CVSS, EPSS and the CISA Known Exploited Vulnerabilities (KEV) catalog are three public vulnerability signals, each from a different publisher. This list is selected by that one criterion and is not a ranking. It draws on FIRST’s CVSS v4.0 and EPSS pages, CISA’s KEV catalog page, and the CWE program’s 2025 KEV insights page, which covers KEV entries from June 2024 to June 2025.
What are the three public signals?
Each signal answers a different question. CVSS describes a vulnerability through scored metric groups. EPSS gives a daily probability of exploitation. The KEV catalog lists vulnerabilities that have been exploited in the wild. The table restates what each publisher says about its own signal.
| Topic | CVSS | EPSS | KEV |
|---|---|---|---|
| Run by | FIRST, through its CVSS-SIG | EPSS Special Interest Group at FIRST | CISA |
| What it gives | Metric groups and scores such as CVSS-BTE | A 0 to 1 probability with ranking percentiles, every day | A catalog of vulnerabilities exploited in the wild |
| Looks at | Base, Threat, Environmental and Supplemental metrics | Exploitation in the next 30 days | Observed exploitation |
1. CVSS: what does it tell you about a vulnerability?
FIRST publishes the Common Vulnerability Scoring System through its CVSS-SIG. Its v4.0 page calls version 4.0 the next generation of the standard. See the CVSS glossary entry for a short definition.
The page names four ways to label a score: Base (CVSS-B), Base plus Threat (CVSS-BT), Base plus Environmental (CVSS-BE) and Base plus Threat plus Environmental (CVSS-BTE). It also says it wants to “reinforce the concept that CVSS it not just the Base score”. Version 4.0 also renamed the Temporal metric group to Threat.
What it does not tell you on its own: the v4.0 page says the new Supplemental group conveys attributes that “do not affect the final CVSS-BTE score”. The group holds Safety, Automatable, Recovery, Value Density, Vulnerability Response Effort and Provider Urgency. The CWE program says its Top 25 calculates severity from the average CVSS score of CVE Records.
Question to ask: is this score Base only, or does it include Threat and Environmental metrics?
2. EPSS: what does it tell you about exploitation likelihood?
EPSS is maintained by the EPSS Special Interest Group at FIRST. FIRST describes it as a data-driven machine-learning model. It estimates the probability that a published CVE will be exploited in the wild in the next 30 days. The page says exploitation activity data comes from industry and government partners. See the EPSS glossary entry.
EPSS publishes a probability between 0 and 1, with ranking percentiles, every day for every CVE. The data is free through CSV, an API and a repository. FIRST says it offsets subjective judgments with empirical signals, to help focus limited remediation effort where attacks are most likely.
What it does not tell you: the definition is a probability for a 30 day window and for published CVEs.
Question to ask: is a 30 day exploitation probability the question we need answered for this CVE?
- 30 daysWindow used in the EPSS definitionSource: FIRST EPSS page
- 2021Year CISA began publishing the KEV catalogSource: CWE KEV insights page
- 182CVE Records in the 2025 KEV weakness list calculationSource: CWE KEV insights page
3. CISA KEV: what does it tell you about real exploitation?
CISA maintains the catalog. The CWE program says CISA began publishing it in 2021. Entries are vulnerabilities reported through the CVE Program that are observed to be, or to have been, actively exploited. CISA’s page calls the catalog the authoritative source of vulnerabilities that have been exploited in the wild.
CISA says organizations should use the KEV catalog as an input to their vulnerability management prioritization framework. The CWE page adds that CISA recommends monitoring the catalog and using its content to help prioritize remediation.
What it does not tell you: the CWE page lists limits of KEV data. Exploit detection might be less mature for some weaknesses, which might lead to under-reporting. Some KEV entries may not map to detailed weakness types. Some CVE descriptions have too little detail to map at all.
Question to ask: is this CVE in the catalog, and if it is not, what else do we know about its exploitation?
Does the KEV view change which weaknesses stand out?
The CWE program compared a Top 10 KEV Weaknesses list with its 2025 CWE Top 25. It used 182 CVE Records, all KEV entries from June 2024 to June 2025, pulled on 15 January 2026. OS Command Injection ranks 1st in the KEV list and 9th in the Top 25. Missing Authentication for Critical Function ranks 4th and 21st. Cross-site Scripting ranks 10th in the KEV list and 1st in the Top 25.
The page says KEV data shows what adversaries exploit, as opposed to what developers and researchers report most often. It lists possible causes of the gap, including whether a flaw is relatively easy to exploit or has a desirable impact such as code execution.
How do the three signals combine?
The sources do not give a formula. The CWE page says pairing public weakness data with knowledge of exploitation activity offers a valuable, additional perspective for operational vulnerability management.
Teams that own this work can find role context on the vulnerability and exposure management page. For related reading, see CVE volume and risk prioritization, vulnerability exploitation trends in H1 2026 and disclosure to exploit speed.
- Which CVSS label is this?Base, Threat, Environmental or a mix.
- What is the EPSS probability?A 30 day estimate for a published CVE.
- Is it in the KEV catalog?Observed exploitation, as CISA maintains it.
Two linked pieces cover this from other angles: the CWE Top 25 and exploited vulnerabilities in 2025.