Exploitation Signals
CVSS tells you how bad a vulnerability would be if someone exploited it. Exploitation signals tell you whether anyone actually has. CVD Portal draws that second answer from the Global CVE Allocation System (GCVE), an open vulnerability correlation platform operated by CIRCL, the Computer Incident Response Center Luxembourg.
Why this matters for Article 14
CRA Article 14(1) requires a manufacturer to notify its CSIRT within 24 hours of becoming aware that a vulnerability in its product is being actively exploited. The clock starts at awareness, so the question of when you could reasonably have known is a compliance question, not just an operational one.
The catalogue most organisations watch is CISA KEV. It is authoritative but not fast. GCVE aggregates five catalogues (CISA KEV, CIRCL, ENISA, Shadowserver and KEVIntel) under the GCVE-BCP-07 format, and several of them assert exploitation days before CISA lists it. Where an entry is reported ahead of CISA, the portal says so explicitly, because that gap is the window the 24-hour clock runs in.
What you see
Three signals appear alongside CVSS wherever the portal shows a vulnerability:
| Signal | Meaning |
|---|---|
| KEV · [catalogues] | One or more catalogues assert exploitation. The badge names which, because "KEV" alone reads as CISA and an Article 14 determination has to be able to point at its source. |
| EPSS n% | The FIRST Exploit Prediction Scoring System probability that this vulnerability will be exploited in the next 30 days. A forecast, not an observation. |
| SIGHTED ×n | Real-world observations collected by GCVE from public sources, honeypots and community contributions. Hover for the most recent. |
These appear on the Supply Chain Intelligence page, on CVE suggestions in the SBOM correlation panel, and in supply-chain alert emails and threat_intel.match webhooks.
The Article 14 prompt
When external sources begin reporting exploitation of a vulnerability recorded on one of your advisories, an evidence panel appears beside the "Actively exploited in the wild" checkbox on the submission. It names the reporting catalogues, gives the date exploitation was first reported, and offers a one-click confirmation.
The portal never ticks that box for you. The flag starts a statutory clock, and a third-party feed must not start one on your behalf: an upstream false positive would create a legal obligation you never chose to accept. Equally, only you can determine whether your product is genuinely affected by a vulnerability in a shared component. The evidence prompts the decision. You make it.
Daily watch
A daily job checks every identifier your company is exposed to, meaning the CVE recorded on each security advisory plus the advisory identifiers on your SBOM findings, and emails your alert recipients when the evidence escalates. Escalation means upward movement only: no evidence to a public proof-of-concept, or a proof-of-concept to reported exploitation. A catalogue retracting an assertion does not generate an alert.
Each escalation is recorded in the audit log as EXPLOITATION_SIGNAL_DETECTED, so the evidence trail behind an Article 14 determination is preserved.
Availability
Exploitation signals require a plan that includes supply-chain alerts. See Threat Intelligence for the wider feed and Article 14 Reporting for the notification workflow itself.
If GCVE is unreachable, the affected pages fall back to their previous behaviour rather than failing. Correlation reverts to an NVD keyword search and says so; exploitation badges are simply absent. No page depends on the service being up.