CVSS, EPSS and KEV: how to actually prioritize dependency vulnerabilities
Every week a dependency scanner finds dozens of vulnerabilities. Every week most developers ignore them, because there's no time to fix 200 issues and no obvious way to know which 3 actually matter. The answer lives in three numbers: CVSS, EPSS and KEV. Understanding what each one measures — and what it doesn't — is the difference between a security backlog that never shrinks and one you can…
Three key numbers — CVSS, EPSS and KEV — help developers prioritize dependency vulnerabilities. CVSS measures theoretical severity, not real-world risk. EPSS predicts the probability a CVE will be exploited in the next month, based on observation data. KEV lists confirmed vulnerabilities exploited in the wild.
CVSS alone often leads developers to fix high-scoring, but irrelevant, issues first. EPSS enables focusing on actual risks. KEV identifies confirmed attacks, making them the highest priority.
When ranking vulnerabilities, KEV-listed findings with fixes should be fixed immediately. EPSS scores around 0.20 indicate a relatively high exploitation probability, so these should be fixed in the current sprint. CVSS scores of 9.8 or higher with low EPSS scores (below 0.05) suggest the issue might not be worth immediate attention. Mid-level CVSS scores without fixes should be accepted and monitored.
Factors like direct vs. transitive vulnerabilities and fix availability further refine prioritization. Mitigation or acceptance may be necessary when fixes are unavailable. Implementing remediation windows based on KEV and EPSS thresholds provides a structured approach to vulnerability management.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.