by Kastro The words
on the page.
16 terms, each in a paragraph. Severity (CVSS) says how bad a bug is; the other signals say how likely it is to hurt you this week. The priority score combines them, in the open.
The public ID for one vulnerability, e.g. CVE-2026-41822. Assigned by a CNA and published through the CVE List (cvelistV5), which is the spine of critical.is.
A 0–10 severity score from the vulnerability’s technical properties (network reachable, no auth, full impact…). critical.is tracks anything scoring ≥ 9.0 from any credible source. It measures how bad, not how likely.
The organisation that assigned the ID and wrote the record, usually the vendor. Their CVSS is the first score we see.
Enriches CVE records with its own CVSS and product identifiers (CPE). Often lags; we treat it as one scorer among several.
CISA’s additions inside the CVE record: SSVC decision, KEV flag, CVSS when the CNA gave none, CWE and CPE.
CISA’s list of vulnerabilities confirmed exploited in the wild. The strongest single signal we have, worth +30 priority points.
The date by which US federal agencies must patch (BOD 22-01). A useful yardstick for everyone else: it is usually three weeks after listing.
CISA has evidence the bug is used in ransomware campaigns. Shown as a red chip; it does not change the score.
A daily model estimating the probability a vulnerability is exploited in the next 30 days. 94% means very likely; 0.4% is background noise. Jumps overnight are a story in themselves.
Where this probability sits relative to every other CVE. 99.8 means only 0.2% of CVEs score higher. The percentile, not the raw probability, feeds the priority score.
CISA’s decision tree. Exploitation “active”, “poc” or “none”; Automatable yes/no; Technical impact. “Act” is the top outcome.
Code to trigger the vulnerability exists in Exploit-DB, Metasploit, nuclei templates or a public repo. Phase 4 wires this signal in fully.
CVSS/10×30 + KEV 30 + EPSS percentile×20 + exploit 10 + SSVC active 10. Fully transparent, shown on every CVE page. It orders the critical set; it never adds sub-9.0 items.
CPE names the affected product and version precisely; CWE names the class of bug (e.g. CWE-122 heap overflow).
Rejected records were withdrawn; disputed ones are contested by the vendor. Both appear on their CVE page but are dropped from the digest.
How AI agents call critical.is directly: get_daily_brief, get_vulnerability, check_dependencies. Open, no key, rate-limited by IP.