How we know

The US agency CISA's catalogue of vulnerabilities proven to be under active exploitation. The least noisy source there is — and the only one that proves “under attack right now” rather than claiming it.

Security advisories from Germany's BSI as CSAF 2.0 documents, TLP:WHITE. German-language, broader than KEV, and the only source with a view of the German market.

CVSS scoring, attack vector and CPE identifiers for each CVE. It does not surface new flaws — it classifies known ones.

Support and security end dates per product line. Not a vulnerability source — but a version without security updates is the flaw that never gets fixed.

CVE raw records straight from MITRE — often hours ahead of the NVD entry. An hourly run reads the current day's delta archive and keeps what touches the catalogue; the daily run picks up stragglers. Where CISA has added it, we take over its exploitation status.

The same corpus as the CSAF documents, but with severity as a word, the portal ID and a one-line German summary — and as a cross-check on whether the CSAF index run is keeping up.

The handful of events per year for which Germany's BSI issues its own advisory with a criticality rating. It does not get less noisy than this in German.

ENISA's European vulnerability database — also lists flaws without a CVE ID and gives a second, independent mapping to products.

The first vendor advisory page in the set — and the only source that names both affected and fixed version ranges. Exactly the detail that turns “might affect me” into “affects me”.

German-language security journalism. Not proof but an early warning: what appears here is on the management's desk tomorrow.