CVE Risk Brief (NVD + EPSS + CISA KEV)
Pricing
from $4.00 / 1,000 results
CVE Risk Brief (NVD + EPSS + CISA KEV)
Give CVE ids, get one clean row each: CVSS score, EPSS exploit probability, CISA Known-Exploited flag, affected vendor/product, and a ready-to-use priority label (act_now / high / medium / low). Official sources, no API key.
Pricing
from $4.00 / 1,000 results
Rating
0.0
(0)
Developer
Sasha Secrier
Maintained by CommunityActor stats
0
Bookmarked
2
Total users
1
Monthly active users
2 days ago
Last modified
Categories
Share
Give it CVE ids, get one clean row per CVE that answers "how urgent is this?": CVSS score, EPSS exploit probability, whether CISA lists it as actively exploited, the affected vendor/product, and a ready-made priority label. No API key needed.
Output
{"cveId": "CVE-2021-44228","found": true,"priority": "act_now","cvssScore": 10.0,"cvssSeverity": "CRITICAL","epss": 0.99999,"knownExploited": true,"kevDueDate": "2021-12-24","kevRansomwareUse": "Known","vendor": "Apache","product": "Log4j2","summary": "CVE-2021-44228 is in the CISA Known Exploited Vulnerabilities catalog (used in ransomware campaigns); exploitation probability in the next 30 days 100.0% (EPSS); priority: act_now"}
Other fields: description, published, lastModified, cvssVersion, cvssVector, cwes, epssPercentile, kevDateAdded, kevRequiredAction.
Priority rule (deterministic, documented)
| Label | When |
|---|---|
act_now | Listed in the CISA Known Exploited Vulnerabilities catalog |
high | EPSS >= 10% or CVSS >= 9.0 |
medium | EPSS >= 1% or CVSS >= 7.0 |
low | Anything else with data |
unknown | No CVSS and no EPSS data (new or unknown CVE) |
The label is a triage aid, not a replacement for your own risk assessment.
Input
| Field | Meaning |
|---|---|
cveIds | List of ids such as CVE-2021-44228 (max 50 per run). |
nvdApiKey | Optional free key from nvd.nist.gov; speeds up large lists. |
Without a key the Actor waits about 6.5 s between CVEs (NVD's public rate limit), so 50 CVEs take around 5 minutes.
Good for
- AI agents and security automations that must decide which vulnerability to patch first.
- Turning a scanner's CVE list into a prioritised report.
- Scheduled checks of a watchlist.
Data sources
NVD (NIST), FIRST EPSS, and the CISA KEV catalog. This Actor is independent and not affiliated with or endorsed by these organisations. Data is returned as published; verify before acting on critical systems.
Pricing
Pay per result (one row = one CVE). See the pricing box on this page.