Your files stay on your device

Vulnerability prioritization calculator

Score security findings from CVSS, EPSS, KEV status, exposure, and business criticality with a transparent weighted 0-100 point breakdown, ranked list, and CSV or JSON import.

CSV columns are matched by name: title, cvss, epss, kev, exposure (internet, internal, isolated), criticality (critical, high, medium, low), and controls (none, partial, strong). JSON accepts a bare array or an object holding findings, vulnerabilities, items, results, or data.

Paste findings, then press Score findings.

What this calculator does, and what it does not
It ranks the findings you hand it with one disclosed formula: every weight, multiplier, and band is on this page, every factor's points are shown per finding, and unknown inputs follow the policy you picked and are listed, never silently zeroed. It does not fetch EPSS probabilities or the KEV catalog; those arrive in your columns. It is a triage ordering aid, not a risk model: it cannot see exploit chains, asset dependencies, or how current the threat data in your import is.OptionsScore findings

More regex & cron tools

- JSON validator (/json/validator)
- JSON query (/json/query)
- JSON diff (/json/diff)
All regex & cron tools (/dev)

Was this tool useful?
YesNo

Canonical HTML: https://nutter.tools/dev/vulnerability-prioritization-calculator
Markdown version: https://nutter.tools/dev/vulnerability-prioritization-calculator.md
Plain-text version: https://nutter.tools/dev/vulnerability-prioritization-calculator.txt
Agent index: https://nutter.tools/llms.txt