VulnPilot — Scoring explained

VulnPilot calculates a composite priority score for each finding. The score is deterministic and re-runnable — the same finding with the same feed data will always produce the same score.

Formula

score = KEV(40) + EPSS(35) + CVSS(15) + Severity(10)

• KEV (40 points) — Binary: 40 if the CVE appears in the CISA KEV catalog, 0 otherwise. Confirmed exploitation is the strongest available signal.
• EPSS (35 points) — EPSS score × 35. An EPSS of 0.97 contributes 33.95 points. Recalculated daily by FIRST.org.
• CVSS (15 points) — Normalized CVSS base score × 15. CVSS 10.0 contributes 15 points.
• Scanner severity (10 points) — Nessus risk rating mapped to 1.0 / 0.75 / 0.40 / 0.10 for Critical / High / Medium / Low.

KEV floor

Any finding with a KEV match scores a minimum of 75, regardless of EPSS or CVSS. This ensures that confirmed-exploited vulnerabilities are always surfaced at the top of the list even when EPSS data is low or CVSS scores a particular variant modestly.

Score cap

Scores are capped at 100.0. The final score is min(round(raw, 2), 100.0).

Priority labels

• CRITICAL NOW — KEV match, or score ≥ 75
• HIGH — score ≥ 50
• MEDIUM — score ≥ 25
• LOW — score < 25