SERAPH CTI tracks a continuously updated catalogue of vulnerabilities and enriches them with severity, exploitability, known exploitation, ransomware activity, affected technologies and threat intelligence — to help security teams prioritise what matters.
CVE-2026-XXXX
Vendor / Product
Technology match
Fortinet FortiOS
Key vulnerability intelligence metrics from across the threat landscape. Select a card to explore that slice of the catalogue.
Thousands of vulnerabilities can affect a modern technology environment. Treating every Critical CVE equally creates noise. Effective prioritisation requires severity, exploitability, active exploitation, technology relevance and business context — combined, not read in isolation.
A vulnerability is disclosed.
How severe could this be, in theory.
How likely is exploitation, in practice.
Is a working exploit public or observed?
5 vulnerabilities from NVD, enriched with EPSS and cross-referenced against the CISA KEV catalogue.
This is why Seraph doesn't prioritise by CVSS alone — a 9.8 with no exploitation evidence and a 7.2 being actively exploited by a ransomware group are not the same problem.
A theoretical worst-case severity score based on the vulnerability's technical characteristics — not whether anyone is actually exploiting it.
A probability, updated daily by FIRST.org, that a vulnerability will be exploited in the wild within the next 30 days.
Not a prediction — an authoritative record that real-world exploitation has already been observed.
Whether the affected technology is one you actually run, and what threat activity is documented against it.
This catalogue tells everyone the same thing. Signed-in Seraph CTI customers declare the technologies they run once, and get notified the moment a new vulnerability matches their stack — not the other thousands that don't.
Of 14,101 tracked vulnerabilities, 1,685 have confirmed real-world exploitation (CISA KEV) and 352 are associated with known ransomware use. Where evidence exists, Seraph connects a vulnerability to the exploit, campaign and ransomware activity behind it.
Seraph does not infer exploit, campaign or threat-actor links that aren't independently sourced — an unverified relationship is worse than none.
Seraph tracks threat actor groups separately, sourced from MITRE ATT&CK's public dataset — real documented techniques, tools and campaigns for 176 groups. A specific vulnerability is only linked to an actor here when that connection is independently reported, not inferred from shared vendors or timing.
Most CVEs won't have a documented actor link — MITRE ATT&CK tracks behaviour and technique use, not CVE-level exploitation, and that gap is left visibly open rather than filled with a guess.
Explore Threat Actor IntelligenceNot every vulnerability carries the same weight in every sector. Seraph CTI flags vulnerabilities relevant to technologies commonly deployed within identity, network/edge, server and cloud infrastructure for a given industry.
Seraph describes vulnerabilities as relevant to technologies commonly used in a sector — never as evidence that a specific CVE is actively targeting it, unless that targeting has been independently confirmed.
Where evidence supports it, Seraph CTI adds regional context — technology relevance, observed exploitation, sector exposure and reported campaigns specific to East Africa.
A single vulnerability record flows across the Seraph platform, not just into a report.
Understand what the vulnerability affects.
Combine severity, exploitability and threat context.
Apply the appropriate patch, mitigation or control.
Confirm remediation and continue monitoring.
Monitor technologies your organisation uses, receive threat-informed vulnerability intelligence and focus remediation on the risks most likely to matter.
Urgent
Patch / mitigate immediately
Confirmed — this one is being exploited.
Is it tied to known ransomware campaigns?
Which actors, if any, are documented using it.
Does it touch what you actually run.
Is that technology in your declared stack.
What to do, and by when.
| CVE | Vendor / Product | CVSS | EPSS | CISA KEV | Ransomware | Published | Action |
|---|
CVSS shown reflects NVD's published base score; where a CVE predates this catalogue's sync window and hasn't yet been scored, it displays as “Not scored” rather than an invented value.
Is remediation tied to controls, risk obligations or evidence?
Does this vulnerability affect an asset or technology we use?
Can the vulnerability be safely validated?
Are there indicators of attempted or successful exploitation?
Is remediation tied to controls, risk obligations or evidence?
Can't find what you need? Ask a security expert.
Here's one of the highest-priority vulnerabilities in the current catalogue, shown exactly as Seraph CTI tracks it.
Metabase allows a remote, unauthenticated attacker to inject arbitrary SQL via the '/reset_password' database endpoint and gain administrator access to the connected Metabase instance.
The vendors with the most tracked vulnerabilities in the current catalogue window — a starting point for understanding where exposure concentrates, not a ranking of vendor security quality.
Computed live from the full tracked catalogue.
Is disclosure volume accelerating?
■ Critical ■ Other severities
Where does exposure concentrate?
How severe is the tracked catalogue overall?
How exploitable is the average tracked CVE?
How many tracked CVEs are tied to ransomware?
How much of the catalogue is confirmed-exploited?
