Threat intelligence · Public sources

Advisories and exploited vulnerabilities map

Collects the latest entries from official catalogues and advisories: CISA KEV, NIST NVD, CERT-AGID, CERT-EU, CISA advisories and Cisco Talos research. These are vulnerabilities and advisories, not attacks in progress: the position on the map is the area of the publishing organisation, not the location of victims.

Loading data…

Updated: —

How to read the map

What is real. Every entry comes from an official public source and links to the original page. Descriptions stay in the source’s language (usually English; Italian for CERT-AGID).
What is aggregated. One marker groups all the entries published by organisations in the same area: United States (CISA, NIST), Italy (CERT-AGID), European Union (CERT-EU). Sources with no area of their own, such as Cisco Talos, are counted separately under “No geographical area”.
What it is not. It does not show where attacks happen or who has been hit: a vulnerability published by NIST concerns products used all over the world.
Severity. It comes from the CVSS score when the source provides one. The KEV catalogue does not assign a severity: it states that the vulnerability is actively exploited, which is exactly why it should be fixed first.

Loading the latest entries…

Geography

Entries by source area

On the map — No geographical area —

Each circle is an area, meaning where the publishing organisations are based; its colour shows how many entries come from it (yellow: up to 8, orange: up to 15, red: more). Click a circle or an entry in the list for details. The map is fixed, with no zoom.

Up-to-date data, cache and examples: what is the difference?

Up-to-date data — the server queries the sources every 5 minutes; the “Source status” line shows which ones responded to the last attempt.

Last real data (cache) — if the sources do not respond, the last data downloaded stays on screen, with its time under “Updated”.

Examples — if no source responds and there is no cache, the page shows a few example entries, labelled as such: real, well-known vulnerabilities from the KEV catalogue (not the latest ones) and a description of the type of content the other sources publish. They are not the current feed.

Metrics

What the sample contains

The figures refer only to the loaded entries (the latest from each source), not to all existing vulnerabilities.

—Entries loaded

—Actively exploited (KEV)

—Critical (CVSS ≥ 9)

—With a CVE identifier

—Used in ransomware campaigns (KEV)

—No geographical area

—Sources that responded

Dates

Loaded entries by month (last 12 months)

Shows when the entries on the map were published: it is not the overall trend in vulnerabilities.

List