The CVE catalogue on the Vulnerabilities tab is part of every package, including the free Community package. CVE alerts on the Alerts tab are included with Plus and Premium, and so are the links from a CVE to the indicators connected to it.
Find a CVE
- Open the Threat Intelligence Portal and go to Vulnerabilities in the menu.
- On the Vulnerabilities tab, type a CVE id or words from the description in Search, or a vendor or product name such as fortinet in Vendor / product.
- Narrow the list with the other filters: Severity (CVSS), EPSS at least, Exploited in the wild, Public exploit, and the Published from and Published to dates.
- Use Sort to order the results, for example by Highest CVSS, Highest EPSS or Newest in KEV.
Under Show you choose between All CVEs and Only CVEs with linked IOCs. The second option keeps the CVEs that Q-Feeds has seen connected to malicious indicators.
Read the scores
Each CVE carries several signals. They answer different questions, so read them together.
- CVSS is the severity score from 0 to 10 that NVD assigns. It says how bad a flaw could be if someone uses it, not how likely that is.
- EPSS score is the probability, from FIRST, that a CVE will be exploited in the next 30 days. A score of 0.40 means a 40% chance. The portal also shows how the score compares with all other scored CVEs.
- CISA KEV is the Known Exploited Vulnerabilities catalogue of the US Cybersecurity and Infrastructure Security Agency. A CVE on that list has been exploited in the wild. The entry shows when it was added, whether ransomware groups are known to use it, the required action and the due date for US federal agencies.
- SSVC is the decision CISA publishes for some CVEs, including whether exploitation is active.
- Public exploit means an Exploit-DB entry, a Metasploit module or a Nuclei template references the CVE. The portal shows identifiers and links only, never exploit code.
- Linked IOCs counts the indicators in the Q-Feeds data that are connected to the CVE.
To decide what to patch first, start with the CVEs on CISA KEV, because attackers already use them. Then take the ones with a high EPSS score. Use CVSS to order the rest.
Open a CVE page
Select a CVE id to open its page. It has one section per source: the NVD record with the CVSS score, CWE and affected products, the CISA SSVC decision, FIRST EPSS, the CISA KEV entry and any public exploits. With Plus or Premium the page also lists the most recently seen linked IOCs, and View all opens them in Browse IOCs.
- Type a CVE id such as CVE-2024-3400 in Threat Lookup to go straight to its CVE page. This does not count as a lookup.
- In Browse IOCs, a KEV, Exploited or EPSS label on a row shows that the indicator is linked to a CVE. Turn on Linked to a known exploited vulnerability (KEV) or Exploited in the wild (KEV or CISA SSVC) to show only those indicators.
- The detail page of an indicator has a Vulnerabilities card with the CVEs it is linked to, and the PDF export includes the same table.
Set up CVE alerts
- On the Vulnerabilities page, open the Alerts tab.
- Under Your software, type a vendor or product in Add a product, for example fortios or confluence. Each result shows how many CVEs it has.
- Tick the products you run, or tick Select all, and select Add selected. They are added in one go.
- To follow everything from one vendor, choose Watch everything matching at the top of the results. That adds one entry that matches every product name containing the word, including names that appear later.
- Under When to alert, pick the minimum score in New CVEs with a CVSS score of at least: Any score, 4.0 (medium and up), 7.0 (high and up), 9.0 (critical only) or Custom.
- Tick Also alert on new CVEs that have no CVSS score yet if you want to hear about CVEs before NVD scores them.
- Leave Alert when one of these CVEs is added to CISA KEV on. You then also hear about an older or lower-scored CVE for your software as soon as it is exploited in the wild.
- Under Digest, choose Daily or Weekly, the day, the hour and your time zone.
- Under Send to, tick the colleagues who should receive the digest, and select Save settings.
Matching uses vendor and product names as NVD and CISA write them, not versions. Check your installed version against the advisory before you act. One product can appear under more than one name, for example Fortinet FortiOS and FortiOS, so add both or use a keyword. The list holds up to 100 entries.
To remove software, tick it in the list, or tick the box in the header to select everything, and select Remove. The Alerts on switch pauses the digest and keeps your list. Anyone in your company can change the list and the settings.
What the digest contains
- Up to 50 CVEs per email. CVEs that were just added to CISA KEV come first, the rest follow by CVSS score, and a final line counts any CVEs that did not fit.
- For each CVE: the CVSS and EPSS scores, the software on your list that it matched, why it is in the digest (New or Added to KEV) and the description.
- Each CVE is sent once. It only comes back if CISA later adds it to KEV.
- When nothing new matches, no email is sent.
- The first digest after you add software covers CVEs published in the last 30 days, so you see recent issues straight away.
Select Show what would be sent now under Preview to see the next digest without sending it. The preview also tells you how many CVEs your CVSS threshold, the unscored setting or an earlier digest held back. Save your settings first if you changed them.
Where the data comes from
CVE records come from the CVE Program and NVD. EPSS scores come from FIRST, exploitation status and SSVC decisions from CISA, and public exploit references from Exploit-DB, Metasploit and Nuclei. New CVEs reach the catalogue once a day.
This product uses the NVD API but is not endorsed or certified by the NVD.
What next
Want CVE alerts for your own software? See what they include and which packages have them.