Project
CVSS + EPSS + KEV Risk-Priority Scorer
Turn a list of CVEs into a single ranked queue that reflects exploitability, not just severity.
- Problem
- CVSS base score alone over-flags. A queue sorted by it buries the few findings that are actually being exploited under thousands of high-but-quiet ones.
- Approach
- A small Python library that pulls CVSS from the NVD feed, exploit-prediction scores from the FIRST EPSS API, and known-exploited status from the CISA KEV catalog, then blends them into one transparent priority score with tunable weights.
- Result
- A CSV or notebook in, a ranked action list out — with the reasoning for each rank shown, so a remediation team can defend the order to system owners.
- Python
- pandas
- requests
- NVD API
- FIRST EPSS
- CISA KEV
- Jupyter
What it will show
- Clean handling of three public data sources with different shapes, refresh cadences, and rate limits.
- A scoring function that is explainable — every rank comes with the CVSS vector, the EPSS percentile, and the KEV flag that produced it.
- Sensible defaults with knobs: weight exploitability vs. impact, boost internet-facing assets, hard-pin anything in KEV to the top.
Data sources
All public, no credentials, nothing derived from a real environment:
- NVD JSON feeds for CVSS base metrics.
- FIRST EPSS API for daily exploit-prediction scores.
- CISA KEV catalog for known-exploited CVEs.
Status
Planned. This page is the spec I’m building against; it becomes a full write-up with a public repo once the first working version lands.