerability will be exploited in the next 30 days. It is useful for the ones KEV has not caught up with. A score of 0.10 means a one-in-ten chance, which is far above the median.
CVSS still matters, but as a tie-breaker rather than the sort key.
Which ones are on your own systems
Sign in and this tool also tells you which of the CVEs you pasted were observed on hosts belonging to the domains you monitor, and names them. That turns "this is being exploited somewhere" into "this is being exploited and you are running it", which is the difference between a newsletter and a work queue. See plans.
Related free tools
Trending CVEs · SSL security grader · Phishing & reputation scan · Credential exposure check · Ransomware leak-site lookup