Your first CVE handoff.
Start with the question you need to answer. Each guide connects a plain-language explanation to a task in the worksheet.
CVSS, EPSS and KEV: what should I do first?
Understand severity, probability and known exploitation. Keep unknown data visible.
Does this finding affect our system?
A worked MLflow example checks the difference between an installed package and the service actually running.
What goes in the escalation ticket?
A copyable structure and a completed synthetic example, including what you have not confirmed.
How do I prepare the scanner export?
Accepted CSV columns, duplicate handling and a private local workflow.
Join asset findings to KEV and EPSS
Preserve scanner rows, map owner columns and inspect exact public-record matches.