Exploited Vulnerabilities Dashboard
How to use

Getting value from the dashboard

The dashboard answers two questions: what is being exploited, and which countermeasures, controls and CAF outcomes matter as a result. Start with the quick start, then use the workflow for your role.

Quick start

  1. Pick a time window on the Overview: 7 days for this week's news, 90 days for trends.
  2. Read the panels. CAF pressure shows where exploitation lands in the CAF. Top techniques shows how attackers are getting in.
  3. Click any bar to open Explore with that filter applied.
  4. Click a vulnerability to see its full chain, from weakness through technique and countermeasure to CAF outcome.

Reading a vulnerability's chain

Every vulnerability on the Explore page opens a four-step chain.

1 · Weakness

The CWE weakness type, and related CAPEC attack patterns for context.

2 · Techniques

The ATT&CK techniques the vulnerability enables. A CTID badge means curated; heuristic means rule-based.

3 · Countermeasures

D3FEND countermeasures and NIST 800-53 controls that address those techniques.

4 · CAF outcomes

The NCSC CAF contributing outcomes involved, each with the reason it was linked.

Workflows by role

Vulnerability management

Weekly triage of newly exploited vulnerabilities

  1. Open Explore with the last 7 days and your watchlist.
  2. Tick Ransomware to see the most urgent first, then untick it to review the rest.
  3. Check the EPSS column: a higher score means exploitation is more likely in the next 30 days, so deal with those first.
  4. Open each vulnerability, read CISA action, and check the vendor advisory before raising a ticket.
  5. Use Download CSV to drop the list into your tracker.

CAF assessors and assurance leads

Decide which CAF outcomes to re-check

  1. Open the CAF view and set the window to 90 days.
  2. Outcomes at the top are under the most exploitation pressure. Start there.
  3. Use each outcome's top techniques and countermeasures as prompts: are those controls in place and evidenced?
  4. Click See vulnerabilities to get the specific CVEs to cite in your assessment notes.

Security architects and design reviewers

Check that designs and patterns defend against what is being exploited

  1. On the Overview, read Top ATT&CK techniques for the last 30 or 90 days.
  2. Click a technique, for example T1190 Exploit Public-Facing Application.
  3. Open any vulnerability and read step 3 of its chain: the D3FEND countermeasures and NIST 800-53 controls.
  4. Compare those against your control patterns and the design in front of you.

SOC and detection engineers

Prioritise detections for active techniques

  1. Filter Explore to the last 30 days and pick a technique.
  2. In each vulnerability's chain, look for D3FEND countermeasures under the Detect tactic.
  3. Check whether you have detection content for those techniques; prioritise those with ransomware use.

CISOs and senior managers

A one-page view for briefings

  1. Use the Overview with a 30-day window: headline counts, CAF pressure and vendor watch.
  2. Share the page link: the window and filters you choose are kept in the URL on the Explore page.
  3. Or embed the compact widget in another dashboard (see below).

Subscribe by RSS

Get new exploited vulnerabilities delivered to you. Each item has the vendor, ransomware flag, EPSS score, ATT&CK techniques, D3FEND countermeasures, CAF outcomes and a link to the full chain. Feeds update when the data refreshes, twice a day.

Newly exploitedEvery vulnerability added to KEV in the last 30 days.https://www.cyberteam.uk/feed.xml
Open
Known ransomware useOnly the ones CISA links to ransomware campaigns: the most urgent.https://www.cyberteam.uk/feed-ransomware.xml
Open
Vendor watchlistOnly products from watchlist vendors such as Microsoft, Cisco, Fortinet and Ivanti.https://www.cyberteam.uk/feed-watchlist.xml
Open

How to subscribe

  • Feed reader (Feedly, Inoreader, NetNewsWire): add a new feed and paste the address.
  • Outlook (classic desktop): right-click RSS Subscriptions in the folder list, choose Add a New RSS Feed, paste the address.
  • Microsoft Teams: in Power Automate, create a flow with the When a feed item is published trigger and a Post message in a chat or channel action.
  • Slack: add the RSS app, then type /feed subscribe followed by the address in the channel.
  • Email: use the same Power Automate trigger with a Send an email action.

Explore filters

SearchMatches CVE ID, vendor, product or vulnerability name.
AddedWhen CISA added the vulnerability to the KEV catalogue (7 days to all time).
VendorOne vendor, as named in the KEV catalogue.
CAF outcomeVulnerabilities linked to a specific NCSC CAF contributing outcome.
TechniqueVulnerabilities linked to a specific MITRE ATT&CK technique.
MappingMITRE CTID (curated), heuristic (rule-based), or unmapped.
RansomwareOnly vulnerabilities CISA records as used in ransomware campaigns.
WatchlistOnly vendors on the watchlist, which reflects common UK public-sector products.

Key terms

KEVCISA's Known Exploited Vulnerabilities catalogue: vulnerabilities confirmed as exploited in the wild.
EPSSExploit Prediction Scoring System (FIRST): the probability of exploitation in the next 30 days.
ATT&CKMITRE's catalogue of attacker tactics and techniques, such as T1190.
D3FENDMITRE's catalogue of defensive countermeasures, grouped by tactic (Harden, Detect, Isolate and others).
NIST 800-53The US control catalogue. Links come from MITRE CTID's published mappings.
CAFThe NCSC Cyber Assessment Framework. Links here are a heuristic starter mapping, not NCSC guidance.
CTIDMapping curated by MITRE's Center for Threat-Informed Defense. The most reliable source here.
HeuristicMapping produced by transparent rules from the vulnerability type and product. Treat as indicative.

Share, export and reuse

  • Share a view: filters on the Explore page are kept in the URL, so you can copy and send it.
  • Spreadsheet: kev-enriched.csv has one row per vulnerability.
  • Open data: dataset.json and linked data in graph.jsonld.
  • RSS: subscribe to new items with the feeds above.
  • Embed the compact widget in another dashboard. Add ?theme=dark for dark backgrounds:
<iframe src="https://www.cyberteam.uk/embed/"
  width="100%" height="520" style="border:0"
  title="Exploited Vulnerabilities Dashboard"></iframe>

Use it well

  • It does not know your estate. Use it to prioritise, and confirm exposure with your own asset inventory and scanners.
  • Check the vendor advisory before acting. This is a prioritisation aid, not threat intelligence.
  • Treat heuristic and CAF mappings as indicative. CTID mappings are curated; the others are reasoned but unofficial.
  • KEV is a US catalogue. Also watch NCSC advisories for UK-specific exploitation.
  • Data refreshes twice a day (06:23 and 19:23 UTC). The build date is shown under each page heading.
  • See Method & data for how every link is made and which sources refreshed.