Know what the data can tell you.

This is a local review worksheet for findings you already have. It does not scan your environment, calculate affected versions or decide whether an asset is vulnerable.

CISA KEV

The bundled snapshot contains the full official CISA KEV mirror, published under CC0. CVE matching is exact after case normalization. A match means listed in that particular snapshot. No match does not mean safe.

Catalog version: 2026.10.30. Release: 2026-10-30T17:02:45.3665Z. Records: 1766. Retrieval: 2026-11-01T01:26:08.063Z.

Exact source feed. CISA's canonical catalog page provides its own interpretation and guidance.

FIRST EPSS

Scores are attributed to FIRST's EPSS. Maintenance downloads the official recommended daily gzip CSV, validates every record, then retains scores for the entire bundled KEV catalog plus the vendor-verified AI advisory roster. The current additional roster is CVE-2023-1177 (MLflow). No user-entered identifiers are sent to FIRST.

Coverage: 1766 scores for 1767 CVEs. Bulk source records checked: 398713. Covered CVEs with no source score: 1. Missing: CVE-2026-118527.

Retrieval: 2026-11-01T01:26:08.514Z. Model version: v2026.06.15. Score date from the bulk header: 2026-10-31T12:00:27Z. The browser evaluates retrieval freshness and score freshness separately.

FIRST-recommended bulk endpoint and resolved dated file. The distribution covers the full scored population; this site's smaller retained subset is not a complete CVE database or complete AI ecosystem inventory. Missing and uncovered scores remain unavailable, never zero.

Refresh and failure behavior

Public source data is downloaded during maintenance, never using your entered identifiers. Both feeds must pass validation before a single snapshot is replaced. KEV downloads have a 30-second timeout and 10 MiB limit. EPSS downloads have a 60-second timeout, a 32 MiB compressed limit and a 128 MiB decompressed limit. Gzip integrity, model/date header, CSV shape, identifiers, duplicates and probability ranges are checked. Scientific notation is supported. A bulk file with fewer than 100,000 records is rejected as unexpectedly incomplete; a distribution change needs maintainer review. A failed refresh retains the previous verified file and its original timestamps.

Daily refresh is recommended. Data older than 72 hours is labeled stale in the browser. This threshold is a product choice. A local refresh needs a rebuild and deployment before visitors receive it; this site does not promise a live update schedule.

Download the exact bundled snapshot to inspect the source URLs, timestamps and SHA-256 hashes. The hashes cover the original KEV JSON and compressed EPSS gzip source bodies. The filtered subset preserves the publisher model version and score timestamp. The browser displays unavailable if its snapshot cannot load.

Local applicability and evidence

Every row begins unknown. A user may attest affected, not affected or remediated, but the app does not independently verify those labels. Package names, scanner severity and public exploitation signals never automatically change applicability.

The worksheet is per CVE, not per asset. CSV columns other than the supported CVE column are ignored. Separate assets with different conclusions belong in separate worksheet exports. Inputs stay in tab memory; exports contain unredacted operator notes.

Editorial sources and scope

The MLflow publisher advisory supplies the historical worked example. FIRST CVSS and the EPSS FAQ explain why severity and probability differ. Field guides were reviewed October 31, 2026; synthetic asset details are labeled.

OSV-Scanner addresses dependency discovery and scanning. AI Patch Desk focuses on the subsequent evidence handoff for junior analysts. It does not claim superior detection, complete AI ecosystem coverage, compliance certification or guaranteed prioritization.