Vulnrichment Viewer

Why build on Vulnrichment instead of raw CVE data?

NVD's own analysis backlog means a large share of CVEs sit unscored for months after publication. CISA's Vulnrichment project fills that gap by publishing its own CVSS scores and SSVC decision points (Exploitation, Automatable, Technical Impact) for CVEs NVD hasn't gotten to yet — but it ships as one JSON file per CVE inside a git repository, not a searchable table. This page flattens that into a single filterable, sortable view, with a few derived metrics layered on top that Vulnrichment doesn't provide directly.

What this page adds on top of Vulnrichment

Days — calendar days from a CVE's publication to the start of its current run of being actively exploited, mined from Vulnrichment's own commit history rather than a single snapshot.
BOD 26-04 remediation tier — computed from CISA's Binding Operational Directive 26-04 matrix (Publicly Exposed × In KEV × Automatable × Technical Impact). Publicly Exposed is asset-level and can't come from CVE data alone, so both possible answers are shown as separate columns.
EPSS — FIRST.org's daily exploit-probability score and percentile, synced on its own schedule since it's a different data source from Vulnrichment.
KEV Cross-Catalog Viewer link — every Exploitation value links out to check whether CISA hasn't (yet) flagged a CVE active but another catalog (ENISA, CIRCL, Previdian, VulnCheck) already lists it as exploited.

How to read the table

Active Since and Days only show a value while a CVE's Exploitation is currently "active" — both go blank again once Vulnrichment walks that assessment back down, since the historical date no longer describes the CVE's present state. CVSS Score filters by severity category (Critical/High/Medium/Low/None) rather than a numeric range. CWE numbers link to their MITRE definitions, and Vendor/Product accept pipe-delimited terms (e.g. "forti|cisco|microsoft") to match any of several at once.

Vulnrichment is polled every 10 minutes (most polls are no-ops unless upstream actually changed) and EPSS once daily. Filter, sort, and column choices are encoded in the address bar, so any view you build can be shared as a link, and Export CSV writes exactly the rows currently showing.