Exploits Comes to Kitploit
From CVEs to PoCs, tools, and context: bringing vulnerability intelligence together in Kitploit
At Kitploit, we collect cybersecurity tools, many of which are exploits or PoCs. To bring more value to the ecosystem, we’re classifying these exploits, scanners, and PoCs and linking them to their corresponding CVEs, alongside relevant vulnerability data for context. We now have a dedicated space to look up vulnerabilities, find related material, and review the context before deciding what deserves a deeper investigation.
Our catalog and the sources that enrich it
Our starting point is the repositories we collect from GitHub, GitLab, and Bitbucket. We connect that material to the relevant CVEs and distinguish between exploits, PoCs, scanners, detections, patches, informational content, and research.
We enrich this catalog with information from several sources:
| Source | What it contributes |
|---|---|
| CVE List | Official CVE records, descriptions, references, and information published by the organizations responsible for assigning them. |
| NVD | The National Vulnerability Database, maintained by NIST, provides technical enrichment such as CVSS metrics, affected products, and references. |
| FIRST EPSS | Exploitation probability estimates and their historical evolution. |
| CISA KEV | Evidence of known exploitation and recommended actions from its catalog. |
| OSV | Information about affected packages and versions, vulnerable version ranges, and fixed versions when available. |
| Exploit-DB | Additional exploit and PoC references that complement the repositories indexed by Kitploit. |
Continuous improvement is part of Kitploit: we’ll keep adding sources, refining classification, and expanding the information that connects each vulnerability to the community’s technical work.
CVSS, EPSS, and KEV: three different signals
Vulnerability pages bring these signals together when they are available:
- CVSS describes the technical severity of a vulnerability. A high score alone does not establish that it is being exploited.
- EPSS estimates the probability of observing exploitation of that vulnerability in the next 30 days. It is not the probability that your organization will be attacked.
- CISA KEV lists vulnerabilities for which there is evidence of exploitation in the wild.
These are complementary dimensions: severity, probability, and observed exploitation.
Visibility for references that are not yet confirmed
A repository may mention a CVE identifier that does not yet have a canonical public record. Kitploit presents it as an unverified CVE, with a warning and links supporting the reference. This preserves the reference without presenting it as official confirmation or adding scores and metadata we do not have.
Absence from NVD does not, by itself, mean a CVE is unconfirmed. CVE List is our reference for record identity; NVD provides additional enrichment. A CVE can have an official record even if NVD has not yet incorporated its information.
Start with a CVE you already know
Look up a vulnerability you’ve investigated before and see which repositories, references, and context Kitploit now brings together.
You’ll also find the latest additions in Latest Exploits on the homepage, along with an RSS feed to follow new entries.
Explore Kitploit’s new Exploits section
If you find an incorrect association or a missing source, let us know. Your feedback helps us improve the catalog’s quality and decide what to add next.