KEV

Catalogue scorecard

How well each known-exploited-vulnerability catalogue backs, situates, leads and maintains the assertions it publishes, scored against a published set of rules: Substantiate, Situate, Lead, Maintain, 25 points each. Evidence is weighed by where it comes from: a listing whose evidence is another catalogue's listing earns little, and a catalogue mirroring another is not an independent witness.

All catalogues
5
Ranked catalogues
0
Under the threshold
180 days
Rolling window
1
Mirror relations
Prepared 2026-10-12T23:25:04+00:00 by Vulnerability-Lookup v6.2.1-233-gfb9679b9 over 6,134 entries Methodology v1 since 2026-10-11 Ranked from 10 listings in the window API · Markdown
# Catalogue Grade Score Entries Badge
1 CISA C 73.54 171
2 Shadowserver C 72.14 106
3 ENISA C 68.47 36
4 CIRCL Local D 53.83 18
5 Previdian D 49.76 707

A catalogue mirrors another when it holds at least 90% of its entries, lists them with a median lag of at most two days and is strictly first on at most 5% of them. Inferred from the listings, not declared. A mirror and its upstream never compete for the lead, and a mirror's listing is not an independent witness.

Mirror Upstream Holds Median lag Strictly first
Previdian mirrors CISA 100% 0.0 days 4%
The rules Entry rules earn a credit in 0..1 per entry and are averaged; catalogue rules are one figure of the catalogue. The score is the weighted sum.

Substantiate: is the claim backed, and by whom? (25 points)

  • Evidence (8): At least one evidence record. Derivative evidence only, citing another catalogue, earns 0.25.
  • Evidence type (5): A typed evidence record that is not derivative; a type of 'unknown' earns nothing.
  • Signal (7): The strongest signal on non-derivative evidence: confirmed_compromise 1.0, successful_exploitation 0.9, in_the_wild_attempts 0.7, mass_scanning 0.5, weaponized_exploit_available 0.4. Halved when the catalogue's evidence is templated.
  • Confidence (5): A confidence from the BCP-07 table on non-derivative evidence; another number in 0..1 earns 0.6, a label earns 0.5. Halved when the catalogue's evidence is templated.

Situate: when, where and how bad? (25 points)

  • First seen (7): timestamps.first_seen_at; asserted_at alone earns 0.7.
  • Last seen (4): timestamps.last_seen_at.
  • Characteristics (6): The four characteristics (remote_code_execution, authentication_required, local_access_required, severity); the credit is the share stated.
  • Scope (5): One of scope.observation_regions, victim_countries, sector or asset_exposure earns 0.5; two or more earn 1.0.
  • References (3): A reference beyond the vulnerability's own record page; only that page earns 0.4.

Lead: how early does the catalogue say it? (25 points)

  • First to list (15): The share of the vulnerabilities shared with an independent catalogue that this catalogue listed first or the same day.
  • Lag (10): The median days behind the first lister on the shared vulnerabilities it did not list first: 1.0 at one day or less, falling to nothing at 90 days.

Maintain: is the catalogue looked after? (25 points)

  • Retractions (12): One minus the share of listings withdrawn within 30 days of being listed.
  • Status reason (8): The share of current entries whose status_reason is not 'unknown'.
  • Freshness (5): The latest listing: 1.0 within 30 days, falling to nothing at the end of the window.

Grades: A from 90, B from 75, C from 60, D from 45, E from 0. A catalogue sharing no vulnerability with an independent catalogue has no lead to measure: the pillar is not assessable and the score is taken over the 75 points that are. The full text, with the methodology history, is in the documentation.