Frequently Asked Questions
Everything you need to know about CVEScope
What is CVEScope?
CVEScope is a vulnerability awareness platform designed to help you spot newly emerging CVEs early, understand which ones are gaining momentum, and prioritise what to investigate first.
Why was CVEScope created?
Because "official" vulnerability information is often late, fragmented, or context-poor when you most need clarity. CVEScope exists to reduce the gap between first public signals and actionable triage—without forcing you to trawl dozens of sources manually.
How does CVEScope work (in simple terms)?
CVEScope continuously collects public signals from multiple sources, correlates them into a single CVE view, and applies prioritisation logic to help you focus. In practice, that means:
- •Multi-source ingestion: pulls in references, advisories, and exploitation-related signals from reputable public sources.
- •Correlation & de-duplication: groups related mentions and references so you're not counting noise.
- •Context & scoring: combines widely used measures (e.g., severity metrics and exploitation likelihood signals) with momentum indicators.
- •Attribution & timestamps: shows reference links and "first seen / last seen" style freshness indicators.
It's intentionally designed to explain why a CVE is showing up—without exposing internal collection rules or proprietary logic.
What does "emerging" mean in CVEScope?
"Emerging" means a CVE has new public activity that suggests it's becoming relevant (for example: new advisories, heightened discussion, newly observed exploitation signals, or rapid growth in mentions). It's not a claim that exploitation is guaranteed—it's a signal that the CVE is worth attention.
What does "trending" mean?
"Trending" refers to momentum—a CVE receiving increasing attention or signals over time, beyond baseline background chatter. Trending is about change, not just raw volume.
Where does the data come from?
CVEScope uses a blend of reputable public vulnerability and security sources (for example: national databases, vendor advisories, and other widely used security references). Exact collection rules and weighting are intentionally not disclosed to prevent gaming and scraping.
Why is some information missing for a vulnerability (e.g., CVSS severity or EPSS)?
Sometimes a CVE appears in CVEScope before all third-party enrichment is available. Common reasons include:
- •No CVSS 3.x score yet: The CVSS score may not have been assigned or published by the relevant authority/vendor at the time you're viewing it.
- •No EPSS score yet: EPSS is calculated and released on a schedule, and newly added or recently updated CVEs may not have an EPSS value immediately.
- •Not published to NIST/NVD yet: Some CVEs circulate publicly before they are fully processed and published in NIST's NVD, which can delay standardised fields and metadata.
CVEScope shows what is available at the time and updates as upstream sources publish more detail.
If something looks wrong (for example, fields that stay blank unusually long or data that contradicts the linked sources), please contact us so we can investigate.
What is "Operational Severity" (S1–S4)?
Operational Severity is CVEScope's triage label—a practical "how urgently should I care?" indicator for operations and security teams. It is not a replacement for CVSS, and it doesn't claim to be a universal truth. It's an opinionated operational filter.
Critical (Act now)
Typically used when there are strong indications of real-world risk, such as:
- • Known exploitation signals (e.g., inclusion in known-exploited catalogues or credible exploitation reports)
- • High impact potential, especially for common enterprise tech
- • Strong confidence signals and rapidly increasing attention
Typical action: immediate triage, confirm exposure, apply mitigations/patches fast, monitor for exploitation attempts.
High (Prioritise)
Typically used when:
- • Severity and/or exploitation likelihood appears meaningfully elevated
- • There are credible technical details and strong community/vendor attention
- • The CVE is relevant to commonly deployed products
Typical action: schedule urgent validation and remediation; elevate monitoring.
Moderate (Track & assess)
Typically used when:
- • The issue is real, but evidence suggests lower immediacy
- • Exploitability may be unclear, limited, or requires conditions
- • Signals are steady rather than accelerating
Typical action: assess exposure, plan patching, keep under review.
Low (Background)
Typically used when:
- • Limited impact or narrow conditions
- • Low confidence signals, low momentum, or low relevance to most environments
Typical action: document, monitor lightly, patch in normal cycles if applicable.
Important: S1–S4 is a prioritisation aid. Your environment, exposure, compensating controls, and asset criticality still decide what matters most.
Is CVEScope protected?
Yes. CVEScope uses access controls and rate limiting to help prevent abuse and automated bulk scraping. Key vulnerability views are available only to authenticated users, and requests are monitored and throttled when needed. While no online service can guarantee absolute protection, CVEScope is designed to minimise unnecessary data exposure and reduce the risk of automated extraction.
Can I access CVEScope via API or integrate it into workflows?
Possibly. If you want API access or workflow integration (SIEM/SOAR, ticketing, alerts, internal dashboards), contact us to discuss options and fit. Integrations are handled on a case-by-case basis.
Can I report a security issue?
Yes. If you believe you've found a security issue, please use the security reporting option on the site's contact/about section. Include enough detail to reproduce the issue safely.