About
A wire service for defenders
The Security Standard reads about a hundred primary sources around the clock: vulnerability databases, vendor security teams, national CERTs, threat research labs, standards bodies and the trade press. It normalizes what they publish, attaches the structured signals that matter for triage, ranks everything with a model you can inspect, and links every line back to its publisher.
It exists because the morning routine of a security team is still a dozen browser tabs. The goal is one page that answers "what changed, what is exploited, what do I patch first, and what should I read" in the time it takes to drink a coffee, and a feed or API that fits into the tooling you already run.
What is in the archive
- Vulnerabilities: every CVE as NVD publishes it (rejected records are dropped), with CVSS base score and vector, CWE, CNA vendor and product data, CISA SSVC exploitation evidence, and EPSS probabilities. CISA KEV listings are merged onto the same record.
- Advisories: PSIRT bulletins from Microsoft, Apple, Cisco, Fortinet, Palo Alto Networks, Ivanti, AWS, Google Cloud and others; CERT/CC, CERT-EU, CCCS, JPCERT and MS-ISAC notes; CISA alerts, joint advisories and ICS advisories; distribution notices from Red Hat, Ubuntu and Debian.
- Research: threat intelligence and technical analysis from vendor labs and independent researchers.
- News: reporting from the trade press, breach notifications and agency press releases.
- Standards and policy: security-relevant RFCs, NIST drafts open for comment, NCSC guidance, ATT&CK and CVE Program announcements, and Federal Register documents.
Continuous ingestion began on 6 July 2026. Nothing is deleted, so the archive deepens daily and the search covers all of it. Coverage gaps happen when a publisher's feed is down or blocks automated access; the sources page shows the live state.
How ranking works
Every item carries an intrinsic score built from attributable signals. Each point has a reason, and the reasons are shown on the item page and in the rank badge's tooltip. The score never depends on age; a read-time recency bonus (15 within 24 hours, 6 within 72 hours, 2 within 7 days) is added when a page is rendered, so ranks decay without re-ingesting anything.
| Signal | Points | Where it comes from |
|---|---|---|
| Listed in CISA KEV | +40 | CISA KEV catalog, or the NVD record's KEV fields |
| Known ransomware campaign use | +8 | CISA KEV |
| Exploitation observed (not KEV) | +25 | CISA SSVC "active", or negation-aware reading of the publisher's text |
| Public exploit code reported | +12 | SSVC "poc", or the publisher's text |
| CVSS critical / high / medium | +18 / +10 / +3 | NVD primary metric, else the publisher's stated score |
| EPSS ≥ 0.5 / ≥ 0.1 | +15 / +6 | FIRST EPSS, refreshed daily for recent high-signal CVEs |
| SSVC automatable / total technical impact | +4 / +3 | CISA Vulnrichment via NVD |
| Exposed product class (edge, VPN, identity, email, file transfer, hypervisor, backup) | +12 | Product catalog match on vendor data or the headline |
| Other recognized product class | +5 | Same |
| Widely deployed vendor product | +6 | Catalog of major vendors |
| Covered by 3+ / 2 independent sources | +12 / +6 | CVE index across the archive |
| Fix available | +5 | NVD patch references, or the publisher's text |
| Source class: government / CERT / vendor PSIRT / standards body / research / news | +10 / +9 / +8 / +6 / +4 / +2 | Source registry |
Scores cap at 100. Tiers are derived from the rank: Critical at 70 or any KEV listing, High at 45, Notable at 25, Routine below. A freshly published CVE that NVD has not yet analyzed scores near zero on purpose: the firehose stays below the records with real signals until evidence arrives.
Text analysis is deliberately conservative. Phrases such as "not known to be exploited" or "no patch is available" are read as negations, never as evidence. Boilerplate mitigation language in agency advisories is stripped before analysis so that "place devices behind firewalls" does not make an item look like a firewall vulnerability.
Editorial policy
- Everything here is public information aggregated for defensive and educational use. Summaries are short, preserve attribution, and link to the original; read the source before acting.
- No exploit code, weaponization detail, stolen data or credential material is published or linked to on purpose. Research sources are chosen for defensive value.
- Vendor marketing, webinars and award posts are filtered out of research feeds by rule, and publishers who decline automated access are paused rather than circumvented.
- Ranking is guidance, not instruction. It is deterministic, inspectable and documented above, and it will be wrong sometimes; the item page always shows why.
- Mistakes in tagging or ranking can be reported to the operator (see the colophon). Corrections apply on the next re-index.
Reuse
- RSS: the wire, items that rank 20 or higher or are KEV-listed, newest first. Per section with
?section=advisoriesand so on. - Plain text: the briefing as 78-column text for terminals, email and pagers.
- JSON API: every filter the site offers, with cursor pagination and stable snapshots.
- OPML: the complete source list for your own reader.
Attribution appreciated, not required. Please cache; the API answers with Cache-Control headers and the data changes at most every half hour.
Colophon
Built as a Cloudflare Pages site with server-rendered HTML, a D1 database and a scheduled ingestion Worker; no framework, no build step, no client-side rendering required. Typeset in Newsreader and Public Sans, both self-hosted under the SIL Open Font License, with your system's monospace for data. There are no cookies, no analytics, no third-party requests and a strict Content Security Policy. Keyboard shortcuts, the theme toggle and the reading list use localStorage only.
Operated independently by a practitioner. The sister site Vulnpedia is a CVE reference built on the same principles. Contact: github.com/ShockinglyMoist.