skills.rest
braydos-h
braydos-hCOMMUNITY
Explore all skills by this author →
GitHub

performing-cve-prioritization-with-kev-catalog

Prioritize CVE remediation by cross-referencing CISA KEV, EPSS, and CVSS data.

4|Updated Apr 28, 2026
Search Tags:#remediation#threat intelligence#cvss#cve#epss#vulnerability prioritization#cisa kev
One-click install
npx skills add https://github.com/braydos-h/BreachPilot --skill performing-cve-prioritization-with-kev-catalog-braydos-h
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: performing-cve-prioritization-with-kev-catalog
Source: https://github.com/braydos-h/BreachPilot/tree/main/skills/performing-cve-prioritization-with-kev-catalog
Command: npx skills add https://github.com/braydos-h/BreachPilot --skill performing-cve-prioritization-with-kev-catalog-braydos-h

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires requests, pandas, and includes scripts (resource) and references (resource) and assets (resource) components.

What problem does it solve? Vulnerability scans produce hundreds of CVEs, but CVSS severity alone does not indicate which ones attackers are actively exploiting. This Skill combines the CISA Known Exploited Vulnerabilities (KEV) catalog with EPSS probability scores and CVSS base scores to rank remediation work by real-world exploitation evidence. ## Core Features & Use Cases - KEV Cross-Referencing: Downloads the CISA KEV JSON feed and matches scan results against actively exploited CVEs, including ransomware-association and BOD 22-01 due-date tracking. - Multi-Factor Risk Scoring: Computes a composite risk score from KEV status (30%), EPSS (25%), CVSS (20%), asset criticality (15%), and network exposure (10%), then assigns P1-P5 priorities with remediation SLAs. - Reporting and Statistics: Generates prioritized CSV reports, KEV catalog statistics, and single-CVE checks via a CLI. - Use Case: Export a Nessus or Qualys scan to CSV, run the prioritization engine, and immediately see which vulnerabilities are KEV-listed, overdue, or ransomware-associated so remediation teams fix the right issues first. ## Quick Start Ask the AI to check whether CVE-2024-3094 is listed in the CISA KEV catalog and what remediation priority it should receive.

Frequently Asked Questions about performing-cve-prioritization-with-kev-catalog

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I prioritize CVEs using the CISA KEV catalog?▼

Download the KEV JSON feed from CISA and match your scan results by CVE ID. Any CVE present in the catalog is actively exploited and should be treated as P1-Emergency regardless of its CVSS score, with remediation tracked against the KEV due date.

What is the difference between KEV, EPSS, and CVSS for vulnerability prioritization?▼

CVSS measures intrinsic severity, EPSS predicts the probability of exploitation within 30 days, and KEV confirms exploitation has already occurred. Combining all three gives a risk-based ranking instead of relying on severity alone.

How do I check if a CVE is in the CISA KEV catalog with Python?▼

Fetch the JSON feed from cisa.gov using the requests library, build a lookup dictionary keyed by cveID, and check membership for your CVE. The included scripts automate this and also flag ransomware-associated and overdue entries.

Does the KEV prioritization script work offline?▼

Yes, the scripts support loading a locally cached KEV JSON file via the --kev-file option or the cache created after the first fetch. EPSS enrichment requires internet access to the FIRST API, but KEV matching works fully offline.

What are the limitations of KEV-only vulnerability prioritization?▼

KEV only contains CVEs CISA has confirmed as exploited, so newly exploited vulnerabilities may not yet be listed. Treating non-KEV CVEs as safe is a common pitfall; combine KEV with EPSS scores to catch high-probability threats before catalog inclusion.

Related Skills

Explore More Software Engineering Skills→
xalgordxalgord
954

performing-endpoint-vulnerability-remediation

Prioritizes CVEs by risk scoring and deploys patches, configuration fixes, and validation for endpoint remediation.

Community
Intermediate
xalgordxalgord
954

building-vulnerability-aging-and-sla-tracking

Implement vulnerability aging dashboards and SLA tracking to measure remediation performance against severity-based deadlines.

Community
Intermediate
AradotsoAradotso
7

cve-mcp-server-security-intelligence

Assess CVE exploitation and remediation priority using NVD, KEV, EPSS, and ATT&CK data.

Official
Advanced
UnitOneAIUnitOneAI
44

cve-triage

Prioritize CVEs into SLA tiers using CVSS 4.0, SSVC 2.1, EPSS, and CISA KEV.

Official
Intermediate