CVE risk signals

One row per CVE joining its NVD record with EPSS, the CISA KEV catalog and Exploit-DB: CVSS and EPSS scores, whether and when it entered KEV, ransomware use, the first public exploit, and how long each took after publication.

Table: demo.security.cve_risk_signals
Source: Opteryx view over NVD, EPSS, CISA KEV and Exploit-DB
Rows
Updated

Query it in Studio Use the OData API

Preview

The first ten rows

Live from the table, no sign-in needed.

SELECT cve_id, published_year, cvss_score, epss_score, in_kev, exploit_count
  FROM demo.security.cve_risk_signals
 LIMIT 10

Example questions

Ask it something

Run any of these here, or open it in Studio to change the SQL. Studio is free to start: 100 queries a day.

How long after disclosure do CVEs reach the KEV catalog?

SELECT kev_lag_band, COUNT(*) AS cves
  FROM demo.security.cve_risk_signals
 WHERE kev_lag_band IS NOT NULL
 GROUP BY kev_lag_band
 ORDER BY kev_lag_band

Edit in Studio

Which ransomware-linked CVEs have the highest EPSS scores?

SELECT cve_id, cvss_score, epss_score, kev_date_added
  FROM demo.security.cve_risk_signals
 WHERE ransomware = TRUE
 ORDER BY epss_score DESC, cve_id
 LIMIT 10

Edit in Studio

Schema

Columns

Column	Type
cve_id	VARCHAR
published_at	TIMESTAMP
published_year	INT64
cvss_score	FLOAT64
epss_score	FLOAT64
epss_percentile	FLOAT64
epss_floor	FLOAT64
in_kev	BOOL
kev_date_added	DATE
ransomware	BOOL
first_exploit_published	DATE
exploit_count	FLOAT64
days_to_kev	INT64
days_to_exploit	INT64
kev_lag_band	VARCHAR
exploit_lag_band	VARCHAR