About CyberSecBulletin

CyberSecBulletin is an independent publication about software and hardware vulnerabilities. We exist for the people who have to decide what gets patched first: system administrators, security engineers and IT managers.

Hundreds of new CVEs are published on a typical day. Most official records are written for specialists and say little about urgency. We collect every record, add the signals that show real-world risk, and explain the important ones in plain language.

What you will find here

• A page for each CVE with its severity score broken down metric by metric, affected and fixed versions, exploitation status and fix guidance.
• News articles on the vulnerabilities that deserve attention.
• A running list of vulnerabilities exploited in the wild.
• Weekly reports that put the numbers in context.
• Hubs for each vendor and weakness type.

Where the data comes from

• CVE records and CVSS scores: the US National Vulnerability Database (NVD) and the CVE Program. This product uses data from the NVD API but is not endorsed or certified by the NVD. CVE records are © The MITRE Corporation and used under the CVE Terms of Use.
• Exploitation status: the CISA Known Exploited Vulnerabilities catalogue.
• Exploitation forecasts: the Exploit Prediction Scoring System (EPSS) from FIRST.org.
• Weakness definitions: MITRE Common Weakness Enumeration (CWE).

We update from these sources every day.

Contact

Corrections, tips and questions: [email protected], or see the contact page.