{
  "id": 10136872,
  "title": "CVSS, EPSS and KEV: how to actually prioritize dependency vulnerabilities",
  "url": "https://urgent.news/2026/09/27/cvss-epss-and-kev-how-to-actually-prioritize-dependency",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-09-27T04:42:38.000Z",
  "source": {
    "name": "Dev.to",
    "slug": "dev-to",
    "url": "https://dev.to/rushabh5000/cvss-epss-and-kev-how-to-actually-prioritize-dependency-vulnerabilities-31e4"
  },
  "original_language": "en",
  "account": "Three key numbers — CVSS, EPSS and KEV — help developers prioritize dependency vulnerabilities. CVSS measures theoretical severity, not real-world risk. EPSS predicts the probability a CVE will be exploited in the next month, based on observation data. KEV lists confirmed vulnerabilities exploited in the wild.\n\nCVSS alone often leads developers to fix high-scoring, but irrelevant, issues first. EPSS enables focusing on actual risks. KEV identifies confirmed attacks, making them the highest priority.\n\nWhen ranking vulnerabilities, KEV-listed findings with fixes should be fixed immediately. EPSS scores around 0.20 indicate a relatively high exploitation probability, so these should be fixed in the current sprint. CVSS scores of 9.8 or higher with low EPSS scores (below 0.05) suggest the issue might not be worth immediate attention. Mid-level CVSS scores without fixes should be accepted and monitored.\n\nFactors like direct vs. transitive vulnerabilities and fix availability further refine prioritization. Mitigation or acceptance may be necessary when fixes are unavailable. Implementing remediation windows based on KEV and EPSS thresholds provides a structured approach to vulnerability management.",
  "summary": "Every week a dependency scanner finds dozens of vulnerabilities. Every week most developers ignore them, because there's no time to fix 200 issues and no obvious way to know which 3 actually matter. The answer lives in three numbers: CVSS, EPSS and KEV. Understanding what each one measures — and what it doesn't — is the difference between a security backlog that never shrinks and one you can…",
  "key_points": [
    "CVSS measures theoretical severity, not real-world risk",
    "EPSS predicts exploitation probability of CVEs in next month",
    "KEV lists confirmed vulnerabilities exploited in the wild"
  ],
  "editors_take": "Using CVSS, EPSS, and KEV together provides a structured approach to prioritizing dependency vulnerabilities, allowing developers to focus on actual risks and confirmed attacks rather than just theoretical severity.",
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}