Skip to main content

Vulnerability Prioritization

CVD Portal helps you decide which reports to fix first. It does not calculate a combined priority score.

Data that helps you set priority​

  • Severity. Each report has a severity: Unrated, Low, Medium, High or Critical. You set it by hand or with the CVSS calculator.
  • Actively exploited flag. You can mark a report as an actively exploited vulnerability. This starts the CRA Article 14 reporting deadlines. See Article 14 Reporting.
  • Exploitation evidence. On the Enterprise plan, when a report has an advisory with a CVE ID, the report page shows exploitation evidence (proof of concept or exploited) from public sources. See Exploitation Signals.
  • AI triage. On the Enterprise plan, AI triage can suggest a severity and a category for a new report. See Settings → AI Triage.

Find work in the submissions list​

You can filter the Submissions list by status and by month. The list shows the number of NEW reports that are older than 48 hours.

Record the decision​

Record why you fix a report now or later in the remediation decision of the report. See Remediation Decisions.