Action score.Three signals, one priority.
CVSS tells you how severe a vulnerability is, not how urgent it is. The action score also accounts for what’s happening in the wild.
Formula
action = CVSS × 4 + (30 if KEV) + EPSS × 30
max 40 max 30 max 30
floor: at least 40 if a ready-made attack tool exists (Metasploit module or KEV),
at least 60 if it can also be exploited over the network without an accountCVSS
max 40Technical severity
How severe is the vulnerability itself? The CVSS base score is multiplied by 4. A flaw scoring 9.8 out of 10 contributes 39 points.
CISA KEV
max 30Exploited in the wild
The US Cybersecurity and Infrastructure Security Agency’s list of vulnerabilities confirmed to be actively exploited. Every CVE on the list gets 30 points.
EPSS
max 30Near-term likelihood
FIRST’s estimate of the probability of exploitation in the next 30 days. A 90% probability contributes 27 points.
Bands
- 80–100
- Now
- Patch today or shut off access.
- 60–79
- This week
- Don’t wait for the next maintenance window.
- 40–59
- Plan
- Add it to your regular patch cycle.
- 0–39
- Monitor
- Low priority for now; keep an eye on changes.
Example
A hypervisor flaw with CVSS 8.2 that requires local access, isn’t in KEV, and has a 5% EPSS: 33 + 0 + 2 = 35 · Monitor. A print server flaw with CVSS 7.5 whose EPSS jumped from 13% to 42% in a week: 30 + 0 + 13 = 43 · Plan, and it’s on the trending list. A team that only looks at CVSS patches the first one first.
How the Noroxi assessment is written
The assessment at the top of every CVE page is not written by AI, and no external service is called when the page opens. Data is pulled regularly from the public sources below into our database; when the page opens, the record's fields are turned into sentences by fixed rules. The same data always produces the same text.
| Line | Source | Updated |
|---|---|---|
| Priority and action score | The formula above: CVSS, CISA KEV, FIRST EPSS | When the data changes |
| Exploitation in the wild, ransomware, deadline | CISA KEV catalog | Hourly |
| Ready-made attack module | Metasploit modules and Nuclei templates (names only) | Daily |
| Proof of concept (PoC) | Public PoC repositories on Exploit-DB and GitHub (never linked) | Daily |
| Exploitation probability and trend | FIRST EPSS (probability, percentile, 7-day change) | Daily |
| Who can trigger it, with what privileges | CVSS vector (NVD or the assigning authority) | Hourly |
| Automatable | CISA SSVC decision (Vulnrichment) | Hourly |
| Fixed version | The vendor's own record (CNA, MSRC); otherwise OSV package and distribution records | Hourly / daily |
| Disputed score | At least a 2-point gap between the assigning authority's (CNA) score and NVD's | Hourly |
| National advisories | siberguvenlik.gov.tr advisory archive (Turkey) | Daily |
Rules
- If there is no data, no sentence is written; nothing is guessed or assumed.
- A vulnerability with only a proof of concept is never called "exploited"; that requires a CISA KEV entry.
- If the record has no fixed version, it says "no fixed version recorded"; versions are never guessed.
- Percentages are rounded down: "100%" would claim certainty, so it is never written.
- The assessment describes the record's data and doesn't know your environment: only a review shows whether it is exploitable for you.
Data sources
- NVDCVE records, CVSS vectors, CPE and CWE mappings
- CISA KEVCatalog of actively exploited vulnerabilities
- FIRST EPSSDaily exploitation probability estimates
- Vendor advisoriesAffected and fixed versions
Data comes from NVD, the CVE Program, CISA KEV, FIRST EPSS and OSV; the last update date is shown above the CVE list.
Our publishing principles
- Every record is published with affected version ranges, the fixed version and source links.
- We don’t publish working exploit code or step-by-step attack instructions.
- We don’t link to proof-of-concept repositories; we only note that one exists.
- Code samples are representative examples that show the flawed pattern and its fix.