crash.run is an exploited-first operational intelligence product. Every vulnerability that appears on this site has been scored, classified and validated by a deterministic pipeline before publication. This page explains how.
Operational lanes
Every tracked vulnerability is assigned to one of five operational lanes based on evidence strength, not just severity numbers.
| Lane | Label | What it means |
|---|---|---|
| on_fire | Review Now | Confirmed active exploitation backed by authoritative evidence. Requires CISA KEV listing or corroborated active/ransomware status with strong typed evidence. Recent items only — after 45 days, confirmed-but-stale items decay to Patch Priority so they stop dominating the daily brief. |
| hunt_today | Hunt Today | High-value context (identity infrastructure, OT/ICS) with a priority score of 35 or above and evidence beyond a press claim. Designed for defenders who hunt proactively, not reactively. |
| patch_priority | Patch Priority | Actionable threat with specific asset relevance: a public PoC targeting edge/identity/OT assets, EPSS ≥ 0.50 on critical context, or a KEV item that has aged past the Review Now window. |
| watchlist | Monitor | Tracked due to high score (≥ 40), critical CVSS (≥ 9.0), or elevated EPSS (≥ 0.10), but no confirmed exploitation or urgent context trigger. |
| background | — | Low priority or insufficient signal. Not surfaced on the site. |
A key principle: items flagged as claimed (exploitation reported in the press but not corroborated by authoritative evidence) can never reach the Review Now lane. The entire system is designed around this boundary.
Priority scoring
Each vulnerability receives a priority score from 0 to 100. The score is additive and deterministic — no manual overrides, no editorial discretion.
Base signals
| Signal | Points | Trigger |
|---|---|---|
| CISA KEV membership | +30 | Listed in the CISA Known Exploited Vulnerabilities catalogue |
| Active exploitation confirmed | +30 | KEV or corroborated active exploitation text signal |
| Public PoC available | +20 | Referenced in VulnCheck, Nuclei, Metasploit, ExploitDB, or PacketStorm |
| CVSS ≥ 9.0 (critical) | +20 | NVD-sourced CVSS score |
| CVSS 7.0–8.9 (high) | +10 | NVD-sourced CVSS score |
| EPSS ≥ 0.50 | +25 | Very high exploit probability |
| EPSS ≥ 0.10 | +12 | Elevated exploit probability |
| EPSS ≥ 0.01 | +5 | Above baseline |
| VulnCheck public exploit | +15 | VulnCheck exploit database reference |
| VulnCheck ransomware use | +20 | Confirmed ransomware campaign use |
| Linked security research repo | +20 | News item references a GitHub PoC or security research repository |
Recency bonus
More recently published vulnerabilities receive a small bonus: +10 within 7 days, +5 within 30 days, +2 within 90 days.
Contextual signals
The pipeline scans vulnerability descriptions for high-value context. These signals add score but do not promote exploitation status on their own:
- Remote code execution / arbitrary code (+15)
- SCADA / ICS / OT (+12)
- Unauthenticated access (+10)
- Critical infrastructure (+10)
- Ransomware mention (+10)
- Authentication bypass (+8)
- Edge device / router / firewall / VPN (+8)
- Path traversal (+5), SQL injection (+5), Deserialization (+5)
Source corroboration
Multiple independent sources covering the same vulnerability add +5 per additional source, up to +15.
Exploitation status
Each vulnerability carries an exploitation status that tracks how far along the exploitation lifecycle it is:
| Status | Meaning | What promotes to this level |
|---|---|---|
| none | No exploitation signal detected | Default for new CVEs |
| poc | Public proof-of-concept exists | VulnCheck exploit DB, Nuclei/Metasploit/ExploitDB template, or text signal |
| claimed | Exploitation claimed in reporting, but uncorroborated | Text signals from news sources without strong typed evidence |
| active | Active exploitation confirmed | CISA KEV listing, or active text signal backed by vendor advisory or telemetry |
| ransomware | Ransomware operator use confirmed | KEV ransomware flag or VulnCheck ransomware confirmation |
The distinction between claimed and active is critical. A news headline saying “actively exploited” is a text signal that starts at claimed; it only reaches active status when backed by strong evidence.
Evidence strength
Not all sources are equal. The pipeline classifies evidence into strong and weak categories:
Strong evidence (can confirm active exploitation):
- KEV — CISA Known Exploited Vulnerabilities catalogue entry
- Vendor confirmed — authoritative advisory from a national CERT (CISA, CERT-EU, CERT-Bund, CERT/CC) or vendor security response
- Telemetry — exploitation observed in scan/sensor data (VulnCheck, GreyNoise, Shadowserver)
Weak evidence (cannot confirm active exploitation alone):
- Public PoC — exploit code exists (Metasploit, ExploitDB, Nuclei, GitHub research) but observed use is unconfirmed
- News claim — media reporting of exploitation without authoritative backing
A vulnerability reported as “actively exploited” by a news outlet but lacking KEV listing, vendor advisory, or telemetry data will be classified as claimed, not active. This is intentional — it prevents unverified press claims from driving urgent operational response.
Confidence levels
Each item receives a confidence level derived from the combination of score, evidence, and source quality:
| Condition | Confidence |
|---|---|
| KEV-listed, or active/ransomware status | High |
| Score ≥ 60 with 2+ independent sources | High |
| Claimed status with score ≥ 35 | Medium |
| Score ≥ 35 | Medium |
| News-only source | Low |
| Score below 25 | Low |
Claimed items are capped at medium confidence regardless of score — uncorroborated text claims cannot reach high confidence.
The critic gate
After scoring and lane assignment, every item passes through a critic gate — a validation layer that can only hold or downgrade, never promote.
The critic enforces rules such as:
- Items in the Review Now lane without KEV or strong evidence are downgraded
- Claimed items that reached Review Now through score alone are moved to Monitor
- Items with placeholder CVE identifiers, no sources, or no primary authoritative source are held
- Active/ransomware status without strong evidence is downgraded to claimed
The critic gate ensures that no item reaches the site with inflated urgency. An item that fails the critic is either held for review or placed in a lower lane — it is never deleted or hidden.
EPSS trends
Where available, crash.run tracks EPSS (Exploit Prediction Scoring System) score movement over a rolling window. A rising EPSS score may indicate growing attacker interest before exploitation is confirmed. Research pages show the current EPSS score alongside the trend direction and delta.
What “no report” means
When a vulnerability appears in the Data Hub but has no full research report, this is usually an honest evidence outcome — the pipeline determined that available evidence was insufficient for a substantive report. This is not a bug. crash.run does not generate reports to fill space; it generates reports when the evidence supports them.
The pipeline runs daily. All scoring weights, evidence gates, and lane thresholds are defined in code as constants — there are no manual overrides or editorial adjustments.