Vulnerabilityleaderboard

CISA's Known Exploited Vulnerabilities (KEV) catalogs issues with documented in-the-wild exploitation. It is the sharper signal for what to remediate first. The NVD remains the broad government repository (CVSS, CPE, CWE) essential for discovery, baselines, and tool integrations, but severity scores alone are weak predictors of real exploitation risk.

In practice: use KEV as the primary prioritization input and NVD for comprehensive coverage and context. NIST prioritizes fast enrichment for KEV-listed CVEs, and federal agencies face mandated KEV remediation timelines under Binding Operational Directive 22-01.