Which vulnerabilities to patch first

Every published CVE, ranked by what predicts exploitation: CISA's evidence that a flaw is being exploited, then the daily EPSS probability. Rebuilt every day from CISA KEV, FIRST EPSS and the NVD.

Loading data…

Does the ranking work?

Share of the CVEs added to CISA KEV in the following 30 days that each strategy had ranked within the monthly budget, using only what was known on each decision date.

The numbers, by budget and by period

Patch first

The top of the ranking today. Known exploitation comes first; the deadline is the one CISA's directive BOD 26-04 sets for an internet-facing system.

Recently added to KEV

Who scores severity now

Source of each CVE's CVSS v3 score, by year of publication.

Our own dependencies

The same ranking applied to the Python dependencies of real systems, transitive ones included, matched against OSV.dev. The last one is an intentionally outdated example.