About cve-triage.tools

cve-triage.tools answers one question: how fast do I need to move on this CVE? Paste an ID and it shows the three signals that decide that, side by side: the CVSS base score from the NIST National Vulnerability Database, the EPSS exploitation probability published daily by FIRST, and whether CISA lists the vulnerability in its Known Exploited Vulnerabilities (KEV) catalog.

How the verdict is worked out

The headline verdict is a fixed ladder, checked top to bottom, and the first rule that matches wins:

1. On the KEV list: actively exploited, patch now. Confirmed exploitation outranks every score.
2. EPSS 50% or higher: high exploitation probability.
3. CVSS 9.0 or higher (Critical): severe, watch closely. Severe if exploited, with no sign yet that it is.
4. EPSS 5% or higher: elevated probability.
5. Everything else: lower urgency right now.

The ladder is deliberately simple so you can see exactly why a CVE got the label it did, and overrule it when you know something it does not, such as whether the affected product is exposed in your environment. The triage guide covers that part.

Where the data comes from

• CVSS and description: fetched live from the NVD 2.0 API when you look up a CVE. The NVD has a well-documented analysis backlog, so recent CVEs can appear without a score.
• EPSS: fetched live from the FIRST EPSS API, which recomputes every score daily.
• KEV: CISA's feed cannot be read directly from a browser, so the site keeps a copy that is refreshed from CISA every day. The catalog date is shown with each result.

Lookups go straight from your browser to those public APIs. Nothing you type is logged by this site.

Who makes it

cve-triage.tools is one of a small family of free security reference tools (the others are linked in the footer and collected at sec-ref.tools). They are built and maintained by a working security researcher who uses them day to day, because the generic calculators for these tasks are often out of date, cluttered, or wrong, and a good reference tool should not require an account.

Accuracy

Care is taken to keep the reference data correct, but these tools are provided for general information and estimation. For anything that matters, verify against the primary standard or data source, each of which is linked from the relevant tool. See the Terms for the full disclaimer.

Contact

Corrections, bug reports and suggestions are welcome. Email contact@sec-ref.tools, or see the contact page.