Free tool
CISA KEV and EPSS checker
Paste a list of CVE numbers, from a scan report or a ticket. See which are known to be exploited, how likely the others are to be, and what to fix first.
Runs in your browser. Nothing you paste is uploaded. Data: CISA KEV of 2026-11-10 (1,779 entries), EPSS scores of 2026-11-12.
How to read the result
The table starts with anything on the CISA KEV catalog: there is evidence that attackers are already using it, so fix it first. The rest are ordered by EPSS, the probability that the flaw is exploited in the next 30 days.
Use the result to decide the order of work, then add what only you know: is the service reachable from the Internet, and how important is the asset? Our guide How to prioritise vulnerabilities with CISA KEV and EPSS walks through it. The recently added KEV entries are listed and refreshed every day.
Sources
The Known Exploited Vulnerabilities catalog is published by the US Cybersecurity and Infrastructure Security Agency (CISA). EPSS scores are published by FIRST (model v2026.06.15). We reformat both files for this page and refresh them daily. This is an aid for ordering work, not a guarantee about any single flaw.
Questions
Frequently asked questions
Is anything I paste sent to a server?
No. The check runs in your browser. The page downloads our public data files and compares them with your list locally.
Where does the data come from?
The CISA Known Exploited Vulnerabilities catalog, and EPSS scores published by FIRST. Both are public. The page shows the date of each.
What do the priority labels mean?
A CVE on the KEV catalog is marked “fix first”. Otherwise the EPSS score sets the label: 10% or more is high likelihood, 1% to 10% is watch, under 1% is lower. These cut-offs are a starting point; choose your own.
Why is a CVE shown as having no EPSS score?
EPSS scores are published for CVEs that are already public and scored. A very new, reserved or rejected CVE may not have one yet.
Is a low score safe to ignore?
Not automatically. EPSS is a probability for the next 30 days, not a guarantee. Combine it with how exposed and important the asset is.
Do this for your whole estate, automatically
Cronzy Watch reads the findings from Wazuh and AWS, ranks them with KEV and EPSS, and shows how to fix them.