CVE Risk Lookup

A vulnerability scan hands you a hundred CVEs and a deadline — this answers "which ones actually matter right now" by combining three independent, free data sources: CVSS (how bad the vulnerability is, from NVD), CISA KEV (whether it's being actively exploited in the wild, right now — not theoretical), and EPSS (FIRST.org's model estimating the probability of exploitation in the next 30 days). A low-CVSS bug with a high EPSS score, or any CVE on the KEV list, can be a higher real-world priority than a "Critical"-rated CVE nobody has ever bothered to exploit. Requires a live network request. Nothing you look up is logged or stored.

How the priority verdict works

Any CVE on CISA's KEV catalog is marked Critical regardless of its CVSS score or EPSS number — "someone is exploiting this today" beats every other signal by definition, and federal civilian agencies are required to remediate KEV entries by the catalog's own due date. Everything not on KEV is ranked by EPSS alone (probability of exploitation in the next 30 days): 50%+ is High, 10–50% is Medium, under 10% is Low. CVSS is shown alongside for context — it measures how bad exploitation would be, not how likely it is — but doesn't drive the priority bucket, since a 9.8-severity bug that's never been weaponized is a very different problem from a 5.0-severity bug being actively automated by botnets.

A note on scope

CVSS/description data comes from the NVD (preferring CVSS v3.1, falling back to v3.0 then v2 when that's all NVD has scored), KEV status from CISA's own catalog (cached here for a few hours, not fetched fresh per request — CISA updates it roughly daily, not by the minute), and exploitation probability from FIRST.org's EPSS. A CVE that's very recent (reserved but not yet published, or published in the last day or two) may not have NVD or EPSS data yet — that's normal, not a bug in this tool. Bulk triage checks up to 60 CVE IDs per request and skips CVSS/description lookups for speed (KEV and EPSS both support fast batch checks; NVD's API doesn't) — click through to a single lookup for the full detail on any one CVE. See also the IOC Lookup tool for indicator reputation rather than vulnerability data.