The Senserva security lexicon

Every tracker and detail page on this site leans on the same handful of identifiers and scores. This page explains each one once, in plain language: what it is, who publishes it, and what it should change about your patching decisions. Detail pages link here instead of restating these definitions.

CVE

Common Vulnerabilities and Exposures

A CVE is a unique identifier for one publicly known vulnerability, in the form CVE-YEAR-NUMBER, such as CVE-2026-40024. The CVE program gives everyone, vendors, researchers, and defenders, one shared name for the same flaw, so an advisory, a scanner finding, and a news story can all be matched to each other.

A CVE identifies the problem, never the fix. The fix is whatever the vendor ships for it, which for Microsoft products means a KB. Senserva's CVE reference maps every Microsoft CVE to the updates that fix it, ranked by real-world risk.

KB

Microsoft Knowledge Base article number

A KB number, such as KB5099540, identifies a specific Microsoft update package and the support article describing it. One KB commonly fixes many CVEs at once: a monthly cumulative update for Windows can resolve dozens in one install.

That one-to-many relationship is why patching questions are usually KB questions. "Am I safe from CVE-X" almost always resolves to "is KB-Y installed". Our Microsoft patch tracker follows every current KB, and each KB page on this site lists exactly which CVEs it fixes.

KEV

CISA Known Exploited Vulnerabilities catalog

The KEV catalog, maintained by the US Cybersecurity and Infrastructure Security Agency, lists CVEs that are confirmed exploited in the wild. Not predicted, not theoretical: observed in real attacks. US federal civilian agencies are required to remediate KEV entries by set deadlines under Binding Operational Directive 22-01.

KEV is the single strongest prioritization signal there is. A KEV entry outranks any score on this page: attackers are already using it, so it goes to the front of the queue. Senserva tracks every KEV addition on the exploited-this-week tracker and flags KEV status on every CVE and KB page.

CVSS

Common Vulnerability Scoring System

CVSS scores how bad a vulnerability would be if exploited, on a standardized scale from 0 to 10. It reflects things like whether the attack works over the network, whether it needs credentials or user interaction, and how completely it compromises the target. 9.0 and above is generally labeled Critical Severity, 7.0 to 8.9 High.

CVSS measures impact, not likelihood. A 9.8 that no attacker has ever weaponized can matter less this week than a 7.5 that is in the KEV catalog. Use CVSS to understand the blast radius, and pair it with KEV and EPSS to decide urgency.

EPSS

Exploit Prediction Scoring System

EPSS, published by FIRST, estimates the probability that a CVE will be exploited in the wild within the next 30 days, expressed as a percentage. It is refreshed daily from real exploitation telemetry, so it moves when attacker behavior moves.

EPSS answers the question CVSS cannot: how likely is this one, now. A CVE with EPSS above 10 percent deserves this maintenance window even if nothing confirms exploitation yet. Senserva shows EPSS on every CVE page and folds it into the ranking on the trackers.

MSRC

Microsoft Security Response Center

MSRC is the part of Microsoft that receives vulnerability reports, ships the fixes, and publishes the advisories. Its Security Update Guide is the authoritative source for which Microsoft CVEs exist, their Severity as Microsoft rates it, and which KB fixes each one on each product version.

Senserva's Microsoft data starts from the MSRC feed on every refresh, several times a day, and the Patch Tuesday page is built from it each month.

NVD

National Vulnerability Database

The NVD, run by NIST, is the US government's database of CVE metadata: descriptions, affected products, and the authoritative CVSS scores most of the industry quotes. When a CVE is "awaiting analysis", it exists but NVD has not yet scored it.

Senserva uses NVD to enrich CVE pages with scores and details beyond what the original advisory carries.

Ransomware association

The flag on CVEs linked to ransomware campaigns

The KEV catalog marks whether a known-exploited CVE has been used in ransomware campaigns. On Senserva pages that appears as a Ransomware flag, and it is the most urgent state a vulnerability can be in: confirmed exploitation, by crews whose business model is taking your environment hostage.

A ransomware-flagged CVE should move ahead of everything else in the queue, and the fix should be verified on every exposed device, not just deployed.

Patch Tuesday

Microsoft's monthly security release

Microsoft ships its scheduled security updates on the second Tuesday of each month. One Patch Tuesday typically means dozens of KBs fixing dozens to hundreds of CVEs across Windows, Office, and the rest of the stack. Out-of-band updates happen when something cannot wait for the next second Tuesday.

Senserva covers every release on the Patch Tuesday page, with the monthly history and every KB and CVE linked to its own page.

How the pieces decide what you patch first

  1. KEV first, always. Confirmed exploitation beats every prediction and every score. Ransomware-flagged entries go to the very front.
  2. Then EPSS. A high 30-day exploitation probability earns this maintenance window, not the next one.
  3. Then CVSS and vendor Severity. Among the rest, fix the biggest blast radius first, on your normal cycle.

That order is exactly how the patch tracker, the CVE reference, and every detail page on this site rank what they show you.

Sources: the CISA KEV catalog, FIRST EPSS, the NIST National Vulnerability Database, and the Microsoft Security Response Center. Full source list and terms: Data sources and thanks.