Every week a dependency scanner finds dozens of vulnerabilities. Every week most developers ignore them, because there is no time to fix 200 issues and no obvious way to know which 3 actually matter. The answer lives in three numbers: CVSS, EPSS and KEV.
The Common Vulnerability Scoring System (CVSS) gives every published CVE a score from 0 to 10 based on how bad the vulnerability could be in a worst-case scenario. The problem is that CVSS scores are entirely theoretical. In practice, fewer than 5% of published CVEs are ever exploited in the wild. A CVSS 9.8 in a library feature you don't use is a lower priority than a CVSS 6.0 actively used in ransomware campaigns. Sorting by CVSS alone means sorting by worst-case theory, not real-world risk.
The Exploit Prediction Scoring System (EPSS), maintained by FIRST, is a machine-learning model trained on actual exploitation evidence — threat intelligence feeds, honeypot data and proof-of-concept exploit activity. It produces a daily probability score (0–1) for the likelihood that a given CVE will be exploited in the next 30 days. The top 1% of CVEs by EPSS account for roughly 75% of observed exploitation attempts. Filter to CVEs with EPSS above 10% and your fix list shrinks dramatically while still covering the overwhelming majority of real attacks. EPSS is updated every day.
The CISA Known Exploited Vulnerabilities (KEV) catalog is the most reliable signal. CISA maintains a manually curated list of vulnerabilities confirmed exploited in real-world attacks. These aren't predictions — they're facts. If a CVE is in the KEV catalog, attackers have working exploits and are using them. KEV findings are always your highest priority, regardless of CVSS.
Fix KEV-listed findings with a fix available this week. Fix findings with EPSS above 0.20 and a fix available in the current sprint. Schedule Critical-CVSS/low-EPSS findings behind these. Accept and monitor Medium findings with no fix. Beyond these scores, direct dependencies warrant higher priority than the same CVE buried deep in the transitive tree. DepWarden fetches EPSS and KEV daily alongside the OSV mirror and uses all of these signals for its "Fix these first" list. See also: SAST vs SCA and what is a SBOM?.