All patch & vulnerability trackers

The Senserva CVE Ranking

A proprietary score that answers one question: of the thousands of vulnerabilities out there, which ones actually matter right now? It ranks every Microsoft and CISA KEV CVE, and the update (KB) that fixes it, by the signals that predict real-world attack, so you fix what is dangerous first instead of chasing raw severity.

Refreshed several times a day. See it live on the Microsoft CVE tracker, the patch tracker, the CISA KEV tracker, and What's Hot.

What it measures, in order of weight

The Senserva CVE Ranking blends the signals below, highest impact first. It is deliberately weighted toward proof of real-world attack over theoretical severity, because a Critical CVSS score that no one is exploiting is a lower priority than a High that ransomware crews are using today.

1. 1
   Confirmed exploitation (CISA KEV)

   The strongest signal by far. A vulnerability in CISA's Known Exploited Vulnerabilities catalog is confirmed in active use by attackers, so it dominates the score.

2. 2
   Known ransomware use

   CISA flags the CVEs tied to ransomware campaigns. These jump the queue, because ransomware operators automate exploitation of exactly these vulnerabilities, and unpatched systems are the entry point in most incidents.

3. 3
   EPSS exploit probability

   FIRST.org EPSS models how likely a CVE is to be exploited in the wild over the next 30 days, updated daily. It separates the genuinely risky from the merely severe before exploitation is confirmed.

4. 4
   CVSS severity

   The base technical severity, used as a tiebreaker once the exploitation signals are in. It answers "how bad if exploited," which matters, but only after "is it being exploited."

5. 5
   Recency

   A trailing boost for what started moving in the last days, so the ranking reflects current heat and cools as an item ages, rather than carrying old news forever.

The Senserva CVE Score, 0 to 100

The ranking puts vulnerabilities in order. The Senserva CVE Score turns that into a single number from 0 to 100 so you can read urgency at a glance on any CVE, patch, or card. It is built from the public signals above, confirmed exploitation, ransomware use, EPSS, CVSS, and recency, on a fixed scale, so the same vulnerability scores the same for everyone and the number does not move just because a page is more or less popular. A confirmed-exploited item that ransomware is using and that turned hot in the last two weeks sits in the 90s; an actively exploited but older CVE lands in the 50s to 80s; a severe CVE that no one is exploiting scores well below that. The same score applies to a Microsoft update (KB), built from the CVEs it fixes.

The Score reflects public signal only, so it is fully explainable. The proprietary demand and telemetry signals refine the ranking order, not this number.

Why a ranking beats a severity score alone

Microsoft discloses 1,000 to 2,000 CVEs a year. Most are never exploited; a handful are used in real attacks this week. CVSS alone cannot tell those apart: it rates how bad a vulnerability would be if exploited, not whether anyone is exploiting it. The Senserva CVE Ranking folds the exploitation signals (CISA KEV, ransomware, EPSS) on top of severity, so the list you see is a fix-first order, not a wall of Critical.

Because it refreshes several times a day, the ranking rises and falls with real events: a CVE added to CISA KEV or picked up by a ransomware crew climbs immediately, and quietly cools as attention moves on. That is the difference between a static score and a live measure of what to patch now.

Where you see the Senserva CVE Ranking

Frequently asked