No. FIRST describes EPSS as a model that scores published CVEs, so a finding with no CVE ID, such as an advisory that carries only a GitHub or OSV identifier, will usually show no EPSS value. A blank score is missing data, not a sign of low risk.
What EPSS covers
FIRST says EPSS publishes a score between 0 and 1 for every published CVE, updated daily, estimating the probability of exploitation in the wild in the next 30 days. The unit is the CVE. The score is generated from CVE level data, so anything outside the CVE system has nothing to attach to.
That leaves some common finding types without a score:
| Finding type | Typical identifier | EPSS available? |
|---|---|---|
| Vulnerability with a published CVE | CVE ID | Yes, once it is scored |
| Advisory with only an ecosystem identifier | GHSA or OSV style ID | Not unless it maps to a CVE |
| Malicious package report | Ecosystem or OSV style ID | No |
| Misconfiguration finding | Scanner rule ID | No |
| Brand new CVE | CVE ID | May lag, check the date |
I did not verify how every database handles a given identifier, so treat the middle rows as the general pattern and check your own data.
Why a blank is not a zero
Dashboards often sort by EPSS descending. Blanks fall to the bottom, next to genuinely low scores. That hides items that may matter. A malicious package has no CVE and no EPSS, yet it can be the most urgent finding in the list.
FIRST also notes that EPSS is not a complete risk score. It does not account for impact, your environment or compensating controls. So even where a score exists, it is one input.
A routine for findings without a score
- Separate them. Give "no CVE" findings their own lane in the report instead of mixing them with low scores.
- Check the alias fields. An advisory may list a CVE alias. If it does, look up the score by that CVE.
- Use other signals. Is it a malicious package report? Treat as an incident, not a scored item. Is there a known fix? Is the component reachable?
- Record the reason. Write "no CVE, no EPSS" in the finding so nobody reads it as "EPSS zero".
- Revisit later. A CVE may be assigned after publication, and a score can then appear.
What to use instead
For vulnerabilities without scores, lean on signals that do not depend on a CVE:
- Whether the vulnerable code is reachable from your entry points.
- Whether a fix version exists.
- Whether the component is exposed to untrusted input.
- Whether credible reports describe exploitation.
For malicious packages the question is different: was it installed, where, and what could it reach? That calls for incident handling, including credential review.
Report wording
A line like "EPSS: not available (no CVE ID)" is honest and clear. Leaders reading a summary will then know the item was not ranked, rather than assuming it scored low.
For related background, see why a new CVE shows no severity score and EPSS probability versus percentile.
Safeguard combines dependency scanning with reachability analysis, which helps rank findings that have no EPSS value. The free scan is at gold.safeguard.sh/scan.
Quick check
Does a missing EPSS score mean low risk?
No. It usually means the finding is not a scored CVE. Use other signals to rank it.
How often are EPSS scores updated?
FIRST states they are published daily.
Sources
Last reviewed: 19 October 2026.
