Your CVSS >= 7.0 filter is silently dropping the CVEs you most want

Description and use

A CVSS >= 7.0 filter in a CVE collector silently dropped all CISA KEV entries because they lack CVSS scores, omitting the most critical, actively exploited vulnerabilities. Moving the filter to each source resolved the issue.

Problem

A CVE collector that filtered by CVSS >= 7.0 dropped all CISA KEV entries because they lack a CVSS score, causing the most critical, actively exploited vulnerabilities to be omitted.

Outcome

After moving the CVSS filter into the NVD fetcher and removing it from the KEV fetcher, the collector now includes all actively exploited vulnerabilities while still limiting NVD entries to those with CVSS >= 7.0.

Workflow

• 1. Fetch KEV JSON and sort by dateAdded descending. 2. Skip IDs already known. 3. Emit KEV entries without CVSS filtering. 4. Fetch NVD entries for the last N days. 5. For each NVD item, extract CVSS baseScore (v3.1 or v3.0). 6. If CVSS is null or >= 7.0, emit the entry; otherwise skip. 7. Combine KEV and NVD outputs into final candidate list.

Evidence

Run that and zero KEV entries survive

Source

The filter moves out of the merge step and into each fetcher

Source