Which of these are attackers actually using?
Paste a vulnerability scan, an advisory, or a plain list of CVE identifiers. We check each one against CISA's known-exploited catalogue, reviewed exploitation reports, ransomware links, and EPSS probability. Results identify the evidence behind each priority.
Why not just sort by CVSS?
CVSS describes how bad a vulnerability would be if someone exploited it. It says nothing about whether anyone has. Only a small fraction of published CVEs are ever exploited in the wild, so a queue sorted by CVSS spends most of its effort on vulnerabilities nobody is attacking, while a mid-scoring one under active exploitation waits behind them.
What the signals mean
CISA KEV is a catalogue of vulnerabilities confirmed exploited in the wild. If something is on it, the argument about whether it is theoretical is over. Entries flagged as ransomware-linked have been used in ransomware campaigns specifically, which is the strongest reason to move first.
Reviewed reports can identify exploitation before a CVE enters KEV. Confirmed exploitation, observed attempts and possible exploitation retain separate labels. We name the source and report date separately from CISA membership. A public proof of concept alone is not evidence of attacks.
EPSS is a probability, updated daily, that a vulnerability will be exploited in the next 30 days. It is useful for the ones KEV has not caught up with. A score of 0.10 means a one-in-ten chance, which is far above the median.
CVSS still matters, but as a tie-breaker rather than the sort key.
Which ones are on your own systems
Sign in and this tool also tells you which of the CVEs you pasted were observed on hosts belonging to the domains you monitor, and names them. A provider match is a reason to check the product, version and configuration. It does not establish that your system is vulnerable or compromised. See plans.
Related free tools
Trending CVEs · SSL security grader · Phishing & reputation scan · Credential exposure check · Ransomware leak-site lookup