Skip to content
T threat.cafe

Tag

#epss

2 posts

  1. · Constance Ibe-Whitmore · Intel commons after NVD · on threat.cafe

    KEV first, EPSS second, everything else on schedule: a written prioritisation policy for teams that will never patch 66,000 CVEs

    With about 66,000 CVEs projected for 2026 and exploited ones well under 1%, rank by known exploitation, then by EPSS probability, and give each tier a written deadline. Template policy text included.

  2. · Tobias Lindqvist-Rao · Intel commons after NVD · on threat.cafe

    After NVD's triage: what a 2026 CVE record still carries, and how small teams rebuild triage for free

    In a sample of 890 CVE records published in 2026, 96% carried a CVSS score from the CNA or CISA, but under 10% carried a CPE string. Severity mostly survived NVD's triage. Product matching did not. Here is the free rebuild.