Tools and sites
Latest vulnerabilities
Actively exploited vulnerabilities, the most recent critical CVEs and CERT-FR advisories. Each CVE links to its detailed NVD entry.
Actively exploited (CISA KEV)
CISA's Known Exploited Vulnerabilities catalogue only lists flaws that attackers have really exploited: it is the list to fix first.
Recent critical CVEs (NVD)
Recently published vulnerabilities with a critical CVSS v3 score (9.0 to 10). Not all are exploited: cross-check with the list above.
CERT-FR advisories and alerts
Advisories report vulnerabilities and their fixes; alerts are reserved for serious, immediate threats. Titles stay in French, as published by CERT-FR.
Reading and prioritising a vulnerability
| Indicator | What it tells you |
|---|---|
| CVE | Unique identifier of a public vulnerability (CVE-year-number), assigned through cve.org. |
| CVSS | Technical severity from 0 to 10. See the Reference frameworks cheat sheet. |
| KEV | Real-world exploitation observed: the highest priority, whatever the score. |
| EPSS | Probability of exploitation in the next 30 days, published by FIRST. |
| CWE | The weakness category behind the vulnerability (e.g. CWE-79 for XSS). |
Simple ruleFirst whatever is in the KEV and exposed to the Internet, then critical CVSS scores with a high EPSS, then the rest according to context.