CoeLab Real-World Impact
Version 1.0 · Our editorial score runs from 0–100. It prioritizes practical risk for IT teams, developers, small organizations, and homelab operators. It is not an official vulnerability severity or personal risk score.
What goes into the score?
- Exploitation evidence and probability: up to 30 points. CISA KEV evidence is stronger than a public proof of concept. EPSS estimates exploitation probability, not impact.
- Attack reachability and prerequisites: up to 25 points. Remote, unauthenticated, low-complexity attacks receive greater priority.
- Technical consequences: up to 25 points, based on published CVSS severity and documented effects.
- Operational relevance: up to 20 points. Edge appliances and widely deployed infrastructure deserve attention; popularity is not assumed without evidence.
Reading the rating
85–100: Urgent. 70–84: High. 50–69: Elevated. Below 50: Monitor. Missing evidence stays unknown, not safe. Every article separates confirmed facts, predictions, and our judgment, and includes its evidence timestamp.
How we select stories
We monitor the official CVE List, including corrections, and enrich candidates with CISA KEV and FIRST EPSS. Rules screen every newly observed published record without an LLM. A capped cloud-model shortlist review precedes a stronger editorial review. The editor can reject a high-scoring story for weak evidence or insufficient reader value. We aim for 3–5 articles per week, never manufacture urgency to fill a quota, and may defer good candidates when the publishing budget is full.
Limits and corrections
A new CVE may lack CVSS or EPSS. We revisit recent records as evidence arrives and prioritize new exploitation evidence for older CVEs. Coverage depends on upstream availability; gaps are reported rather than treated as an empty feed. Ratings are not a substitute for checking your installed versions and vendor advisories. We link primary sources and correct articles when material facts change.
Sources: CVE Program, CISA KEV, FIRST EPSS.