Cyber intelligence — daily exploited vulnerabilities and threat activity

The pipeline behind this dashboard runs once a day, writes an immutable dated snapshot, and republishes — the date selector replays any past day. It reads four public feeds (CISA KEV, NVD, CISA advisories, ransomware leak-site postings), correlates them into a confirmed-exploited-criticals view, and maps ransomware victim claims by country. Three of four sources need no API key, so it runs live out of the box; the optional NVD key only raises a rate limit. Per-source fetch status ships inside every snapshot. As with every prototype on this site: not an operational tool, and ransomware postings are unverified criminal claims — see the investigation Cyber intelligence as a daily instrument.