boxscore/security is a daily page of record for published software vulnerabilities, in the shape of a newspaper sports page. Once a day it reports, in dense tabular form, everything that happened in the public vulnerability record during the previous UTC day: what was disclosed, what got weaponized, what got patched, and how the running totals moved. It reports; it does not analyze, rank by opinion, or editorialize.
The page has four fixed sections. Standings are running per-sector, per-vendor aggregates. Leaders are trailing-30-day leaderboards. Transactions are the day's status changes — KEV additions, patches, rescores, rejections, enrichments. Yesterday's Results is every CVE published that UTC day, ranked by a fixed, published formula and rendered as box scores. Reference pages for individual vendors, weakness classes, ecosystems, and CVEs assemble the cumulative record. See the methodology for the ranking rule, the UTC day boundary, and full source attribution.
boxscore/security is a personal project operated by Ron Diver in the United States. It is free to read and requires no account. It is not affiliated with, endorsed by, or sponsored by NIST, CISA, FIRST, MITRE, the CVE Program, or OSV; those organizations publish the underlying data, which this site compiles and presents. Questions, corrections, or takedown requests: rondiver@gmail.com.