Severity (Critical / High / Medium / Low)
Radar's own composite risk score — not the same thing as a CVSS
score. It blends known-exploited status, real-world exploitation
probability, public exploit availability, how many sources are
reporting it, and whether it matches your stack into a single
0–10 priority ranking. Use it to decide what to look at first.
KEV badge
"Known Exploited Vulnerability" — this CVE is confirmed being
actively exploited in the wild, tracked by CISA and/or
VulnCheck. The strongest single signal that something needs
attention now, not just in theory.
Exploit available badge
Public proof-of-concept or working exploit code exists for this
vulnerability. It doesn't necessarily mean it's been used in a
real attack yet — but the bar for someone to use it has dropped.
EPSS
Exploit Prediction Scoring System — a 0–1 probability,
maintained by FIRST.org, estimating how likely this
vulnerability is to be exploited in the next 30 days. Higher
means more likely to be targeted soon; most CVEs score well
under 0.01.
CVSS vector
The industry-standard severity rating string (e.g.
AV:N/AC:L/PR:N/UI:N/...). Each letter pair encodes
one fact about how the vulnerability can be exploited:
- AV (Attack Vector) — N=Network, A=Adjacent, L=Local, P=Physical: how close an attacker needs to be
- AC (Attack Complexity) — L=Low, H=High: how hard it is to pull off
- PR (Privileges Required) — N=None, L=Low, H=High: what access the attacker needs first
- UI (User Interaction) — N=None, R=Required: does a victim need to click or do something
- C / I / A (Confidentiality / Integrity / Availability Impact) — N=None, L=Low, H=High: what happens if it's exploited
A CVE with AV:N/AC:L/PR:N/UI:N is about as bad as it
gets for reachability — exploitable remotely, with no special
access or user action needed.
ATT&CK technique tags (e.g. T1003.001)
MITRE ATT&CK technique IDs — a standard catalog of specific
attacker behaviors (T1003.001 is "OS Credential Dumping: LSASS
Memory"). A tag means the source content described that
specific technique being used. Look any ID up at
attack.mitre.org for the full writeup.
Threat actor / campaign tags
Named groups or campaigns (e.g. LockBit, APT29) that narrative
sources have attributed this activity to, when known.
