Why this exists.

Roughly fifty vulnerabilities a day are rated critical. A handful of them matter this week. Critical is a daily brief that separates the two, in the open.

What Critical is

Critical tracks every vulnerability rated CVSS 9.0 or higher by any credible scorer: the CNA that published it, CISA’s ADP enrichment, or NVD. It then layers on the signals that say whether a bug is actually being used: CISA’s Known Exploited Vulnerabilities catalog, FIRST’s EPSS probability, and CISA’s SSVC decision points. Each record shows every input and the source it came from, so you can check the work.

It is built and run by Kastro, a small studio in Iceland, as a free public resource. There is no account, no paywall, and no tracking. The same data is available as RSS, a JSON API, and an MCP endpoint for AI agents.

How the ranking works

Severity says how bad a bug is; it does not say how likely it is to hurt you. The priority score combines both in one transparent formula, out of 100:

CVSS / 10 × 30  +  in KEV 30  +  EPSS percentile × 20  +  public exploit 10  +  SSVC active 10

It orders the critical set; it never adds anything below 9.0. Every CVE page shows the breakdown, and the glossary explains each term. Collection runs daily at 06:00 UTC, and exploitation signals refresh hourly. A missing signal never means a vulnerability is safe; it means the upstream has not said anything yet.

Sources and attribution

CVE List (cvelistV5): the canonical records, including CISA’s Vulnrichment ADP container. CVE is a registered trademark of The MITRE Corporation; content is used under the CVE Terms of Use.
CISA Known Exploited Vulnerabilities catalog and SSVC decisions: US government works in the public domain.
National Vulnerability Database: additional CVSS assessments. This product uses data from the NVD API but is not endorsed or certified by the NVD.
FIRST EPSS: exploitation probabilities from the Exploit Prediction Scoring System, used with attribution per FIRST’s terms.

Descriptions, titles, product names, and references are reproduced from those records and belong to their authors. Critical adds the ranking, the grouping, and the daily framing. If a record is wrong, the fix belongs upstream: every CVE page links to its source record.

Privacy and cookies

Critical sets no analytics or advertising cookies and loads nothing from third parties; fonts are served from this site. Three first-party cookies exist, all optional, all created only when you use the feature:

theme: light or dark, one year.
watchlist: the vendors and products you chose to highlight, one year, stored only in your browser.
critical_preferences: a random token, one year, that keys your ignored reports, blocked vendors, and layout choice. The server stores those under a hash of the token and deletes rows untouched for about thirteen months. Clearing cookies loses access to them; nothing links them to you.

Server logs hold request metadata for operations and are not shared. Public outputs (the site, RSS, JSON, MCP) never vary by visitor. Requests to the MCP endpoint and APIs are rate-limited by address, and that is the only record kept of them.

Contact

Questions, corrections to how a record is presented, or ideas: reach Kastro through kastro.is. For errors in the vulnerability data itself, contact the CNA named on the CVE page or CISA for KEV entries.