Dozens of CVEs are published every day and most are never used in an attack. A list sorted by date or by CVSS puts the loudest entries on top, not the ones being exploited. This watchlist uses three public signals, in a fixed order.
1. The KEV flag: exploitation was observed
A KEV mark with a red dot means the CVE is in the CISA Known Exploited Vulnerabilities catalog. CISA lists a CVE only with reliable evidence of exploitation and a clear remediation. It is the strongest signal available for free, so flagged entries always come first. The dates beside them are the day CISA added the entry and the due date it set for US federal agencies.
2. EPSS: how likely exploitation is
EPSS, from FIRST.org, estimates the probability that a CVE will see exploitation activity in the next 30 days. The list shows the probability and the percentile among all scored CVEs. Within each group, higher EPSS comes first. A new CVE often starts with a low score that rises once exploit code circulates, so check the EPSS lookup again a few days later.
3. CVSS: how bad it would be
The severity column shows one published CVSS assessment with its number, its label (critical, high, medium, low), the CVSS version and who published it: the NVD or the organisation that assigned the CVE. It only breaks ties. Open a CVE to see all published assessments side by side.
What the list does not tell you
Whether you run the affected product, and whether it is reachable by an attacker. Use the My stack filter to keep only the vendors and products you operate, then read the vendor advisory for each entry. A CVE that is absent here is not cleared: look it up by identifier in the CVE lookup.