Your CVSS >= 7.0 filter is silently dropping the CVEs you most want

Описание и применение

Фильтр CVSS >= 7.0 в скрипте сбрасывал все записи из CISA KEV, так как они не содержат балла CVSS, и тем самым пропускали наиболее критичные уязвимости. Перенос фильтра в отдельные источники исправил проблему.

Задача

A CVE collector that filtered by CVSS >= 7.0 dropped all CISA KEV entries because they lack a CVSS score, causing the most critical, actively exploited vulnerabilities to be omitted.

Результат

After moving the CVSS filter into the NVD fetcher and removing it from the KEV fetcher, the collector now includes all actively exploited vulnerabilities while still limiting NVD entries to those with CVSS >= 7.0.

Рабочий процесс

• 1. Fetch KEV JSON and sort by dateAdded descending. 2. Skip IDs already known. 3. Emit KEV entries without CVSS filtering. 4. Fetch NVD entries for the last N days. 5. For each NVD item, extract CVSS baseScore (v3.1 or v3.0). 6. If CVSS is null or >= 7.0, emit the entry; otherwise skip. 7. Combine KEV and NVD outputs into final candidate list.

Доказательства

Run that and zero KEV entries survive

Источник

The filter moves out of the merge step and into each fetcher

Источник