Skip to main content
When an assessment shows a client a long list of CVEs, the first question is usually where the data comes from and why the ranking should be trusted. This page answers that, and you can share it with a client’s IT lead during vendor due diligence.

​
The six sources

Telivy combines a vulnerability catalog scored with NVD’s CVSS data, matching against the software actually running in the client’s environment, and three signals about real-world exploitation. Each finding also links to the CVE’s page on nvd.nist.gov so anyone can read the public write-up.

​
How each source is used

​
CVE Program catalog

Telivy syncs the official CVE Program 5.0 JSON feed, published by CVE Numbering Authorities through MITRE, into its own database every night. NVD pulls from the same upstream source. Each record includes the CVE ID and description, affected products and versions, CVSS v2 and v3 metrics, public references, and publication and modification dates. A CVE published or updated upstream shows up in Telivy within 24 hours.

​
NVD scoring

Telivy also pulls NVD’s CVE JSON 2.0 feeds directly from NIST. A daily job reads NVD’s recent and modified feeds to add CVSS v2, v3, and v4 scores and product metadata as soon as NVD publishes them. A weekly job reloads the full historical feed to catch anything the daily job missed.

​
Matching to the client’s software

Knowing which CVEs exist is half the job. When the network scanner or agent identifies a running service or installed software, for example OpenSSH 7.2p2 on a Linux server or an old Apache version on an internal web server, that version is matched against the Vulners database through the Nmap vulners script. The result is the list of CVEs that affect the exact software found, not every CVE for that vendor.

​
EPSS

The Exploit Prediction Scoring System gives every CVE a score from 0 to 1: the probability it will be exploited in the next 30 days. Telivy refreshes EPSS scores daily. A CVSS 9.8 with an EPSS of 0.001 is a very different problem from a CVSS 7.5 with an EPSS of 0.94.

​
CISA KEV

The CISA Known Exploited Vulnerabilities catalog is the US government’s list of CVEs that have been seen exploited in real attacks. Telivy syncs the full catalog and flags matching CVEs in a client’s findings. A KEV flag is confirmation, not a prediction, which makes it the strongest reason to patch.

​
ExploitDB

ExploitDB is an archive of public exploit code and proof-of-concept attacks. Telivy links matching CVEs to their public exploits. A match means working attack code is already available, so exploiting the CVE takes less skill. Together the three signals answer different questions: EPSS estimates how likely exploitation is, KEV confirms whether it has happened, and ExploitDB shows how easy it would be.

​
Prioritizing the list

A 200-endpoint environment can easily show thousands of open CVEs. Ranking by CVSS alone leads to patching critical-scored CVEs nobody exploits while missing lower-scored ones that are under active attack. Telivy ranks vulnerabilities with the Risk Priority Score, which combines exploitation likelihood, impact, and the exposure of the affected asset into one 0 to 100 number. The Priorities tab lists every CVE and device in RPS order. A practical approach:
  1. Start from the Priorities tab, not the full CVE list. The full list is every CVE that matches something installed, and nobody fixes all of it at once.
  2. Look at KEV and EPSS together with how many devices are affected. A high-likelihood CVE on 40 endpoints is a different conversation from the same CVE on one retired VM.
  3. Patch through your usual workflow. The next scan matches the environment against the catalog again, and fixed vulnerabilities close on their own.

​
Common misunderstandings

“Telivy only links to NVD and does not use its data.” It does both. The catalog comes from the CVE Program feed, so a new CVE appears after the next nightly sync whatever NVD’s enrichment status. CVSS scores come from NVD’s own feeds, refreshed daily with a weekly full reload. The nvd.nist.gov links are there for people reading the finding. “Higher CVSS means higher priority.” CVSS describes how bad exploitation would be. EPSS describes how likely it is. A CVE can score 9.8 on CVSS and 0.001 on EPSS: severe in theory and almost never seen in practice. Use both, and use the RPS to rank. “If a CVE is not in Telivy, my client is not affected.” A CVE only becomes a finding when the affected product is running on something Telivy scans. If you expected a finding for a known-vulnerable service and it is missing, check that the device was reachable during the scan and that the service version was detected correctly.