How we score CVEs
What the EVULNABLE Risk Score (EVRS) measures, where each number comes from, and what the status chips mean.
What EVRS measures
CVSS answers “how severe is this flaw?” EVRS answers “how soon should this be fixed?” A known-exploited CVE with a moderate CVSS can outrank a CVSS 9.8 with no exploitation signal.
Most CVEs in a release are not known to be exploited, so most sit in Elevated or below, even when the vendor rates them Critical.
What it weighs
8 factors| Factor | What it measures |
|---|---|
| Active Exploitation | A vendor's own confirmation of exploitation in the wild, independent of CISA's listing. |
| CISA KEV | Listed in CISA's Known Exploited Vulnerabilities catalog — the US government's own confirmation that this CVE has been exploited. |
| CVSS | The CVSS base score — raw technical severity, independent of whether anyone is exploiting it. |
| EPSS | FIRST's Exploit Prediction Scoring System: the probability of exploitation in the next 30 days. |
| KEV listing recency | How recently CISA added the CVE to the KEV catalog. Something listed last month needs action this week; something listed in 2021 has been in the catalog for years: still exploited, no longer new. |
| Microsoft Exploitability Index | Microsoft's own Exploitability Index, for CVEs that come from a Patch Tuesday release. |
| Public Disclosure | Disclosed publicly before a patch shipped, so defenders and attackers learned of it at the same time. |
| Ransomware | CISA records this CVE being used in a known ransomware campaign. |
Most factors with no data behind them contribute nothing and are reported as a gap rather than scored as a zero — the difference between “checked, and it is not exploited” and “nobody has said”. Three factors are the exception — CISA KEV status, active exploitation, and FIRST’s EPSS score — because most CVEs genuinely are not KEV-listed or exploited, so a missing reading there is scored at that population base rate rather than left out of the score entirely; this only changes the number, not the honesty of the gap list, which still names all three as unconfirmed. That is what the Intelligence coverage line on a card is counting — and its denominator is what was obtainable for that CVE, not a flat 100, so an entry is never marked down for a source that could not apply to it. A CVE page’s own Evidence available: N of M signals reads from that same underlying data, one row per applicable factor stating its actual reading — but counted flat, each signal worth one toward N and M alike, not weighted by the points behind it the way Intelligence coverage is.
Priority bands
Live counts, 25 Oct 08:57 UTC| Score | Band | Recommended priority | CVEs now |
|---|---|---|---|
| 85–100 | Immediate | Patch Immediately | 457 |
| 65–84 | Urgent | Patch This Cycle | 910 |
| 10–64 | Elevated | Scheduled Maintenance | 1,300 |
| 4–9 | Routine | Monitor | 157 |
| 0–3 | Informational | Monitor | 132 |
Exigent flag
Exigent363 nowA flag inside Immediate, not a sixth band. It never pushes a score above 100. All of these must be true:
- In CISA KEV
- Confirmed actively exploited
- Published CVSS of 9.0 or higher (not derived from a severity word)
- At least one of: EPSS 90% or more, known ransomware use, or a CISA deadline within 14 days
Not in the score
Public exploit availability (Metasploit, Exploit-DB) is shown on CVE pages but not scored. A public module is not evidence of real-world use.
An environment-aware version of the score exists and is not used on this site. The exact model is not published beyond this page.
Data sources
10 of 15 shown| Source | Used for | Refresh |
|---|---|---|
| Microsoft Security Update Guide (CVRF) | CVE list, titles, severity, exploitability signals, disclosure status | Every 6 hours |
| CISA Known Exploited Vulnerabilities (KEV) | Known-exploitation status, ransomware association, remediation deadline | Every 6 hours |
| FIRST EPSS | Exploit-prediction probability and percentile | Every 12 hours |
| NIST NVD | CVE search, and CVSS for KEV entries CISA's own schema does not carry | On demand, rate-limit aware |
| Cisco PSIRT, Red Hat, Google Chrome | Vendor-published CVSS, cross-referenced to fill the same gap | Every 6 hours |
| CyberSecurityTracker.ai | Fixed versions and vendor required actions, for CVE search | On demand, cached per CVE; background refresh every 24 hours |
| Check Point Research | Per-CVE threat research coverage — title, date and link only, shown on CVE pages | Every 6 hours |
| ENISA EUVD | The EU vulnerability database's own record of a CVE — the base score, its version and the assigner it lists — shown on CVE Lookup only, never fed into EVRS scoring | On demand, cached per CVE for 12 hours |
| endoflife.date | Microsoft lifecycle milestones (end of life, end of support, ESU) | Every 24 hours |
| Shodan | Exposed ports and services for the Domain Security Check — opt-in, single-domain only, never fed into EVRS scoring | On demand, cached per IP for 7 days |
Show all 15
| CVE Program (cve.org) | CVSS assigned by a CVE's own CNA, used only while NVD has not scored a KEV entry yet and labeled as the CNA's, not NVD's; also names which CNA assigned each score | Background, 5 new CVEs per run; cached 30 days, 7 if unscored |
| Rapid7 Metasploit | Whether a public Metasploit module exists for a CVE — shown on CVE Lookup only, never fed into EVRS scoring | Every 12 hours |
| GitHub Advisory Database | Per-CVE advisory cross-reference on CVE Lookup — identifier, summary and affected package ecosystems, display-only, never fed into EVRS scoring | On demand, cached per CVE for 6 hours |
| VulnCheck KEV | Known-exploited flag on CVE Lookup for CVEs VulnCheck lists and CISA KEV does not — display-only, never fed into EVRS scoring, not included in exports | Every 12 hours |
| RDAP registration data | Domain registration details in the Domain Security Check — registrar, registration state, created and expiry dates, registrar status, read from each top-level domain's own registry | On demand for each scan; the list of registry servers is read once per process |
Status chips and terms
| Term | Meaning |
|---|---|
| Actively Exploited | The vendor's own confirmation that this CVE is being exploited in the wild, as reported in that release. |
| CISA KEV | Listed in the CISA Known Exploited Vulnerabilities catalog. On a KEV-sourced view this is true of every row by construction, which is why those pages state it once as the source rather than repeating it as a separate flag. |
| Publicly Disclosed | The vendor's own flag that this CVE was disclosed publicly before a patch shipped. |
| EPSS | Two numbers, shown as one. The probability (0–1) is the chance of exploitation in the next 30 days and is what EVRS scores on; the percentile ranks that probability against every other scored CVE and is shown in brackets as context. A displayed percentile is capped at the 99.99th and a probability at 0.999: nothing sits at the 100th percentile of a population it belongs to, and EPSS never assigns a probability of 1. |
| CVSS | The Common Vulnerability Scoring System base score — raw technical severity, independent of real-world exploitation. Base scores from different CVSS versions are computed from different metrics, so the version is named wherever a score is shown and left unlabelled rather than guessed when unknown. |
| Intelligence coverage | How much of the weight budget had real data behind it, and out of how much was obtainable for that CVE. A score built on 65 points of evidence rests on less than the same score built on 100, so the gap is named — "no CVSS vector published" — rather than left as a bare number. The denominator excludes anything that could not apply: Microsoft's Exploitability Index covers Microsoft's own products, so a Meta or Oracle CVE is not marked down for lacking one. It measures completeness of evidence, not how sure we are of the result. |
| Exigent | A flag layered on the Immediate band, never a sixth band and never a score above 100. It has its own hue, distinct from every band color, so it cannot be misread as a level above Immediate. |
Data sources and attribution
Known-exploitation status, required actions, ransomware association and remediation deadlines come from the CISA Known Exploited Vulnerabilities Catalog. Exploitation probability and percentile are provided by FIRST.org’s EPSS, used under FIRST’s open data terms.
Microsoft Patch Tuesday data is sourced from the Microsoft Security Update Guide; CVE enrichment from the NIST National Vulnerability Database. This product uses data from the NVD API but is not endorsed or certified by the NVD.