Severity & scoring
How severity, KEV, and EPSS combine into priority.
TraceGuard doesn't just list CVEs by CVSS severity — it combines three signals so the "fix first" list reflects real-world risk, not just theoretical impact.
The three signals
- Severity — the vulnerability's base severity (e.g. critical/high/medium/low). How bad is it if exploited?
- KEV — presence in CISA's Known Exploited Vulnerabilities catalog. Is it being exploited in the wild right now? A KEV hit is a strong escalation.
- EPSS — a 0–1 probability that the vulnerability will be exploited in the near term. How likely is exploitation soon?
Why combine them
A high-severity CVE with near-zero EPSS and no KEV entry is usually less urgent than a medium-severity one that's actively exploited (in KEV) with high EPSS. Ranking by severity and KEV and EPSS surfaces the handful that genuinely need action now, instead of a flat wall of criticals.
See Vulnerabilities & scanning for how this shows up in the product.