Nimstead Pulse is a daily report on published vulnerabilities and known exploitation. It combines NVD, CISA KEV and EPSS data, with a weekly brief and a tool for checking your own CVE list.
I wanted to show published vulnerabilities alongside known exploitation, since a rise in one doesn't necessarily mean a rise in the other. Pulse explains how it counts both.
What the numbers mean
NVD provides publication dates and vulnerability details. CISA's Known Exploited Vulnerabilities catalogue records confirmed exploitation. FIRST's EPSS estimates the probability of exploitation activity over the next 30 days.
The gap between CVE publication and a KEV listing measures how long it took CISA to add the record, not when exploitation began. Pulse calls this "days to KEV" and explains the distinction beside the chart.
Pulse excludes rejected CVEs from the counts and uses complete twelve-month periods for headline growth comparisons. The charts mark the current month as partial. A vulnerability's absence from KEV doesn't establish that it's safe. You still need information about your own systems to decide which fixes come first.
Keeping a CVE list private
You can paste or upload a list into the Your CVEs tool to analyse it in your browser. Your input stays in memory; it never enters a request, local storage or the URL.
Even when your input stays local, requests for individual CVE data files could reveal which vulnerabilities you're checking. Every visitor therefore downloads the same complete index.
If you request descriptions, the browser fetches all description files in a fixed order. This uses more bandwidth, but keeps the requests independent of your list. The privacy notes explain how this works.
A static site with daily data
A scheduled workflow runs the Python pipeline daily to process the feeds into JSON. The interface uses Svelte 5 and Vite and runs as static assets on Cloudflare Workers.
Reports are rendered to HTML during the build, so they're readable before the interactive data loads. Charts can be exported as PNGs or CSV, and the weekly brief collects recent changes and approaching KEV due dates.
Try Pulse or read the MIT-licensed code. The Nimstead branding is separately reserved. I've also written about applying and verifying fixes with Nimstead Assure.
