Category
Intel commons after NVD
4 posts
-
Malicious packages are not vulnerabilities: why your CVE scanner can pass a package that is malware by design
Malware gets a malware advisory, not a CVE, and lives in separate datasets. In our 15 October test, npm audit flagged three of four known-malicious versions; the fourth is listed in OSV but not in GitHub's database.
-
KEV first, EPSS second, everything else on schedule: a written prioritisation policy for teams that will never patch 66,000 CVEs
With about 66,000 CVEs projected for 2026 and exploited ones well under 1%, rank by known exploitation, then by EPSS probability, and give each tier a written deadline. Template policy text included.
-
The intel commons is rationed: what abuse.ch, VirusTotal, NVD and MS-ISAC changes mean for teams built on free
Between November 2024 and April 2026, four sources small teams treat as free added mandatory authentication, non-commercial tiers, paid membership or triage. Free intel now costs accounts, terms reviews and fallbacks.
-
After NVD's triage: what a 2026 CVE record still carries, and how small teams rebuild triage for free
In a sample of 890 CVE records published in 2026, 96% carried a CVSS score from the CNA or CISA, but under 10% carried a CPE string. Severity mostly survived NVD's triage. Product matching did not. Here is the free rebuild.
