Nutter Tools
Nutter Tools

A free toolbox that runs in your browser. A tool for every job.

Your files never leave your device

Images

  • Convert images
  • Compress images
  • Resize images
  • Crop
  • Watermark

PDF & files

  • Merge PDFs
  • Split a PDF
  • Images to PDF
  • PDF to images
  • Remove photo location

Video & audio

  • Compress video
  • Convert video
  • Video to GIF
  • Convert audio
  • Trim audio

Everyday

  • QR codes
  • Passwords
  • Time zones
  • Unit converter
  • Word count
  • Webcam test

Developer

  • JSON formatter
  • Base64
  • Regex tester
  • Hashes
  • JWT decoder

Site

  • About
  • Contact
  • Settings
  • Privacy
  • Terms
  • Site map
  • llms.txt

Everyday

  • Images
  • Video
  • Audio
  • PDF & files
  • Text
  • QR codes
  • Units & math
  • Time & dates
  • Color
  • Passwords & IDs
  • Device tests
  • Sun & moon

For developers

  • JSON
  • Encoding
  • Regex & cron
  • Web & auth
  • Hashing & encryption
  • Config files
  • Network
  • Browser
  • AI
  • Fake data
© Nutter Toolsnutter.tools
  1. Home
  2. Regex & cron
  3. Vulnerability prioritization calculator
Your files stay on your device

Vulnerability prioritization calculator

Score security findings from CVSS, EPSS, KEV status, exposure, and business criticality with a transparent weighted 0-100 point breakdown, ranked list, and CSV or JSON import.

This tool is in beta

Still being tested. If a result looks wrong, tell us.

Report a problem

Findings list, CSV or JSON

CSV columns are matched by name: title, cvss, epss, kev, exposure (internet, internal, isolated), criticality (critical, high, medium, low), and controls (none, partial, strong). JSON accepts a bare array or an object holding findings, vulnerabilities, items, results, or data.

0 characters

Paste findings, then press Score findings.

What this calculator does, and what it does not

It ranks the findings you hand it with one disclosed formula: every weight, multiplier, and band is on this page, every factor's points are shown per finding, and unknown inputs follow the policy you picked and are listed, never silently zeroed. It does not fetch EPSS probabilities or the KEV catalog; those arrive in your columns. It is a triage ordering aid, not a risk model: it cannot see exploit chains, asset dependencies, or how current the threat data in your import is.

Findings and formula

Unknown inputsFields left empty, listed under each finding
Lifts the band label when the score alone lands lower

Bands

Score = controls multiplier x weighted average x 100, banded top down. Weights go up to 100, bands 8 at most, multipliers 0.05 to 1. Up to 500 findings and 200,000 characters of text per run.

Runs on this device. Nothing is uploaded.

More regex & cron tools

  • JSON validator
  • JSON query
  • JSON diff
All regex & cron tools

Was this tool useful?