Methodology
How NEOSEC Intel scores
Every figure on this platform follows a fixed rule. This page lists them, so you can trace every value.
Priority (0–325)
The priority ranks vulnerabilities by how urgent they are today – not only by how severe they are in theory. It is made up of six parts and ranges from 0 to 325.
| Part | Rule | Maximum |
|---|---|---|
| Actively exploited (KEV) | 100 points if the CVE is listed in the CISA Known Exploited Vulnerabilities catalog. | 100 |
| Ransomware | 25 points if CISA notes exploitation by ransomware groups. | 25 |
| Exploit probability (EPSS) | EPSS percentile (0 to 1) squared, times 80. High probabilities weigh much more than low ones. | 80 |
| Severity (CVSS) | Highest CVSS base score from version 3 and 4, times 5. | 50 |
| Recency | Full 30 points within the first 30 days after the CVE was published, then decreasing logarithmically to 0 after five years. BSI warnings count from their own date. | 30 |
| Prevalence in Germany | Weight 0 to 1 of the affected products, times 40. Based on a curated list of widely used products, derived from anonymised, aggregated inventories from NEOSEC operations. With several products, the highest weight counts. | 40 |
| Total | 325 |
The priority is recalculated whenever an advisory is added or changed, additionally every hour for new entries and once a day in full after the EPSS values are updated.
XIEM® Effective CVSS (0–10)
The XIEM® Effective CVSS is the highest CVSS base score any source has assigned to the vulnerability – across CVSS version 3 and 4 and across the ratings of the NVD, the vendor or assigning authority (CNA) and older source data. It shows the worst known case. The CVE page states which rating the value comes from. Without any rating, the page shows “no score available”. The XIEM® Effective CVSS is not a priority: it describes technical severity, while the priority (0–325) also accounts for exploitation, recency and prevalence.
Severity
Severity follows the highest CVSS base score from version 3 and 4. Without a CVSS score, the source's severity applies.
| Level | Rule |
|---|---|
| critical | CVSS 9.0 or higher |
| high | CVSS 7.0 or higher |
| medium | CVSS 4.0 or higher |
| low | CVSS above 0 |
| Actively exploited (KEV) | always critical, regardless of CVSS – exploitation is confirmed. |
Rating “actively exploited”
A vulnerability counts as actively exploited when at least one of the following sources reports exploitation. The CVE page names the sources behind the rating. Only the CISA KEV catalogue feeds the priority and the filter “Actively exploited (KEV)”; the other evidence changes the exploit maturity and the display, not the priority.
- CISA KEV: official catalogue of the US agency CISA.
- VulnCheck KEV: extended KEV catalogue by VulnCheck.
- CIRCL KEV: own catalogue of the Luxembourg CERT CIRCL. Catalogues of other publishers that CIRCL also lists are not imported.
- CIRCL sightings: “exploited” reports with a source link. Reports generated automatically from Telegram channels and honeypot hits are not imported.
- CERT-FR alertes: alerts issued by the French agency ANSSI. A closed alerte remains evidence.
- CERT.at warnings marked “aktiv ausgenutzt” (actively exploited) in the title. From CERT.at we take only title, date, link and CVE numbers.
- Apple note in the CVE record: Apple states in the description that it is aware of reports of possible exploitation. Only the CVE record is read, not the Apple website.
CIRCL sightings of type “proof of concept” appear as reported, unverified PoC links among the exploit references.
Conflicting information
If several sources report different CVSS scores, the highest applies (see XIEM® Effective CVSS); its origin is shown. Product information is stored separately per source and shown with its origin on the CVE page instead of being merged into one list. The linked original source remains authoritative.
Data freshness
Each source is queried at a fixed interval. The source status shows, per source, the last successful fetch and the measured interval – the median gap between recent fetches. The status follows from this:
- current: last success at most two intervals ago
- delayed: older than two intervals
- disrupted: older than six intervals, at the latest after 48 hours, but never before four intervals
- discontinued: no successful fetch for 30 days
Translation and AI enrichment
English-language advisories are machine-translated into German; a specialist glossary keeps terms consistent. If the original source is only available in English, the German page says so. Industry mapping and summaries are AI-assisted. CVE titles are generated by rules from vendor, product and weakness class, not by a language model. Priority, severity and XIEM® Effective CVSS are calculated exclusively by the rules on this page.
Warranty
All information is compiled with care but without warranty. The linked original source is authoritative. Decisions on patches and countermeasures rest with the operator of the affected systems.