vulnerability-prioritization

Open-source vulnerability prioritization engine that enriches scanner findings with vulnerability intelligence, identifies urgent risks, and automates alerts and ITSM ticketing.

Riesgo real de un CVE, no el nominal: correlaciona CVSS, EPSS, CISA KEV y exploits públicos en una puntuación 0-100, calcula la decisión SSVC (qué hacer y en cuánto tiempo) y añade un analista LLM que investiga en internet y atribuye los actores. Todo en tu máquina, sin telemetría.

Model every CVE as a disclosure state machine: zero-day, coordination and fix-vs-exploit analytics over NVD, EPSS and CISA KEV data, vectorized with NumPy.

Fluescan is a vulnerability prioritization tool that combines CVSS severity, EPSS exploit likelihood, KEV intelligence, PoC/Metasploit availability, and contextual signals into a single actionable score so security teams can focus remediation on what is most likely to be exploited first.

Vulnerability prioritization lab: multi-source ingestion, CycloneDX inventory and scoring strategy comparison (FastAPI, PostgreSQL, React/TypeScript)

FIRVP — Federal Intelligence and Regulated-data Vulnerability Prioritization. A methodology for context-aware, audit-grade vulnerability prioritization integrating federal vulnerability intelligence and regulated-data sensitivity for U.S. organizations with compliance obligations.

Rank Microsoft Patch Tuesday by evidence of real-world exploitation, not vendor severity. Joins MSRC + FIRST.org EPSS + CISA KEV. Zero dependencies.

Top Vulnerability Prioritization Platform 🌟 Star if you like it! 🌟

Reproducible AI framework for enterprise vulnerability prioritization using NVD, CISA KEV and EPSS. XGBoost ROC-AUC 0.985 with 2.7× Top-100 precision improvement over CVSS-only prioritization.

Context-aware vulnerability prioritization with attack-path chaining. Self-hosted, no lock-in, swap any scanner.

CVE feed aggregator and prioritisation tool that ranks CVEs by real-world exploitation (CISA KEV, EPSS, SSVC). Describe your stack, drop in a lockfile or SBOM, or paste CVEs from Nessus or another scanner. No account needed: your stack lives in the URL. Built for and deployed on Cloudflare Workers.

Leakage-free evaluation of a Recursive Feature Elimination Random Forest for CVE exploitability prioritization: code, data, results and a calibrated scoring package.

Empirical Security — independent third-party profile of a public API surface, by API Evangelist. Empirical Security builds data-driven models that predict which vulnerabilities will actually be exploited, so security teams can prioritize remediation by real-world risk instead of raw CVSS severity.