Skip to content

Deterministic · Versioned · Transparent signals

See which CVEs show real-world exploitation signals.

One rules-based verdict per CVE, built from seven public threat-intel sources. No opaque model, no enterprise-only data, no ML hallucinations.

Try the web console — free View pricing

319,455

CVEs analyzed

7

Intelligence sources

6

Exploitability verdicts

  • Hosted in Frankfurt, EU
  • Rules-based, reviewable scoring
  • TLS 1.3 + WAF protected

Six verdict tiers

From ACTIVELY_EXPLOITED to UNKNOWN.

Every CVE collapses into a single label and a 0–100 score. No tabs, no toggles, no “contact sales for the real one.”

ACTIVELY_EXPLOITED

Score 95–98

Known exploitation in the wild. Review immediately against your environment.

Example: CVE-2021-44228 — Log4Shell

WEAPONIZED

Score 70–95

Strong exploitation signal from a Metasploit module or high EPSS.

Example: CVE-2017-0144 — EternalBlue

POC_AVAILABLE

Score 25–69

Public exploit or detection evidence is available for review.

Example: CVE-2023-23397 — Outlook NTLM leak

THEORETICAL

Score 10–24

No public exploit signals currently observed. Keep it in normal risk review.

Example: most low-severity library CVEs

NOT_APPLICABLE

Score 0

NVD marks the CVE rejected or reserved, so RealExploit does not score it.

Example: any **REJECT** entry in NVD

UNKNOWN

Reserved fallback

Insufficient signals to score. Returning conservative estimate.

Example: brand-new CVEs awaiting enrichment

How the verdict is built

Seven public sources. One score. Versioned engine.

No opaque ML and no proprietary feed lock-in. Each API response includes the scoring version, contributing signals and a human-readable reasoning trace.

  • NIST NVD
  • CISA KEV
  • FIRST.org EPSS
  • ExploitDB
  • Metasploit Framework
  • ProjectDiscovery Nuclei
  • Curated GitHub PoCs

Verdict response excerpt

GET /v1/cves/CVE-2021-44228/verdict
Authorization: Bearer rxe_live_...

{
  "cve_id": "CVE-2021-44228",
  "status": "analyzed",
  "verdict": "ACTIVELY_EXPLOITED",
  "score": 95,
  "reasoning": [
    "Listed in CISA KEV (Known Exploited Vulnerabilities)"
  ],
  "score_version": 1,
  "signals": {
    "in_kev": true,
    "has_metasploit_module": true
  }
}

Same shape on every tier. See what scales →

Real-world workflows

Built for the work that starts after your scanner finds a CVE.

RealExploit does not scan your environment. It enriches the CVEs you already have with repeatable exploitation evidence, so your team can make faster and more defensible prioritization decisions.

Vulnerability management

Triage scanner and SBOM findings

Enrich a CVE list with verdict, score, KEV, EPSS, CVSS and public exploit signals. Export the results to sort or join with asset criticality in your existing workflow.

Security research

Validate a new disclosure

Inspect the reasoning, affected products, publication timeline and public exploit signals behind a CVE without checking seven sources separately.

SecOps and incident response

Prioritize incident response

When an advisory or incident names multiple CVEs, identify which are in CISA KEV or show public exploit capability before deciding investigation order.

DevSecOps

Enrich CI/CD and ticket automation

Call the authenticated REST API from scripts or pipelines and use the structured verdict, score and raw signals in your own policy for tickets, reviews or build gates.

MSSPs

Run repeatable client reviews

Name a bulk job per authorized client engagement, upload a one-column CSV, and download reviewable evidence. Team and Enterprise jobs continue asynchronously and notify you when ready.

See the bulk workflow →

Security governance

Document remediation decisions

Filter lookup history by CVE, verdict or date and export the current evidence and scoring rationale for tickets, change records or internal reviews.

Bring a CVE — try the console

Why RealExploit

Built to support clear, reviewable security prioritization.

Deterministic verdicts

Rules-based scoring returns a verdict, a score version and a human-readable explanation of the result.

Reviewable evidence

Every verdict exposes its contributing signal values and reasoning. CSV exports preserve score version and timestamps for later review.

Automation-friendly REST

Authenticated REST for single and JSON batch lookups, plus asynchronous CVE-list analysis and detailed results export.

Pricing

Honest tiers. No usage cliff.

Web console for everyone. API on Pro and up. Full comparison →

Free

Try it without a card

$0

  • Web console
  • 5 CVE lookups / week
  • 10-row CSV cap (subject to weekly allowance)
  • Telegram gate to activate
Start free

Pro

For one engineer

$99/mo

  • Full REST API
  • 1,000 lookups / day
  • 100-CVE bulk CSV (sync)
Start Pro
Most teams

Team

3 shared seats

$499/mo

  • 150,000 lookups / day org-shared
  • 10,000-CVE CSV (async)
  • API batch up to 500 CVEs
  • Roles and email invitations
Start Team

Enterprise

10 seats, per-seat quota

$1,499/mo

  • 200,000 lookups / day per seat
  • 100,000-CVE CSV (async)
  • API batch up to 1,000 CVEs
  • Per-seat usage visibility
Start Enterprise

Prioritize CVEs by real-world exploitation evidence.

Bring CVEs from scanners, SBOMs or advisories, then combine the verdict with your own exposure and asset context.

Try the web console — free View pricing