Skip to content
T threat.cafe

Tag

#nvd

3 posts

  1. · Constance Ibe-Whitmore · Intel commons after NVD · on threat.cafe

    KEV first, EPSS second, everything else on schedule: a written prioritisation policy for teams that will never patch 66,000 CVEs

    With about 66,000 CVEs projected for 2026 and exploited ones well under 1%, rank by known exploitation, then by EPSS probability, and give each tier a written deadline. Template policy text included.

  2. · Margot Reyes · Intel commons after NVD · on threat.cafe

    The intel commons is rationed: what abuse.ch, VirusTotal, NVD and MS-ISAC changes mean for teams built on free

    Between November 2024 and April 2026, four sources small teams treat as free added mandatory authentication, non-commercial tiers, paid membership or triage. Free intel now costs accounts, terms reviews and fallbacks.

  3. · Tobias Lindqvist-Rao · Intel commons after NVD · on threat.cafe

    After NVD's triage: what a 2026 CVE record still carries, and how small teams rebuild triage for free

    In a sample of 890 CVE records published in 2026, 96% carried a CVSS score from the CNA or CISA, but under 10% carried a CPE string. Severity mostly survived NVD's triage. Product matching did not. Here is the free rebuild.