IT SBIT Services
Schneeberger
DEEN
CVE tracker

Glossary

What do CVSS, EPSS, KEV or zero-day mean? Short and clear explanations – so you know what the figures on this page tell you.

CVE
Common Vulnerabilities and Exposures: a unique worldwide number for a publicly known security vulnerability, e.g. CVE-2026-12345. It lets vendors, authorities and experts refer to the same vulnerability without confusion.
NVD
National Vulnerability Database of the US institute NIST: a public database of all CVEs with ratings (CVSS), affected products and references. The main source of this tracker.
CNA
CVE Numbering Authority: an organisation allowed to assign CVE numbers – usually the vendor itself, e.g. Microsoft or Adobe. We use it to attribute a CVE to the vendor’s patch day.
CVSS (score 0–10)
Common Vulnerability Scoring System by FIRST: rates the technical severity of a vulnerability from 0 to 10 – for example whether it can be exploited over the network without logging in and what an attacker can do afterwards. The score does not say whether the vulnerability is actually being attacked.
Severity
Level derived from the CVSS score: critical 9.0–10.0, high 7.0–8.9, medium 4.0–6.9, low 0.1–3.9. Microsoft uses its own scale (critical, important, moderate, low) based on the consequences in typical deployment scenarios.
EPSS and percentile
Exploit Prediction Scoring System by FIRST: the probability (0–100 %), recalculated daily, that a vulnerability will be exploited in the next 30 days. The percentile compares it with all CVEs: the 95th percentile means the score is higher than for 95 % of all CVEs.
KEV (actively exploited)
Known Exploited Vulnerabilities: a catalogue by the US agency CISA of vulnerabilities that are proven to be exploited in practice. US federal agencies have to fix them by a deadline – for everyone else a clear signal to act now.
SSVC (CISA assessment)
Stakeholder-Specific Vulnerability Categorization: a decision aid CISA uses to assess new CVEs (Vulnrichment programme). Exploitation: none known, public proof of concept or actively exploited. Automatable: whether an attacker can repeat the exploitation without human interaction. Technical impact: partial or total (full control over the affected system).
Zero-day
A vulnerability that is already being exploited or is publicly known before the vendor provides an update. On Patch Tuesday Microsoft marks such vulnerabilities as “exploited” or “publicly disclosed”.
Publicly disclosed
Information from Microsoft: details of the vulnerability were public before the update, e.g. in a research article. Attackers could prepare, even if no attacks are known yet.
Proof of concept (PoC)
Public code showing that a vulnerability can actually be exploited. We link to the PoC-in-GitHub collection; the repositories are not checked and may contain malicious code themselves.
Metasploit module
Metasploit (Rapid7) is a widely used penetration testing tool. If a module exists, the vulnerability can be exploited with little effort – the risk rises considerably.
Exploit-DB
Public archive of exploits run by OffSec. An entry means that attack code is freely available. We only show links, no code.
Patch Tuesday
Microsoft’s monthly update day: the second Tuesday of the month, around 10 a.m. Pacific Time (usually 7 p.m. in Switzerland). Many other vendors release updates on the same day.
MSRC
Microsoft Security Response Center: publishes all vulnerabilities fixed by Microsoft in the Security Update Guide. We read its official interface (CVRF).
Exploitability assessment
Microsoft Exploitability Index: how likely an attack is – detected, more likely, less likely or unlikely.
Critical Patch Update
Oracle’s name for its quarterly bundled updates (third Tuesday of January, April, July and October). Since May 2026 a Critical Security Patch Update is added in the other months.
Patch day
A fixed date, known in advance, on which a vendor releases security updates in a bundle. IT departments can plan testing and installation. Urgent vulnerabilities are still fixed outside the schedule (out of band).
Out of band
An update outside the fixed patch day – usually because a vulnerability is already being attacked and cannot wait for the next date.
Types of impact
What an attacker can achieve with the vulnerability:
  • Remote code execution: the attacker’s own code runs on the target system, often over the network – usually the most dangerous type.
  • Elevation of privilege: someone with limited access gains higher privileges, such as administrator or SYSTEM.
  • Information disclosure: protected data such as memory contents, passwords or files become readable.
  • Denial of service (DoS): a service or system is crashed or brought to a standstill.
  • Security feature bypass: a protection such as Mark of the Web or Secure Boot is circumvented.
  • Spoofing: the attacker poses as someone else or forges content, such as a sender address or a display.
  • Tampering: data or settings can be changed without authorisation.
Affected products and versions
Which programs in which versions contain the vulnerability. “Fixed in” names the first version with the fix – all older ones are vulnerable.
KB number and update
Microsoft updates carry a Knowledge Base number, e.g. KB5126836. It identifies the package in the Microsoft Update Catalog or in WSUS/Intune. Other vendors name versions or patches.

Sources

The tracker combines official, freely usable data sources – updated continuously:

This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.

Affected? We can help.

We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.

Get in touchRSS feed