Yes. The CISA KEV catalog is published as CSV and JSON, and EPSS scores are available as a daily CSV and an API without registration. You can join them to scanner output with a script. The work is in the join, the refresh, the failure handling and keeping it running.
What the two feeds are
KEV. CISA describes its Known Exploited Vulnerabilities catalog as the authoritative source of vulnerabilities exploited in the wild, and advises organisations to use it as an input to prioritisation. Entries show a date added, a due date and whether the vulnerability is known to be used in ransomware campaigns.
EPSS. The Exploit Prediction Scoring System estimates the probability that a CVE will be exploited in the wild in the next 30 days, as a score from 0 to 1. FIRST says scores are recalculated daily and are free to download, and that EPSS is not a severity score or a risk score. It also advises against multiplying EPSS by CVSS.
The two answer different questions. KEV says "this has been exploited". EPSS says "this might be, soon". Neither says whether the vulnerable code is reachable in your application.
What the integration involves
- Export scanner results in a structured format such as SARIF or JSON, keyed by CVE id.
- Download KEV daily and EPSS daily. Store dated copies so you can explain past decisions.
- Join on CVE id. Add three fields: in KEV (yes or no), EPSS score, EPSS percentile.
- Define a rule. For example, a finding in KEV gets the fastest queue, and a high EPSS score moves a finding up within its severity tier. Write down thresholds as policy, with a named owner.
- Handle gaps. Not every finding has a CVE id, and ecosystem advisories may use other identifiers, so decide how unmatched findings are treated.
- Alert when a feed download fails, so stale data is not mistaken for no data.
What this does not solve
| Gap | Why it remains |
|---|---|
| Is the vulnerable function actually called | Needs reachability analysis, which is a separate capability |
| Is the asset exposed to the internet | Needs asset context |
| Is a fix available and safe | Needs upgrade analysis |
| Who owns the finding | Needs routing rules |
Build or buy
For a small codebase, a script and a weekly review can be fine, and it teaches the team how prioritisation works. As repositories and teams grow, the maintenance of joins, ownership routing and history takes real time. That is the point to compare with a managed platform that already combines these signals. Our guide to KEV and EPSS ranking across many services covers the ranking side.
Try it yourself
Click through it at your own pace, or open it full screen. Look at how exploitation evidence and reachability change the order of the same list of findings.
Safeguard provides reachability analysis and a free scan at gold.safeguard.sh/scan.
Quick check
Should EPSS replace CVSS?
No. FIRST describes EPSS as a probability of exploitation, not severity. Use them together as separate signals, without multiplying them.
Is every KEV finding urgent for me?
It is a strong signal, but confirm the affected component is actually present and exposed in your environment.
Sources
Last reviewed: 19 October 2026.
