Method
How Patchfirst works
For each CVE, Patchfirst shows whether it is exploited, how likely exploitation is, which ATT&CK techniques are linked to it, and which sources say so. Each claim carries a provenance badge.
Patchfirst tracks all 398,633 published CVEs. The 9,988 that are exploited, mapped to ATT&CK, named in reports, very likely to be exploited, or recent and critical get a full page with deep analysis; every other CVE has a basic page with source data.
Who this is for
Security and IT teams who need to decide which vulnerabilities to patch first, and analysts who want to know how attackers use a vulnerability and how to detect it.
Patchfirst is free and needs no account. It is a starting point for research: check the linked sources before acting on a claim.
The four badges
Badges are never upgraded- Copied from an authoritative feed: NVD, CVE.org, CISA KEV, FIRST EPSS or MITRE CTID mappings, or labelled by the annotators of a published dataset. Dataset labels (AnnoCTR, TRAM2) count here because the people who checked them belong to the dataset, not to Patchfirst.
- Found by keyword or pattern matching over threat-report text. Not reviewed by a person. It is drawn dashed and dim so it reads as weaker than source data.
- Written by a language model from the source data on this page. Not reviewed by a person. The badge always names the model.
- Confirmed by a named reviewer in Patchfirst's review workflow.
Every technique link also states its basis
- ctid-kevMITRE CTID mapping of the KEV entry
- ctid-cveMITRE CTID mapping of the CVE
- dataset-annotationLabelled by dataset annotators
- report-passageMatched in report text
- report-attack-idATT&CK ID cited in the report
- human-reviewPatchfirst review
- ai-mappingAI mapping from the description
Glossary
Terms used on this site- CISA KEV
- The US Cybersecurity and Infrastructure Security Agency’s list of Known Exploited Vulnerabilities. A CVE is added when CISA has evidence that attackers are using it.
- EPSS
- Exploit Prediction Scoring System, from FIRST. The estimated chance that a CVE will be exploited in the next 30 days.
- EPSS percentile
- How a CVE’s EPSS score compares with all other CVEs. “Top 0.1%” (p99.9) means it is rated riskier than 99.9% of CVEs.
- CVSS
- Common Vulnerability Scoring System. A 0 to 10 rating of how severe a vulnerability is if exploited. It does not say whether anyone is exploiting it.
- MITRE ATT&CK
- A public catalogue of the techniques attackers use, maintained by MITRE. Patchfirst uses it to describe what attackers do with a vulnerability.
- Technique
- One specific attacker behaviour in MITRE ATT&CK, such as T1190 “Exploit Public-Facing Application”. IDs with a dot, like T1059.004, are sub-techniques.
- Tactic
- The attacker’s goal at a stage of an attack in MITRE ATT&CK, such as Initial Access or Persistence. Each technique belongs to one or more tactics.
- Sigma rule
- An open, vendor-neutral detection rule for log data. Security teams convert Sigma rules into searches for their own SIEM.
- Priority score
- Patchfirst’s 0 to 100 ranking. It adds points for CISA KEV listing, ransomware use, EPSS, threat reports, public exploit code and CVSS. Every CVE page shows the breakdown.
- EUVD
- The EU Vulnerability Database, run by ENISA. It also flags vulnerabilities known to be exploited.
- Public exploit
- Working attack code that anyone can download, for example from Exploit-DB. It makes exploitation easier but does not prove attacks are happening.
- End of life
- The vendor no longer ships security fixes. Remove or isolate the product instead of waiting for a patch.
- Confidence (technique links)
- How sure Patchfirst is that an ATT&CK technique applies to this CVE. High and medium links are shown by default; low ones come from early or generic mappings, text matching, or contradict the CVE’s details.
- Exploitation timeline
- Dated milestones for a CVE: when it was disclosed, when exploit code became public, when exploitation was confirmed, and when threat reports named it.
- Patch history
- Earlier and later CVEs in the same code, in date order. It shows when a fix was bypassed or incomplete and which version finally fixed it.
- Bug family
- A group of related CVEs. A chain is linked by evidence that one CVE follows from another. A class family groups CVEs by product and weakness type and is not proven to share a root cause.
- Link confidence
- How strong the evidence is that two CVEs are related. High: stated in the CVE text or linked in an advisory, or the same code was patched one release apart. Medium: the same code, or a version step plus a similar description. Low: similar description only.
- CWE
- Common Weakness Enumeration. The type of coding mistake behind a vulnerability, such as SQL injection (CWE-89).
- Source data
- Copied from an authoritative feed such as NVD, CISA KEV, FIRST EPSS or MITRE’s mappings.
- Machine-matched
- Found by keyword or pattern matching in threat-report text. Not reviewed by a person.
- AI-written
- Written by a language model from the source data. The badge names the model. Not reviewed by a person.
- Human-checked
- Confirmed by a named reviewer in Patchfirst’s review workflow.
Priority score
0 to 100, one decimal placeConfirmed exploitation outweighs predicted exploitation, and both outweigh severity. A critical CVSS score on its own adds at most 10 points. Every CVE page shows its factors.
| Factor | Rule | Max |
|---|---|---|
| In a KEV catalog | 35 if listed in CISA KEV or VulnCheck KEV (the detail names which) | 35 |
| Recent KEV listing | 10 if first added to a KEV catalog in the last 90 days, 5 within 365 days | 10 |
| Known ransomware use | 10 if CISA or VulnCheck KEV marks ransomware use as “Known” | 10 |
| EPSS percentile | 20 × EPSS percentile | 20 |
| Threat reports | 10 × min(1, ln(1 + reports) ÷ ln 6), full at 5 reports | 10 |
| Public exploit code | 5 if Exploit-DB, PoC-in-GitHub, Metasploit, nuclei, an NVD Exploit-tagged reference or a GHSA/OSV advisory has exploit code | 5 |
| Mentioned in OTX pulses | 3 × min(1, ln(1 + pulses) ÷ ln 21), full at 20 AlienVault OTX pulses (machine-matched; not counted as threat reports) | 3 |
| CVSS base score | 0.7 × CVSS base score (0 to 7) | 7 |
| End-of-life product | −15 if the product is end-of-life (no patches exist; total floors at 0) | −15 |
| Total | 100 |
EPSS enters as a percentile so the score separates CVEs across the whole range. The report factor saturates at five reports.
Quotes
Most threat reports are not cleared for redistribution. Patchfirst quotes at most 320 characters from any passage, always linked to the original. Full report text is not published.
Quotes are exact substrings of the report, with character offsets kept in the data so anyone can check them. When a quote names the CVE, the id is highlighted.
Sources and licences
This build: 31 Oct 2026| Source | Version | Records | Licence |
|---|---|---|---|
| CISA Known Exploited Vulnerabilities | 2026.10.30 | 1,766 | US Government work. Public domain in the US; CISA asks for attribution. |
| FIRST EPSS | v2026.06.15 | 398,142 | FIRST EPSS. Free to use with attribution to FIRST. |
| NIST NVD CVE API 2.0 | KEV | 19,118 | NIST NVD. Public domain in the US. Not endorsed by NIST. |
| CVE.org CVE Services (CVE JSON 5) | CVE | 0 | CVE Program. Reproduction permitted with attribution to the CVE Program. |
| MITRE CTID Mappings Explorer: KEV to ATT&CK | KEV | 1,183 | MITRE Center for Threat-Informed Defense. Apache-2.0. |
| MITRE CTID attack_to_cve | master | 1,683 | MITRE Center for Threat-Informed Defense. Apache-2.0. |
| GitHub Advisory Database (reviewed) | main | 37,493 | See source. |
| OSV.dev bulk (non-GHSA records with CVE aliases) | npm, | 13,156 | See source. |
| ENISA EU Vulnerability Database | 2026-10-31 | 398,629 | See source. |
| Exploit-DB (OffSec) | files_ | 30,672 | See source. |
| SigmaHQ detection rules | master | 3,804 | See source. |
| CVE List V5 (CVEProject/cvelistV5) | – | See source. | |
| VulnCheck KEV | 2026-10-31 | 5,741 | See source. |
| nomi-sec/PoC-in-GitHub | master | 9,863 | See source. |
| Metasploit Framework modules | master | 3,203 | See source. |
| ProjectDiscovery nuclei-templates | main | 4,549 | See source. |
| AlienVault OTX pulses | 7-day | 5,418 | See source. |
| Threat-report corpus | 2026-10-22T22:33:37+00:00 | 220 | See source. |
| MITRE ATT&CK Enterprise | 19.2 | 697 | MITRE ATT&CK. Royalty-free licence; © The MITRE Corporation. |
This product uses data from the NVD API but is not endorsed or certified by the NVD. CVE® and ATT&CK® are registered trademarks of The MITRE Corporation.
API and feeds
No key, no login. Static files rebuilt with the data.- /rss.xml Newest 200 CVEs, RSS 2.0
- /feed.json Newest 200 CVEs, JSON Feed 1.1, with the index row in _patchfirst
- /api/cve/<CVE-ID>.json One full record for any CVE: techniques, evidence, reports, priority factors
- /api/search?q= Search across every CVE (id, title, vendor, product, description)
- /api/index.json Compact index of every CVE, as used by search and filters