// TOOLS
Security Tools
🩹 What do I patch first?
Paste the CVE list from your scanner —or the whole report, I will extract them— and walk out with a remediation order you can defend in front of a client or a board.
Why CVSS alone falls short: it measures how bad it would be if you were exploited, not how likely that is. There are thousands of CVSS 9.8 CVEs nobody ever exploited, and 6.5 bugs sitting inside ransomware campaigns today. This combines three signals: FIRST EPSS (30-day exploitation probability), the CISA KEV catalog (confirmed real-world exploitation) and CVSS, weighted and adjusted with your asset context.
Up to 50 CVEs per query. Shortcut: Ctrl + Enter.
Asset context
This is what no public database knows and what really moves the order. It applies to the whole batch, so group by asset type if you mix exposed servers with laptops.
What it does, what data it uses and its limits
- What it does
- Orders a list of CVEs by patching priority, combining severity (CVSS), exploitation probability (EPSS) and known exploitation (KEV) with your asset’s context.
- What data it uses
- Only the CVE IDs you paste. Our server fetches CVSS from CIRCL and EPSS from FIRST, and KEV from a local copy of CISA’s catalogue. The final order is computed in your browser.
- Limits
- The priority helps you decide; it is not a guarantee: it does not know what your network already mitigates.
- A very recent CVE may not have a CVSS or EPSS score yet.
- Up to 50 CVEs per check.