I Built a Vulnerability Triage Tool Without Knowing What EPSS or KEV Meant

说明与用途

triage‑lens 通过 EPSS、CISA KEV 和 CVSS 对 CVE 进行优先级排序，生成简洁的可操作列表。

问题

Security teams receive long lists of CVEs with high CVSS scores but lack guidance on which to address first, leading to wasted effort.

结果

The tool reduced the actionable CVE list to a short, high‑confidence set, enabling faster remediation decisions.

工作流

• Collect CVE list from vulnerability scanner
• Fetch EPSS scores via FIRST.org API
• Download CISA KEV catalog
• Assign priority: P0 if in KEV, P1 if EPSS≥0.1 and CVSS≥7.0, else lower
• Generate ranked report for the team

证据

The top rank P0 means listed in KEV: it already rained there, no debate.

来源

The three P0 findings (Log4Shell, Heartbleed, Spring4Shell) were really listed.

来源