VULNSOCIAL
Fix what matters
Start by selecting your industry, vendor, or product below
What to fix first
Ranked by attention across researchers, advisories, exploit references, and community discussion. Higher rank means more live signal, not a higher CVSS by default. Use search and sort to compare strength and recency.
Built for security engineers, SOC analysts, and DevSecOps teams who need signal over noise, not another unread severity queue.
Live dashboardVendors, trends, and indicators below use the same live pipeline. Filter by vendor or product to match your stack.
Vendors by Exposure
Select to apply CPE scope
Products by Exposure
Select vendor or product to apply CPE scope
Attention over time (30D)
Mention volume for the top 30 CVEs in this view. Toggle series to compare momentum.
Threat signal metrics
45,029
CVEs in scope
140,512
Signal volume
438
24h volume
24,274
Active exploitation
38,670
Patches / workarounds
Aggregate signal volume (30D)
Total mentions across in-scope CVEs. Spikes usually track advisories, PoC chatter, or exploitation reporting, not random drift.
Signal classification
Where discussion is coming from. Useful context when a CVE suddenly dominates a category.
- Disclosure61,245(46.1%)
- Patch23,994(18.1%)
- Active Exploitation22,560(17.0%)
- General19,816(14.9%)
- PoC5,147(3.9%)
Threat indicators
PoC references, exploit code, active exploitation, patches, and technical detail, aggregated for the current scope.
- Technical Details99,606(55.8%)
- Patch Available38,670(21.7%)
- Active Exploitation24,274(13.6%)
- PoC Mentioned11,161(6.2%)
- Exploit Code4,866(2.7%)
Why VulnSocial
The problem
Traditional tools optimize for severity. Your adversaries optimize for opportunity.
NVD and CVSS tell you what could be bad. They do not tell you what people are weaponizing, discussing, or patching this week. The result is the same backlog, reshuffled: alert fatigue with no clear order of operations.
Most teams do not lack CVE data. They lack a live read on where attention and exploitation momentum actually are.
The approach
Attention-driven risk, not score-driven noise.
VulnSocial aggregates real-time signals from researchers, exploits, advisories, and community discussion. We rank CVEs by what the landscape is amplifying: proof-of-concept mentions, active exploitation indicators, patch availability, and trending volume over the last 24 hours and 30 days. You filter by vendor and product so the feed matches your stack.
> pipeline.stream (live)
How it works
One post becomes signal: watch it move through ingest → classify → enrich → route.
Simo @SimoKohonen
Example post · pipeline demo
Webshells be flowing into Cisco SD-WAN honeypots now.. Exploitation of CVE-2026-20127 is looking pretty heavy, new actors popping up by the hour
ingest: raw post · CVE-2026-20127
15.7K views65 likes19 RTs2 replies20 bookmarks
- [ 01 ]
Ingest signals
We collect and classify mentions across channels that move before tickets do: advisories, researcher posts, exploit references, and technical discussion.
- [ 02 ]
Score attention
CVEs surface by signal volume and trajectory, not a static severity label, so spikes in discussion map to spikes in urgency.
- [ 03 ]
Surface threat context
Exploit momentum, PoC noise, active exploitation flags, and patch availability appear alongside each CVE so triage is factual, not guesswork.
- [ 04 ]
Scope to your stack
Filter by vendor and product (Microsoft, Apple, Cisco, and more) so the feed reflects exposure you actually run, not the entire internet’s backlog.
> loop: raw social post → classify → enrich with threat context → emit to your scoped feed
What you get
High-signal capabilities, not generic scanning slides.
Exploit momentum tracking
See when exploitation and exploit-code references accelerate, not just that a CVE exists.
Real-time signal aggregation
Mentions and classifications update continuously so your picture matches the current discussion.
Trending windows (24h / 30d)
Compare short-horizon spikes against sustained attention to separate flash from lasting risk.
Stack-specific threat view
CPE-aware filters narrow the universe to the vendors and products you deploy.
PoC and patch visibility
Proof-of-concept chatter and remediation signals sit next to severity so prioritization is grounded.
Attention-ranked CVE lists
Rankings reflect what the ecosystem is focused on, aligned with how incidents actually unfold.
Who it's for
One feed, three common workflows.
SOC analyst
Triage inbound noise against a live ranked list. When something spikes in the feed, you already have exploitation and PoC context before the ticket lands.
Security lead
Brief leadership with what the landscape is amplifying, not a spreadsheet sorted by CVSS. Align patch windows with real attention and exposure.
DevSecOps
Scope to your shipped stack, watch trending CVEs for those vendors, and coordinate fixes with evidence that a vulnerability is actively discussed or exploited.
The backlog is static. The threat landscape is not.
Open the live feed, scope to your vendors, and align the next patch cycle with what is actually gaining traction, not what scored highest on a spreadsheet last quarter.
About VulnSocial
VulnSocial is not a generic scanner. We aggregate and classify vulnerability signals from the channels that move first: researchers, advisories, exploit references, and community discussion. CVEs are ordered by attention and momentum, not CVSS alone. Active exploitation indicators, PoC noise, and patch availability sit next to each CVE so triage is grounded in what is happening now.
Scope the dashboard with vendor and product filters to match your stack. Security teams use VulnSocial to cut through alert fatigue: SOC analysts for ranked triage, leads for credible briefings, DevSecOps for stack-specific trending and remediation timing. Share snapshots with your team from the feed when you need to align on what matters today.