Prioritisation
Exploitation first, severity second
A fleet of thirty hosts can easily produce several hundred High and Critical findings. Sorted by CVSS alone, nothing tells you which few matter this week. CveDeck ranks every finding by three signals, in a fixed order.
KEV, then EPSS, then CVSS
CVSS says how bad a vulnerability would be if exploited. KEV says whether it is being exploited right now. EPSS says how likely that is to start. Both the fleet list and the findings table use this order by default.
-
1CISA KEV
Is it being exploited right now? The US Cybersecurity and Infrastructure Security Agency's catalog lists CVEs with confirmed exploitation in the wild. Findings on it come first, shown with the federal remediation due date.
-
2FIRST EPSS
How likely is exploitation to start? The Exploit Prediction Scoring System gives each published CVE a modelled probability of exploitation in the next 30 days. CveDeck shows the score and its percentile.
-
3CVSS
How bad would it be if exploited? The CVSS score comes after KEV and EPSS in the sort order. It still counts, but it no longer buries an exploited Medium under a Critical nobody has touched.
In practice, a CVSS 6.5 that CISA lists as actively exploited outranks a CVSS 9.8 that nobody has touched, because what is happening beats what could happen.
Why the percentile matters as much as the score
EPSS scores are heavily skewed. The overwhelming majority of CVEs score below 0.01, so an absolute score that looks negligible can still rank above most of the corpus. A rank reads correctly where a raw probability misleads, so CveDeck displays both.
Three exploitation states, never two
"Not on the list" and "never checked" look identical in most tools. They are not the same answer, so CveDeck keeps them apart at every layer, from the database to the screen.
| State | Meaning | Shown as |
|---|---|---|
| Listed | On CISA's Known Exploited Vulnerabilities catalog. | Exploited |
| Not listed | Checked against a usable catalog, and genuinely absent. | Not on KEV |
| Unknown | Not checked: no usable catalog existed when the finding was recorded. | A muted dash, never a zero |
A zero is an assertion; a dash is the honest absence of one. When no feed has ever loaded, the fleet's "Actively exploited" card reads "no exploit data loaded" rather than "0". See honest reporting for the same rule applied to scan results.
Where the data comes from
The two kinds of data are fetched differently, on purpose.
- Package advisories are queried during a scan. Package-level matching uses OSV.dev, which carries distribution trackers such as Ubuntu's and Debian's. OS-level matching against NIST NVD is available but off by default, because NVD's rate limits make an unkeyed fleet scan slow.
- Exploitation data is downloaded whole and cached. CISA KEV and FIRST EPSS each publish a complete file daily. CveDeck downloads them once and joins them offline, so enrichment adds no network dependency to a scan.
When a refresh fails
- A failed refresh never empties a good cache. Yesterday's answer beats no answer, and an empty catalog returned as a success is treated as a failure.
- Staleness is reported, not hidden. A feed's last-refreshed time only moves on success, and the dashboard shows a banner when a feed is stale or unusable.
- Refreshes are triggered outside the app. CveDeck has no scheduler yet: use a daily cron job, or the systemd timer the native installer sets up.
- New intel applies at the next scan. Refreshing the feeds updates the cache; existing findings pick up the new signals when their host is scanned again.
CveDeck isn't affiliated with OSV.dev, NVD, CISA or FIRST. On this site, red marks exploitation and nothing else.