CVE Triage — Which Vulnerabilities Actually Matter

Severity does not tell you what to patch. This Actor joins three open feeds that, together, do:

Feed	What it contributes
NVD	CVSS severity, affected products, references
EPSS	Probability the CVE will be exploited in the next 30 days
CISA KEV	Confirmed exploitation in the wild, plus the ransomware-campaign flag

Every other vulnerability Actor scrapes one of these. Joining them is the point.

The problem this solves

On a live sample of 56 CVEs rated CVSS 9.0 or higher, 35 of them — 63% — had an EPSS score below 1% and no record of exploitation. They were, in practice, not urgent.

A raw NVD feed hands you all 56 and calls them critical. This Actor tells you which 21 to look at first.

Priority ranking

Each CVE is assigned one of four bands, and the rule is stated plainly rather than hidden in a score:

Priority	Meaning
ACTIVELY_EXPLOITED	On CISA's KEV list. Someone is exploiting this right now.
PROBABLE	EPSS ≥ 10%. Exploitation is likely within 30 days.
ELEVATED	EPSS ≥ 1%, or critical severity with a real exploit signal.
STANDARD	Everything else, whatever CVSS says.

Rows come back sorted most-urgent-first, so capping results still returns the ones that matter.

Modes

kev — actively exploited (recommended). CISA's entire Known Exploited Vulnerabilities catalogue, ~1,685 CVEs, enriched with EPSS scores and full NVD detail. The highest-signal vulnerability list that exists.

recent — newly published. Triage the CVE firehose. Roughly 6,000 CVEs are published every two weeks; a minEpss of 0.05 typically reduces that to a handful.

search — by vendor or product. Every Fortinet, WordPress, Citrix or Apache CVE, ranked by exploitation risk rather than by severity.

Examples

Ransomware-linked vulnerabilities — the shortest, sharpest list:

{ "mode": "kev", "ransomwareOnly": true }

What actually needs attention this month:

{ "mode": "recent", "daysBack": 30, "minEpss": 0.05 }

Everything affecting a vendor, urgent first:

{ "mode": "search", "keyword": "fortinet", "includeStandard": false }

Your weekly patch list:

{ "mode": "kev", "minEpss": 0.1, "maxResults": 50 }

Output

{
  "cveId": "CVE-2021-44228",
  "priority": "ACTIVELY_EXPLOITED",
  "priorityRank": 1,
  "knownExploited": true,
  "knownRansomware": true,
  "epssScore": 0.99999,
  "epssPercentile": 0.99975,
  "kevDateAdded": "2021-12-10",
  "kevDueDate": "2021-12-24",
  "kevRequiredAction": "Apply updates per vendor instructions.",
  "cvssScore": 10.0,
  "cvssSeverity": "CRITICAL",
  "cvssVersion": "3.1",
  "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
  "published": "2021-12-10T10:15:09.143",
  "vendorProject": "Apache",
  "product": "Log4j2",
  "cwes": ["CWE-502", "CWE-400", "CWE-20"],
  "description": "Apache Log4j2 2.0-beta9 through 2.15.0 ...",
  "referenceCount": 103,
  "nvdUrl": "https://nvd.nist.gov/vuln/detail/CVE-2021-44228"
}

Field reference

Field	Meaning
priority / priorityRank	Triage band and its sort order (1 = most urgent)
knownExploited	Present in CISA's KEV catalogue
knownRansomware	CISA has linked it to a ransomware campaign
epssScore	Probability of exploitation within 30 days, 0-1
epssPercentile	Rank against all ~366,000 scored CVEs
kevDateAdded / kevDueDate	When CISA listed it, and the federal remediation deadline
kevRequiredAction	The remediation CISA specifies
cvssScore / cvssSeverity / cvssVector	Severity, from the newest CVSS version NVD publishes
vendorProject / product	Vendor and product, from the KEV entry
cwes	Weakness classifications
published / lastModified / vulnStatus	NVD lifecycle fields
referenceCount / references	Advisory links (first five)

Notes on the data

• EPSS is a probability, not a verdict. A score of 0.10 means roughly a one-in-ten chance of observed exploitation within 30 days. It is a prioritisation aid, not a guarantee in either direction.
• EPSS is re-scored daily, so results shift between runs. Each run records the model date in RUN_STATS.
• KEV is authoritative but lagging. A CVE appears once CISA has confirmed exploitation, which is after exploitation began. Absence from KEV is not evidence of safety — that is precisely what EPSS is for.
• Some CVEs have no EPSS score, usually very new or rejected entries. Setting minEpss excludes them.
• CVSS versions differ across records. The newest available is used, preferring 4.0 over 3.1 over 3.0 over 2.0, and the version is reported per row.
• NVD limits date windows to 120 days; the Actor rejects wider ranges rather than silently truncating.

Sources and conduct

All three feeds are public and require no authentication:

• NVD — NIST National Vulnerability Database
• EPSS — FIRST Exploit Prediction Scoring System
• CISA KEV — Known Exploited Vulnerabilities catalogue

Requests are rate-limited and backed off politely; NVD in particular is a free public service and this Actor pauses between pages rather than hammering it. Nothing here bypasses an access control.

Integrations

Output lands in a standard Apify dataset: export as JSON, CSV, Excel or XML, or wire it into Make, Zapier, n8n, Slack, Jira or your own code via the Apify API. Schedule it daily and alert on new ACTIVELY_EXPLOITED rows.