Introduction
Open a dependency scanner on a large codebase and you will likely see hundreds of findings marked "critical." The CVSS base score is doing what it was built to do: rate how bad a flaw could be in the worst case, for anyone, on any system. It cannot tell you the one thing you need on Monday morning: which of those CVEs matters to your code right now.
That gap is expensive. One 2026 analysis by Picus Security found that CVSS-led triage puts teams to work on roughly 57% of all vulnerabilities while capturing only 2.3% of real-world exploitation, and Gartner estimates fewer than 10% of CVEs are ever exploited at all. So for every dependency CVE ZeroPath's SCA engine surfaces, we stop repeating the NVD number and layer four independent signals on top of it. Here is what they are, and why we are careful about how they combine.
Why isn't the CVSS score enough on its own?
CVSS measures theoretical severity under ideal exploitation conditions. It does not know whether attackers are using a flaw in the wild, how likely they are to, or whether your application ever calls the vulnerable code. A queue built on severity alone treats an unreachable transitive dependency the same as an internet-facing service already under attack. The result is the backlog every security team knows: thousands of "criticals," most of which pose no real risk to the app in front of you. Severity alone cannot separate the two.
What four signals does ZeroPath add to each CVE?
For every advisory, ZeroPath records four things beside the raw CVE:
- The real advisory CVSS. We parse the actual CVSS vector when the advisory has one. When it doesn't, we store nothing. There is no invented 5.0 "medium" to fill the blank, because a made-up number is a number your team learns to distrust.
- CISA KEV. If a CVE sits in CISA's Known Exploited Vulnerabilities catalog, it is being exploited in the wild right now. We record that it is listed, the date CISA added it, and whether it is tied to a known ransomware campaign.
- FIRST EPSS. The Exploit Prediction Scoring System gives a daily probability that a CVE will be exploited in the next 30 days, plus its percentile against every other scored CVE. It is how you rank the ones nobody is exploiting yet.
- A contextual severity for your repo. This is the signal no public feed can give you, and it is where the scanner does its real work.
How does ZeroPath know whether a CVE matters to your code?
The first three signals are public facts. The fourth comes from reading your codebase. The same AI validation agent that runs ZeroPath's SAST analysis investigates each CVE and asks a concrete question: is the vulnerable function actually called, and can untrusted input reach it?
From that investigation it produces two numbers on a 0 to 10 scale. One is a contextual severity, the impact if the flaw were exploited in your application. The other is a confidence, how complete the evidence is. Multiply them and you get a composite score from 0 to 100 that orders the queue. A frightening CVE the agent is only half-sure about sinks. A reachable, confirmed-exploitable one rises. The unreachable transitive dependency that pads every SCA report drops to the bottom, which is where it belongs. Every CVE in a batch gets an explicit verdict with its reasoning, so nothing is quietly dropped without a record of why.
This is the same idea behind our work on reducing false positives with repository context, applied to dependencies instead of first-party code.
How does ZeroPath keep this intelligence current and honest?
KEV and EPSS change daily. CISA adds entries several times a week, and EPSS rescores the whole catalog every day. A background worker re-fetches both feeds once a day and re-enriches every advisory we have ever recorded, not only new ones, so a CVE added to KEV tonight updates your existing findings tomorrow.
Freshness is tracked as its own fact. One record holds when the last successful refresh ran and the dates the feeds reported for themselves. If a feed is unreachable, ZeroPath does not wipe good data or quietly serve stale intelligence. It keeps the last known-good values, logs the gap loudly, and shows a coverage warning instead of pretending a CVE is "not exploited." Absence is always shown as absence, never as a fabricated zero.
One design choice is deliberate: KEV and EPSS sit next to a finding as signals for your analysts. They are not folded into the numeric severity, and they are not fed to the model that scores exploitability. Reachability is what moves the score. KEV and EPSS tell a human whether a reachable CVE is also on fire in the wild. Keeping them separate is what keeps each signal trustworthy.
What does this look like day to day?
In the issue list, a finding carries a KEV badge, its EPSS probability, and a reachability-adjusted severity, so a reachable and known-exploited CVE is obvious at a glance. For auditors and downstream teams, the same intelligence exports into a standard CycloneDX SBOM and VEX document. Unreachable CVEs are marked not_affected with a code_not_reachable justification, and KEV and EPSS ride along as machine-readable properties. That gives you a portable, evidence-backed answer to the question every security team eventually hears: why aren't you patching this CVE?
Key takeaways
- CVSS rates worst-case severity. It cannot tell you what is exploitable in your environment, and fewer than 10% of CVEs are ever exploited in the wild.
- ZeroPath adds four signals to every dependency CVE: the real advisory CVSS (or an honest blank), CISA KEV, FIRST EPSS, and an AI-derived contextual severity for your repo.
- Reachability-adjusted severity times confidence orders the queue, so reachable and exploitable rises while unreachable transitive noise sinks.
- KEV and EPSS refresh daily, fail loud when a feed is down, and stay decision signals rather than fabricated scores.
- The same intelligence exports to CycloneDX SBOM and VEX for compliance and downstream consumers.
See it on your own dependencies
Point ZeroPath at a repository and watch the same CVE list reorder once reachability, KEV, and EPSS are in the picture. Get a demo of ZeroPath.
