Paste what you run and see every CVE that touches it, with the evidence behind each one. Record your call with that evidence frozen beside it. When the evidence moves, you hear, and the next reviewer opens your record instead of rebuilding the case.
CVE-2025-62593 in Ray. A CVE is the identifier for a known software vulnerability.
Read the state. See exploitation, severity and movement together. Open a receipt to inspect the source behind a value.
Actual page, captured 19 September 2026. Open this CVE to inspect the sources and check a version.
NVD, CISA KEV and EPSS update in place. Six months after you defer or accept a CVE, the public page shows today's scores, not what was true when you signed off. vciy freezes the upstream state at the moment of your call so no engineer ever reconstructs old evidence by hand.
SOC 2, ISO 27001, PCI-DSS 4.0 and CISA BOD 26-04 examiners sample exceptions past their SLA and ask what you knew on the day you made the call. Replace screenshot folders and Slack archeology with one dated, hash-chained link the reviewer can verify independently.
Once a CVE is decided, routine score churn stays held back. You are paged only when new facts invalidate your specific premise: an accepted risk enters CISA KEV, a federal deadline moves inside your window, or a revised version range hits what you run.
Every score, version range and exploitation flag records when it became true upstream and when our index learned it. Where CNA and NVD authorities disagree, both are shown side by side rather than overwritten.
Browse this week's CISA KEV hubEvaluated on post-cutoff CVEs (receipt 1bad6b0f9c8287eb) with a 0 / 3 vs 7 / 17 fabrication gate. No model output ever enters the fact plane.
When you ask for an analytical reading, a separate verifier model checks every cited CVE, version and claim against the frozen index before a single sentence reaches your screen.
Compare against NVD, EPSS and KennaThe CVE page gives you the public evidence. Your decision record keeps your verdict, your reason and the evidence frozen when you record it. Put its link in the ticket so the next reviewer can inspect the basis for your call.
Sign in to keep your first 100 decision records free. Reading the CVE stays public.
See how Decision Vault worksUpgraded log4j-core to 2.17.1 across every service during the December 2021 disclosure window.
Retrospective worked example: the 2021 action was recorded in September 2026. Its frozen evidence is from record creation, not 2021. Customer records are private.
While your call holds, the routine alerts on that CVE are held back, and the weekly all-clear says how many. When new evidence breaks the call, you hear first, with the reason in one sentence: CISA lists an accepted risk as exploited, CISA's deadline moves before your patch-by date, or a revised range now covers your version. Decision Watch runs on every record, free ones included.
The more you use it, the better it gets: AI that learns your preferences and helps you reclaim your inbox. Press "Not relevant to us" and the CVE goes quiet until new evidence breaks that call. Every preference is a line you can read and remove. vciy's own model reads them before an alert reaches you, and a KEV listing, a CISA deadline change or a broken call always reaches you.
Had an incident, or a near miss? Open an investigation from the CVE page. It keeps what happened, who owns it, the products and CVEs involved and when to check back, with the evidence on its CVE frozen the day it opened. A year later, someone in another team finds it by searching your records. New evidence reaches you while it is open, and closing it adds a version that says what you found.
When the public record is not enough, go deeper inside the investigation: run automated deep code analysis ($49.99 per run) against your code path or call stack, or choose Send me an expert ยท contact us to bring an engineer into the thread.
Check what you run with no account. Sign in to watch one stack of three products and keep 100 decision records.
$0 No card PractitionerThree stacks with unlimited products, three seats, sitreps into Slack, Teams or Jira, and unlimited records.
$20 a month or $200 a year AdvisorTen stacks, each with its own register, sitreps and a monthly report sent to the client.
$125 a month or $1,250 a year CustodyRecords nobody can delete or edit, access history, and an auditor grant. We start with a review of your evidence.
$10,000 a year Book an evidence review: sales@vciy.comCustody starts with a conversation: write to sales@vciy.com. Need the system on your hardware? See On-Prem.