Each day you get one real, actively-exploited vulnerability from the CISA KEV catalog. Everyone gets the same one, and a new one unlocks at local midnight.
There are two ways to play it. Pick one with the toggle at the top.
Six tries at the CVSS v3.1 base score.
Four tries to pick all eight metrics. The score is derived from your choice.
One mode per puzzle. Your first guess of the day locks the mode in, because finishing either mode shows you the full answer — the score and the vector. The other mode unlocks with tomorrow's puzzle. Practice puzzles are exempt: switch freely there, nothing is recorded.