Three scores, three questions
CISA KEV, EPSS and CVSS explained
CISA KEV
Is it being exploited right now?
A yes/no list kept by CISA of vulnerabilities attackers are confirmed to be using. Under 2,000 entries out of hundreds of thousands of CVEs, so a match matters.
EPSS
How likely is exploitation soon?
FIRST's daily estimate of the chance of exploitation in the next 30 days, from 0 to 100%. Most CVEs score under 1%.
CVSS
How bad would it be?
A 0 to 10 severity rating of the damage if exploited. Useful for impact, but thousands of Critical and High CVEs are never exploited.
A practical order: fix anything on KEV first, then high-EPSS findings, then the rest by CVSS severity. The full reasoning is in CVSS vs EPSS vs CISA KEV.
Questions
CVE checker FAQ
What is the CISA KEV catalog?
The Known Exploited Vulnerabilities catalog is a list kept by the US Cybersecurity and Infrastructure Security Agency (CISA) of vulnerabilities with reliable evidence of active exploitation. US federal agencies must fix them by a due date; everyone else should treat them as fix-first.
What is an EPSS score?
The Exploit Prediction Scoring System, published by FIRST, estimates the probability that a CVE will be exploited in the next 30 days. It is updated daily and comes with a percentile showing how the CVE compares with all others.
What is the difference between CVSS, EPSS and KEV?
CVSS rates how bad a vulnerability would be if exploited. EPSS estimates how likely exploitation is soon. KEV confirms it is already being exploited. Fix KEV entries first, use EPSS to break ties, and CVSS for impact.
How do I check a whole scan instead of one CVE?
Upload a Nessus, Qualys, Rapid7, OpenVAS or other scanner export to Varaxon Scan Hub. It checks every finding against KEV, EPSS and CVSS and puts the exploited ones at the top of the report.
More free checks
Sources: CISA Known Exploited Vulnerabilities catalog; EPSS data from FIRST.org; CVSS and descriptions from the NIST National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.