Join public evidence without losing the asset.

Open the inventory join with a scanner CSV. Keep the original asset, owner and version fields while attaching exact CVE matches.

Map three columns.

The CVE column is required. Asset and owner are optional. Other columns are retained in the original record. A cell containing several comma, semicolon or whitespace-separated CVEs becomes several joined rows with the same source-row number. Repeated CVEs within one cell are merged; separate source rows are never merged.

Asset,CVE,Owner,Version
registry-a,CVE-2023-1177,ML platform,2.2.0
registry-b,CVE-2023-1177,Research,2.2.0

These fictional rows remain two review items. The public match is the same; applicability, reachability and ownership may differ.

Understand the two evidence sources.

CISA publishes a known-exploitation catalog and an official JSON/CSV mirror. A match means the CVE appears in the bundled dated catalog. It does not prove the scanner's component identification or this asset's exposure. An absent match means only that the CVE is not in that snapshot.

FIRST EPSS estimates exploitation in the wild within the next 30 days. It is not the probability that your particular host will be compromised. The tool keeps probability and percentile distinct and never combines them with KEV into an invented score.

Supply broader EPSS coverage locally.

The bundled scores cover the KEV catalog plus the MLflow example. For other CVEs, download the FIRST daily CSV separately, decompress its gzip file and import the CSV. Preserve the model_version and score_date comment plus the cve,epss,percentile header. Files are limited to 32 MiB and 1,000,000 records.

The supplied file replaces bundled EPSS for every row. This prevents mixing dates silently. The parser checks identifiers, duplicate CVEs and numeric ranges, but cannot authenticate the publisher or prove the file is complete. Missing remains unavailable, including when a zero score would be valid. Score age is shown explicitly.

Filter and export a reproducible view.

Filter by owner, original-field search, KEV membership or missing EPSS. Sort by source row, KEV presence or descending EPSS. These are explicit view operations, not a risk-ranking algorithm. Inspect a row to see its original scanner fields and exact public records.

After review, JSON export includes the rows, mappings, filters, public-source provenance and the SHA-256 of source text re-encoded as UTF-8. This is not an original-byte forensic file hash. Exports are unredacted JSON; no spreadsheet formulas are evaluated and no CSV export is produced.

For the actual remediation decision, use your asset evidence and team policy. The CVE worksheet can record applicability, accountable owner and next action. Catalog due dates are not automatically your organization's deadlines.