Written out in full, because a security claim that will not show its working is worth nothing.
| CISA KEV | whether it is exploited at all, the date added, the federal remediation due date, known ransomware campaign use, and the required action, all quoted verbatim. |
|---|---|
| NVD | the CVSS base score and vector, the CWE, and the reference URLs. |
| EPSS | the probability of exploitation in the next 30 days, and the percentile. |
| Reachable without credentials | the CVSS vector is AV:N and PR:N. A property of the vulnerability. It is not a statement that any system is exposed. |
|---|---|
| Percentile band | EPSS's own percentile expressed in words, so "0.18" is read against every other CVE rather than in the abstract. |
| Days exploited | today minus the KEV date added. |
| Recency bucket | days exploited, cut at 30, 90, 180, 365 and 730. |
| Acute list | added within 90 days, reachable without credentials, percentile at or above 0.9. |
| Tier | 1 if reachable without credentials and top decile; 2 if either; 3 otherwise. A CVE with no vector gets no tier at all rather than a guess. |
It does not tell you whether you are exposed. "Reachable from the internet without credentials" describes the bug. Whether your estate is affected depends on what you run and where it is reachable from, which this corpus cannot see and does not guess at.
It is not a prediction of compromise. EPSS is a published probability that exploitation will occur, not a probability that any particular organisation is breached.
Being absent from a source is not a clean bill. A CVE with no CVSS vector is omitted rather than ranked, because an unknown vector cannot honestly be sorted.
Timing reflects the source, not us. A CVE added to KEV today may have been exploited for years first. CISA's date is the date it was added.
CISA's list answers one question: is this exploited. It is a list of 1726 items, and most of them share three properties - they are old, they need no credentials, and they have been exploited for years. A list where most entries share those properties cannot prioritise, because a reader has to do the prioritising themselves, which is the expensive part.
Joining the vector and the probability is not novel research. It is the same three public datasets, ordered so that the question "what do I do first" has an answer. That is the whole claim, and it is deliberately a small one.
The underlying data is CISA's, NVD's and FIRST's, all publicly available and all redistributable with attribution. The derived ordering is ours and is offered under CC BY 4.0. If you are a news organisation, a vendor, or someone building a tool, take it.