What is a CVE?
CVE stands for Common Vulnerabilities and Exposures. A CVE ID, written as CVE, the year and a number, is the public identifier for one disclosed vulnerability. It lets a vendor advisory, a scanner finding and a threat report all refer to the same flaw. A CVE ID is also the first of CISA's three conditions for adding a vulnerability to its KEV catalog.
The number of CVEs keeps rising. FIRST forecast a median of about 59,427 CVEs for 2026 in February and raised the forecast to about 66,000 in June, naming AI-assisted vulnerability discovery among the drivers.
What does CVSS measure?
The Common Vulnerability Scoring System is maintained by FIRST. It captures the principal characteristics of a vulnerability and produces a numerical score reflecting its severity, which maps to qualitative ratings of low, medium, high and critical. Version 4.0 was published in November 2023.
Severity is a property of the flaw in general. A critical CVSS score does not say whether anyone is exploiting the vulnerability, whether your instance is reachable from the internet, or whether a control in front of it already blocks the attack.
What does EPSS add?
The Exploit Prediction Scoring System, also from FIRST, estimates the probability that a published CVE will be exploited in the wild in the next 30 days. Scores run from 0 to 1 and come with percentiles. FIRST publishes them daily and makes them free to download as CSV or through an API.
EPSS is about attacker behavior across the internet, not about your estate. A high probability tells you a CVE is likely to be used; it does not tell you whether your asset is affected.
What is the KEV catalog?
CISA's Known Exploited Vulnerabilities catalog lists vulnerabilities that meet three criteria: an assigned CVE ID, reliable evidence of active exploitation in the wild, and a clear remediation action. Under Binding Operational Directive 22-01, US federal civilian agencies must remediate KEV entries within set timeframes, and CISA recommends that other organizations include a requirement to immediately address KEV catalog vulnerabilities in their vulnerability management plan.
How do the four fit together?
| Standard | Published by | Answers | Does not answer |
|---|---|---|---|
| CVE | The CVE program | Which vulnerability is this? | How severe or how exploited it is |
| CVSS | FIRST | How severe is the flaw? | Whether it is exploited, or reachable in your estate |
| EPSS | FIRST | How likely is exploitation in the next 30 days? | Whether your asset is affected |
| KEV | CISA | Is there reliable evidence of exploitation? | Whether your asset is affected |
The missing column in every row is your own estate. That is the gap exposure validation fills: a safe test that shows whether a specific exposure can be exploited on a specific asset now. The next track starts with what validation proves.
How do ASM tools use these standards?
Most tools map findings to CVEs and show a severity. Some go further. Censys ASM, for example, documents EPSS and KEV scoring alongside reachability confirmation, and watchTowr lists a known exploited vulnerabilities agent among its eight attack agents. For an order of work that combines all four signals, see how to prioritize external exposures.
Terms in this lesson: CVE (Common Vulnerabilities and Exposures), CVSS (Common Vulnerability Scoring System), EPSS, KEV, BOD 22-01
Sources: FIRST, CVSS, FIRST, EPSS, CISA, Known Exploited Vulnerabilities catalog, FIRST, mid-year forecast, 15 June 2026, Censys, External Exposure Management, watchTowr, Platform