What is a CVE? Vulnerabilities, severity scores and CISA’s list

The terms

• CVE: Common Vulnerabilities and Exposures. A public ID like CVE-2026-12345 for one specific flaw, so everyone means the same thing.
• CVSS: a score from 0 to 10 for how severe a flaw could be. 9 and above is critical.
• CISA KEV: the U.S. Cybersecurity and Infrastructure Security Agency’s Known Exploited Vulnerabilities catalog, a list of flaws with evidence of real attacks. Federal agencies are required to fix them by set deadlines; everyone else should treat the list as a priority signal.

What to patch first

1. Anything on the KEV list that you runCriminals are already using it.
2. Critical flaws in things exposed to the internetYour website platform, plugins, server software, firewall, remote access tools.
3. Everything else, on a scheduleMonthly is reasonable for most small businesses.

Keeping up without reading every alert

Our vulnerability database pulls the KEV catalog and new WordPress, CMS and hosting-panel flaws twice a day, sorted for small businesses, and our security advisories write up the ones most likely to affect local sites in plain English.