How we score
How bad is it - three questions, one box
We do not invent a score. The number is the industry's - CVSS, from NVD or the vendor - and the box says in plain words what it means.
1 · How bad can it get?
The CVSS score, 0 to 10, with what an attacker needs and what they can do if it works.
2 · Is anyone using it?
Our phase - reported, corroborated, confirmed, exploited - and CISA's list of known exploited vulnerabilities.
3 · Does it touch you?
Only you can answer that from outside. ReconX customers see which of their own systems are affected, and what to do first.
The scale - drawn to scale
- Low · 0.1-3.9 Hard to use, or little harm if used.
- Medium · 4.0-6.9 Needs conditions; limited harm.
- High · 7.0-8.9 Serious harm, some conditions.
- Critical · 9.0-10 Easy and severe.
Colour is never the only signal: every score carries its band name.
What an attacker needs
Read from the CVSS vector:
- Internet access to it - attack vector (AV): network, adjacent, local, physical
- A login - privileges required (PR): none, low, high
- A user to click - user interaction (UI): none, required
- Special settings - attack complexity and requirements (AC, AT in CVSS 4.0)
Red when it helps the attacker, blue when it holds them back, grey when not published yet.
If it works, an attacker can
Read from the impact:
- Run their own code - the type of flaw (remote code execution)
- Read the data - confidentiality (C)
- Change or delete data - integrity (I)
- Take it offline - availability (A)
Only what the CVE carries is listed.
The rules
- The score comes from NVD or the vendor, with its version (CVSS 4.0 or 3.1), its source and the date we read it. A missing score says "not published yet", never 0.
- A notice shows the worst score among its CVEs, and says which. ReconX shows every CVE.
- The one-line summary and the type of flaw are drafted from cited sources and approved by a person with the notice.
- A score is the worst case for the flaw. Whether a system is affected is a question about that system, not about the score.
Pro CISO publishes ReconX Watchtower notices from public sources so organisations can act early. A notice describes an issue, never any organisation's systems. Times are Amsterdam time. Report a vulnerability in our systems.
ReconX Watchtower opened to the public on 24 October 2026, in the wake of PHP2Shell - our contribution to a safer digital ecosystem.