KEV is confirmed-exploitation evidence, EPSS is a dated forecast, CVSS is supplied severity. Signals stay distinct; no composite score and no popularity signal exist.
KEVCISA Known Exploited Vulnerabilities catalog membership. Catalog dates mark catalog addition, not proven first exploitation or current attack volume.
Not listed in this KEV snapshot. Absence is not proof of no exploitation.
EPSSA dated exploitation probability forecast from the named model version, not observed exploitation. Percent is the probability estimate; percentile ranks the CVE against all scored CVEs when supplied.
Unavailable EPSS unavailable for this snapshot.
CVSSCNA-supplied severity only. Legacy v2 scores, ADP-only metrics, and unscored records are labeled in place; none of them means low severity.
KEVCISA Known Exploited Vulnerabilities catalog membership. Catalog dates mark catalog addition, not proven first exploitation or current attack volume.
Not listed in this KEV snapshot. Absence is not proof of no exploitation.
EPSSA dated exploitation probability forecast from the named model version, not observed exploitation. Percent is the probability estimate; percentile ranks the CVE against all scored CVEs when supplied.
Unavailable EPSS unavailable for this snapshot.
CVSSCNA-supplied severity only. Legacy v2 scores, ADP-only metrics, and unscored records are labeled in place; none of them means low severity.
KEVCISA Known Exploited Vulnerabilities catalog membership. Catalog dates mark catalog addition, not proven first exploitation or current attack volume.
Not listed in this KEV snapshot. Absence is not proof of no exploitation.
EPSSA dated exploitation probability forecast from the named model version, not observed exploitation. Percent is the probability estimate; percentile ranks the CVE against all scored CVEs when supplied.
Unavailable EPSS unavailable for this snapshot.
CVSSCNA-supplied severity only. Legacy v2 scores, ADP-only metrics, and unscored records are labeled in place; none of them means low severity.
KEVCISA Known Exploited Vulnerabilities catalog membership. Catalog dates mark catalog addition, not proven first exploitation or current attack volume.
Not listed in this KEV snapshot. Absence is not proof of no exploitation.
EPSSA dated exploitation probability forecast from the named model version, not observed exploitation. Percent is the probability estimate; percentile ranks the CVE against all scored CVEs when supplied.
Unavailable EPSS unavailable for this snapshot.
CVSSCNA-supplied severity only. Legacy v2 scores, ADP-only metrics, and unscored records are labeled in place; none of them means low severity.
KEVCISA Known Exploited Vulnerabilities catalog membership. Catalog dates mark catalog addition, not proven first exploitation or current attack volume.
Not listed in this KEV snapshot. Absence is not proof of no exploitation.
EPSSA dated exploitation probability forecast from the named model version, not observed exploitation. Percent is the probability estimate; percentile ranks the CVE against all scored CVEs when supplied.
Unavailable EPSS unavailable for this snapshot.
CVSSCNA-supplied severity only. Legacy v2 scores, ADP-only metrics, and unscored records are labeled in place; none of them means low severity.