KBrain Concepts
CVE, NVD, CISA KEV and EPSS explained
A plain-language guide to the four terms behind vulnerability data: what a CVE is, what NVD adds, what CISA KEV means, and how EPSS scores work, and how to use them together.
Add the CVE brain to your AI assistant
Vulnerability data comes with a small vocabulary that is easy to mix up: CVE, NVD, CISA KEV, and EPSS. They are related but each answers a different question. Understanding what each one is makes it far easier to prioritize, and to know what to ask an AI assistant connected to a CVE data source.
CVE: the identifier
A CVE, Common Vulnerabilities and Exposures, is a unique identifier for a specific vulnerability, in the form CVE-YYYY-NNNNN. It is a name, not a score. CVE-2021-44228 refers to one specific flaw, so that everyone can talk about the same thing without ambiguity.
NVD: the enriched record
The National Vulnerability Database, run by NIST, takes each CVE and adds structured analysis: a description, a CVSS score and vector, the weakness type (CWE), the affected products (CPEs), and references. When people say they looked up a CVE, they usually mean they read its NVD record.
CISA KEV: what is being exploited
The CISA Known Exploited Vulnerabilities catalog is a list of CVEs confirmed to be exploited in the wild. It answers a question NVD does not: is anyone actually using this? A KEV listing is one of the strongest reasons to patch quickly, and the catalog records the date each entry was added.
EPSS: how likely exploitation is
The Exploit Prediction Scoring System, from FIRST.org, gives each CVE a probability, between 0 and 1, that it will be exploited in the next 30 days. Where CISA KEV is a confirmed yes or no, EPSS is a forecast. A high EPSS score on a CVE not yet in KEV is an early warning.
How they fit together
- CVE names the vulnerability.
- NVD describes it and scores its potential impact with CVSS.
- CISA KEV tells you if it is being exploited now.
- EPSS estimates how likely exploitation is soon.
Impact is not urgency. CVSS tells you how bad a vulnerability could be; CISA KEV and EPSS tell you how pressing it is. Good prioritization uses all four.
The KBrain CVE brain joins these sources so a single lookup returns the NVD record with CISA KEV status and the EPSS score attached, which is what makes it practical to reason over all four inside an AI assistant.
Add the CVE brain to your AI assistant
Look up CVEs, CISA KEV exploited status, and EPSS scores from Claude, ChatGPT, or any MCP compatible assistant. Hosted and refreshed daily, with no self-hosting and no API keys to manage.
Frequently asked questions
What is the difference between a CVE and NVD?
A CVE is the identifier for a vulnerability. NVD is the database that enriches each CVE with a description, a CVSS score, the weakness type, affected products, and references. You look up a CVE to read its NVD record.
Is CISA KEV the same as a high CVSS score?
No. CVSS measures potential impact, while CISA KEV lists vulnerabilities confirmed to be exploited in the wild. A CVE can have a high CVSS score and not be in KEV, or a moderate score and be actively exploited.
What does an EPSS score mean?
EPSS is a probability between 0 and 1 that a vulnerability will be exploited in the next 30 days. It is a forecast of likelihood, complementary to the confirmed exploitation that CISA KEV records.
Which should I prioritize by?
Use them together: patch CISA KEV entries first, then high-EPSS items, then remaining high-CVSS issues. Relying on CVSS alone misses what attackers are actually doing.