Documentation
Vulnerabilities
Browse and filter the CVE catalogue, rank CVEs by risk score and export what you find.
Overview
The Vulnerabilities page is the CVE catalogue: every CVE that DeviceQuest knows about from its vulnerability feeds, with severity, CVSS, EPSS, CISA KEV status and a composite risk score. DeviceQuest matches these CVEs against the software, operating systems and device models found on your assets. Use this page to look up a CVE, find the most dangerous ones and open a CVE to see which of your assets it affects.
To work through the vulnerabilities found on your own assets, use Triage.
Screen tour
- Search CVEs, software…: finds CVEs whose ID, description or affected software contains the text.
- Filters: opens the filter panel. The badge counts the active filters.
- Export: copies or downloads the CVEs on the current page.
- Triage: opens Triage, where you work on the CVEs found on your assets.
- ⌘K: opens the command palette for this page.
- Severity · this page: the severity mix of the CVEs on the current page. Click a severity to filter by it.
- CVE: the CVE ID. Click it to open the CVE details.
- Risk: the composite risk score. Click the header to sort by risk, highest first.
The header shows how many CVEs are in the catalogue and which rows you are looking at, for example Showing 1–50 of 133,613 · page 1 of 2,673. Each page holds 50 CVEs. Use ← Prev and Next → at the bottom of the table to move between pages.
Columns
| Column | What it shows |
|---|---|
| CVE | The CVE ID. Hover to see Open {CVE} details; click to open the CVE. |
| Severity | A four-bar severity ladder and the label: Critical, High, Medium, Low or Informational. |
| CVSS | The CVSS v3 base score, with the CVSS v4 score underneath (for example v4 9.3) when the feed provides one. |
| EPSS | The EPSS probability that the CVE is exploited in the next 30 days, as a badge such as EPSS 97.4%. The badge colour follows the EPSS percentile, with separate colours above the 50th percentile, above the 20th percentile and below. Hover for the exact score and percentile. |
| KEV | A CISA KEV badge when the CVE is in the CISA Known Exploited Vulnerabilities catalogue, otherwise —. |
| Risk | The composite risk score and its tier. See Risk score. |
| Description | The first two lines of the description. Hover to read all of it. |
| Software | The first two affected products, then +N more. Hover +N more to see the rest. |
| Published | The date the CVE was published. |
Risk score
The risk score combines how severe a CVE is with how likely it is to be exploited:
Risk = CVSS × EPSS × 1.2 if the CVE is in CISA KEV
- CVSS is the CVSS v3 base score (0–10).
- EPSS is the exploit probability (0–1).
- CVEs listed in CISA KEV get a 1.2 boost, because they are known to be exploited.
- The score is capped at 10.
For example, a CVSS 9.8 CVE with an EPSS of 0.94 that is in KEV scores 9.8 × 0.94 × 1.2 = 11.05, shown as 10.00. The same CVE without KEV scores 9.21.
| Tier | Score | Meaning |
|---|---|---|
| High priority | above 7 | Severe and likely to be exploited. Fix first. |
| Medium priority | above 4, up to 7 | Plan a fix in your normal patch cycle. |
| Low priority | 4 or less | Low impact, or unlikely to be exploited. |
Hover a risk value to see the score and tier, for example Risk 9.21 · High priority. Click the Risk header to sort the catalogue by risk score, highest first. Click it again to return to the default order (CVSS, highest first, then CVE ID).
Filter the catalogue
- Severity: Any, Critical, High, Medium, Low or Informational.
- CVSS ≥: the lowest CVSS v3 score to show (0.0–10.0).
- CVSS ≤: the highest CVSS v3 score to show.
- Published from: CVEs published on or after this date.
- Published to: CVEs published on or before this date.
- Active filters appear as chips. Click × on a chip to remove that filter.
- Click Filters.
- Set any of the fields. Each change applies straight away.
- To remove one filter, click × on its chip. To remove them all, click Clear all (shown when two or more filters are active).
If CVSS ≥ is higher than CVSS ≤, the panel warns that no vulnerabilities can match.
You can also filter by severity from the Severity · this page ribbon: click a severity to show only that severity, and click it again to clear the filter.
Filters, search, sort order and page number are kept in the page address, so you can bookmark or share a filtered view.
Export CVEs
Click Export and choose:
| Option | What you get |
|---|---|
| Copy as ticket draft (this page) | A Markdown table of the CVEs on the page, ready to paste into a ticket. |
| Copy as Slack message (this page) | A short list of up to 10 CVEs, formatted for Slack. |
| Email affected team (this page) | A new email in your mail program with the subject [Security] N vulnerability finding(s) requiring attention and the first five CVEs. |
| Download CSV (this page) | vulnerabilities.csv with the columns cveId, severity, cvssScore, description and publishedAt. |
Every option uses the CVEs on the current page. Filter and sort first to export the CVEs you need. A message confirms each copy.
Command palette
Press ⌘K (or Ctrl+K), or click ⌘K, to open the command palette. Type to search, then press Enter to run the selected item:
- Filter: Critical severity (and the other severities)
- Clear all filters
- Download CSV (this page)
- the first eight CVEs on the page, to open one directly
Keyboard shortcuts
| Key | Action |
|---|---|
| ⌘K / Ctrl+K | Open or close the command palette |
| ↑ / ↓ | Move through the palette items |
| Enter | Run the selected palette item |
| Esc | Close the palette |