Two sources to sort thousands of CVEs: the catalogue of known exploited vulnerabilities, and a probability-of-exploitation score.
The KEV (Known Exploited Vulnerabilities) catalogue lists CVEs whose exploitation has been observed. EPSS (Exploit Prediction Scoring System) gives each CVE a probability of exploitation within thirty days. Together, they separate theoretical vulnerabilities from those actually used.
The Vulnerabilities scanner matches the NVD, KEV and EPSS with the exposure of the resource in the graph. A KEV CVE on a machine reachable from the internet raises the score of the attack path that goes through it.
The online demonstration is open to all, on fictitious data. For an instance on your own accounts, request a demonstration.