Help

When researchers and vendors disclose a software security flaw, it gets a public ID called a CVE. Hundreds of thousands exist, and dozens of separate sites and feeds track different details about each one. ExploitSignal does that tracking for you and gives every flaw a single risk score from 0 to 100.

Five things happen on a loop.

1. 1

   Collect

   Data is fetched from 22 public sources (see Where the data comes from).
2. 2

   Merge

   All the details about one flaw become a single record that tracks which source said what.
3. 3

   Enrich

   Extra signals are added: a known-exploited listing, attacks seen in the wild, trending security discussion.
4. 4

   Score & rank

   Each flaw gets a risk score and priority, so one sort puts the most dangerous first.
5. 5

   Act

   You browse and filter; with a free account you triage, tag, watch, and get alerts.

1. 1

   Open the Dashboard

   See the current landscape.
2. 2

   Go to Vulnerabilities

   It opens sorted by what changed most recently; click the Risk column to rank by danger instead.
3. 3

   Filter or search

   Use the filters, or press Ctrl/⌘ + K.
4. 4

   Create a free account

   Triage flaws, add notes and tags, build watchlists and bundles, and get alerts. If this deployment is not accepting new accounts, ask the operator for one.

A deployment runs either open to the public or private to the people who can already reach it. On a public one, everything marked "Sign-in required" is hidden until you sign in; on a private one, most of it is simply there. The API page needs an account either way.

CVE

A public ID for one specific software flaw, like CVE-2021-44228.

Vulnerability

Another word for a security flaw, a weakness attackers can abuse. Each CVE describes one vulnerability.

CVSS score

A 0-10 rating of how severe a flaw is in theory (10 = worst). It measures potential impact, not whether anyone is attacking it.

EPSS

A 0-100% prediction of how likely a flaw is to be exploited in the next 30 days.

KEV (Known Exploited)

A flaw that the U.S. cyber agency (CISA) has confirmed is actually being used in real attacks. Patch these first.

Exploit maturity

How ready-to-use an attack is: from just "referenced", to a public proof-of-concept, to weaponized, to KEV-listed.

In the wild

Threat sensors are seeing real attackers or automated bots try to exploit the flaw right now.

Ransomware-linked

The flaw is known to be used by ransomware gangs, criminals who lock up your files for payment.

CWE / CAPEC / ATT&CK

Catalogs that classify the type of weakness (CWE), the attack pattern (CAPEC), and the attacker technique (MITRE ATT&CK).

SSVC

A decision aid from CISA that labels a flaw's exploitation status and whether an attack can be automated.

Advisory

A vendor or project's official write-up of a flaw (for example a GitHub or open-source-package advisory), often with the affected versions and the fix.

Risk score & priority

ExploitSignal's own 0-100 score combining all the signals above into one number, plus a Critical/High/Medium/Low label. See How the risk score works. In the list, Severity and Priority are separate columns that use the same four words: Severity comes from CVSS alone, Priority from the risk score, so a flaw can read High in one and Medium in the other.

Webhook

A URL you own that ExploitSignal calls when something happens, with the details in the message, so another tool can react without anybody reading an email.

VEX

A vendor's own statement about whether a flaw actually affects their product, which is often "not affected" even when a scanner flags the component.

Triage

Your decision about a flaw: one of new, reviewing, watching or dismissed. You can attach a reason and an expiry date, and a watching or dismissed flaw returns to new when that date passes.

The left-hand menu, in order.

Open to everyone

Once you are signed in

The whole record on one page. Most of it is readable without an account.

ExploitSignal blends many signals into a single risk score from 0 to 100 and a priority label (Critical / High / Medium / Low).

The factors

A worked example

Reading the score

ExploitSignal aggregates 22 public sources.

Everything on these pages is also available to a program. Most reading endpoints answer anybody; the report and data-health ones follow the same rule as their pages, and an operator can require a key for every read. Anything that is yours, such as triage, notes, tags, bundles and watchlists, always needs a key that belongs to you.

curl -H "X-API-Key: your-key" \
  "https://your-deployment/api/v1/vulnerabilities?limit=5"

Skip this unless your organisation runs ServiceNow. ExploitSignal can push flaws into it as records; the controls are on the API page.

Choose how records are written

Choose how it signs in

What gets sent

Turning it on, in order

Letting ServiceNow update your triage

{ "cve_id": "CVE-2021-44228", "state": "resolved" }

When something goes wrong

The instance URL was rejected when you saved it

For an ordinary account it has to start with https:// and resolve on the public internet. Only the operator can point one at an internal address.

Authentication failed

The instance rejected the credentials. Re-check the client id and secret, or the JWT private key.

Access to the table was denied

The credentials worked but the user is not allowed on that table. Check its roles, and whether the table needs Vulnerability Response. A wrong API key looks like this too.

Table was not found

A typo, or it does not exist on that instance.

Skipped N rejected records

ServiceNow refused those specific records, usually a field-map value it does not accept. The rest went through; fix the mapping and they are retried on a later change.

The callback URL has no hostname

The deployment has no public address configured. Ask the operator to set PUBLIC_BASE_URL; the path alone is no use from ServiceNow.

The same error every sync

The whole batch is failing rather than one record. Test, Dry run, Sync now and Backfill all act on the saved instance rather than on what is typed in the form.

Do I need an account to use it?

No. The dashboard, vulnerabilities, advisories, intel, and the trend charts on Reports are readable by anyone. An account adds your personal workspace, alerts, and the report archive, including the weekly report written about your own watchlists and triage queue.

Is my triage/notes visible to others?

No. Your workspace (triage, notes, tags, bundles, watchlists, alerts) is private to your account.

Does it scan or change my systems?

No. ExploitSignal is read-only; it never connects to or modifies your infrastructure.

What should I patch first?

Sort by the Risk column, and prioritize anything KEV-listed, in-the-wild, or with high EPSS. The "Why this score" panel explains each ranking.

A flaw I know about is missing, or looks thin. Why?

A fresh deployment loads roughly the last four months, a window the operator sets. Feeds that publish their whole catalogue, such as CISA KEV and EPSS, still bring older flaws in, so an old CVE can appear with its exploitation signals but a sparse description. Data Health shows how far each source has got.

A page is missing from my menu. Why?

On a deployment open to the public, the workspace pages (Watchlists, Bundles, Data Health, API, Settings) appear only after you sign in. On a private one, everybody who can reach the app sees them, except the API page, which always needs an account.

Can I use it from a script?

Yes. See Using the API.