About EVULNABLE
What this site is, who runs it, where its numbers come from, and what it is not.
What this is
EVULNABLE answers one question: of everything that is broken, what should you fix first?
Severity alone does not answer it. A CVSS 9.8 with no known exploitation signal may be less urgent than a 7.5 confirmed in active ransomware campaigns, and a list sorted by severity puts them the wrong way round. So this site combines confirmed exploitation, CISA's Known Exploited Vulnerabilities catalog, FIRST's EPSS probabilities, published CVSS and vendor advisories into one ranking, and shows its working on every entry.
Who runs it
EVULNABLE is independently operated. It is not affiliated with, sponsored by, or paid by any vendor it covers — not the scanner vendors compared on this site, not the penetration-testing firms, and not the vendors whose advisories it ranks. Nothing on this site is a paid placement, and there is no advertising.
That matters most on the two comparison pages, where a ranking is worth nothing if the ranker is being paid by one of the entries. Where a judgment is EVULNABLE's own rather than a vendor's published fact, those pages label it as such.
Reach a person at [email protected]. See Contact for reporting wrong data or requesting a correction.
How current the numbers are
Every figure is fetched from the source that publishes it, and every page carries the time its data was fetched:
| Source | What it provides |
|---|---|
| CISA KEV | Confirmed exploitation, ransomware association, federal remediation deadlines |
| Microsoft MSRC | The monthly Patch Tuesday release |
| FIRST EPSS | Exploitation probability and percentile |
| NIST NVD | CVE records and CVSS, on demand for search and enrichment |
| Vendor advisories | Cisco, Red Hat, Chrome, Ubuntu, Debian, Adobe, Oracle, Ivanti, Apple |
| CyberSecurityTracker.ai | Fixed versions and vendor required actions, used by CVE search |
| Check Point Research | Per-CVE threat research coverage — title, date and link only, shown on CVE pages |
| endoflife.date | Microsoft end-of-life, end-of-support and ESU milestones |
| CVE Program (cve.org) | The CVSS score assigned by a CVE's own CNA, labeled as the CNA's and used only while NVD has not scored a KEV entry; which CNA assigned it |
| ENISA EUVD | The EU vulnerability database's record of a CVE: base score, its version and the assigner it lists. Shown on CVE Lookup only, not used in EVRS |
| GitHub Advisory Database | Per-CVE advisory cross-reference on CVE Lookup: identifier, summary and affected package ecosystems. Not used in EVRS |
| CERT-EU security advisories | Advisory titles and dates on the vulnerability news page, each linked to CERT-EU's own publication. Not used in EVRS |
| VulnCheck KEV | Known-exploited flag on CVE Lookup for CVEs VulnCheck lists and CISA KEV does not. Not used in EVRS, not included in exports |
| Rapid7 Metasploit | Whether a public Metasploit module exists for a CVE. Shown on CVE Lookup only, not used in EVRS |
| Shodan | Open ports and services in the Domain Security Check. Opt-in, single domain only, not used in EVRS |
| SSLMate Certificate Search | Certificate Transparency data from SSLMate Certificate Search: the unexpired certificates logged for a domain, in the Domain Security Check. Opt-in, single domain only, not used in EVRS |
| RDAP registration data | Registrar, registration state, created and expiry dates and registrar status in the Domain Security Check, read from each top-level domain's own registry. The registry is found through the IANA RDAP bootstrap registry; rdap.org is the fallback when a registry's own endpoint does not answer |
| Vendor comparisons | Platform and pen-test vendor research |
Nothing is estimated to fill a gap: an absent number is shown as absent, which is the difference between “checked, and it is not exploited” and “nobody has said”.
What this is not
- Not a replacement for your scanner. EVULNABLE has no idea what you run or how it is exposed. It ranks vulnerabilities, not your vulnerabilities.
- Not an authority on any CVE. Every record links back to the organization that published it. Where EVULNABLE and NVD disagree, NVD is the record and this is an opinion about urgency.
- Not a service with an SLA. EVULNABLE provides these public vulnerability-intelligence tools without an SLA: there is no uptime guarantee and no support contract for them. Commercial EVULNABLE services and customer environments are governed by their applicable service agreements.
- Not somewhere to put regulated data. EVULNABLE does not accept scan files. See Privacy and data handling for exactly what the site does with a search term or a domain, and decide from that rather than from this sentence.
How the score works
The EVULNABLE Risk Score, what it weighs, and why an entry can rank above a higher CVSS are all set out on the Methodology page, including the cases where the score deliberately abstains rather than guesses.