Is this CVE urgent? CVSS, EPSS & KEV in one lookup
Three questions decide how fast you have to move on a vulnerability: how bad is it (CVSS), how likely is it to be exploited (EPSS), and is it already being exploited in the wild (CISA KEV). This puts all three on one screen. Data is fetched live from NVD, FIRST and CISA in your browser.
Frequently asked questions
What does an EPSS score mean?
EPSS (Exploit Prediction Scoring System) is the probability, from 0 to 100%, that a vulnerability will be exploited in the wild within the next 30 days. FIRST publishes it daily and it updates as new threat data arrives.
What is the difference between EPSS and CVSS?
CVSS rates how severe a vulnerability is if exploited; EPSS estimates how likely it is to actually be exploited. A CVE can be CVSS 9.8 yet have a low EPSS, meaning severe in theory but not currently under attack.
What does it mean if a CVE is in the CISA KEV catalog?
The CISA Known Exploited Vulnerabilities catalog is an evidence-based list of CVEs confirmed exploited in the wild. Inclusion is the strongest signal to patch immediately, and U.S. federal agencies must remediate KEV entries by a set due date.
What EPSS score counts as high risk?
There is no official cutoff, but a common convention treats EPSS above about 10% as elevated and above 50% as high. Always pair it with KEV status: any KEV-listed CVE is high priority regardless of its EPSS.
Does a high CVSS score mean a CVE is being exploited right now?
No. CVSS measures potential severity, not active exploitation. Check EPSS for probability and CISA KEV for confirmed in-the-wild use to know whether it is actually being attacked.
How often are EPSS and KEV data updated?
EPSS is recomputed daily by FIRST; the CISA KEV catalog is updated whenever CISA confirms new exploited vulnerabilities. This tool shows the KEV catalog date so you can see how fresh that data is.
Do I need to patch every high-CVSS CVE first?
Not necessarily. Modern prioritization uses all three signals: patch KEV-listed and high-EPSS CVEs first, then work down by CVSS. A high CVSS with near-zero EPSS and no KEV listing is usually lower urgency.