NVD CVE data
Continuous sync from the National Vulnerability Database, matched against technology fingerprints detected on customer domains and websites.
Solution
Critical CVE alerts for MSPs across customer tenants
Track critical CVE exposure across every customer domain and website without manual CVE lookups. SecurityScore.me correlates NVD, CISA KEV, and EPSS intelligence against technology detected on customer assets, then surfaces confirmed exposure as severity-ranked findings under Security Operations.
What CVE alerts correlate
CISA KEV catalog
Known Exploited Vulnerabilities are flagged separately so CVEs with confirmed real-world exploitation get priority over the general CVE backlog.
EPSS scoring
Exploit Prediction Scoring System data adds exploitation-likelihood context alongside CVSS severity.
Applicability confidence
Matches are marked confirmed, potential, or unknown based on fingerprint confidence—low-confidence signals alone cannot create a high-severity confirmed finding.
External exposure tracking, not a SIEM
What this tracks
CVE alerts identify externally observable technology on customer domains and websites, such as web servers, CMS platforms, and libraries like Apache, nginx, IIS, WordPress, Drupal, Joomla, PHP, jQuery, and Bootstrap, that matches a known CVE, then checks CISA KEV and EPSS for exploitation context.
What this is not
This is external vulnerability exposure tracking, not active exploitation detection or a SIEM. A CVE match does not confirm exploitation occurred, and safe rescans refresh fingerprints without verifying exploitation.
Where it sits versus an authenticated scanner
An authenticated vulnerability scanner logs into a host and enumerates installed packages. This runs from the outside with no credentials, fingerprinting what is publicly observable. It is lighter, safe to run continuously across a whole portfolio, and catches the exposure an attacker would see first. It does not replace an internal scan where one is in scope.
Confirmed, potential, unknown
Each match is graded by fingerprint confidence. A confirmed match on a clearly identified version and a potential match on an ambiguous banner are treated differently, and a low-confidence signal alone cannot produce a high-severity confirmed finding.
CVE alert workflow for MSP teams
- Detect technology
- Domain and website scans fingerprint software running on customer assets.
- Correlate against CVEs
- Scheduled correlation checks fingerprints against synced NVD, KEV, and EPSS data.
- Review under Security Operations
- Critical CVEs surface as severity-ranked findings alongside other posture findings.
- Safe rescan
- Trigger a rescan for an approved website or domain asset to refresh fingerprints and correlation. Passive, rate-limited, no arbitrary targets.
Related pages
- Security findings
CVE alerts surface as severity-ranked findings in the same inbox.
- Security operations
Where Critical CVEs are triaged alongside other MSP operations work.
- Domain & website monitoring
Scheduled domain and website scans that detect the technology CVE alerts correlate against.
- Alert management
Route CVE and other monitoring alerts to the right MSP team members.
- CVE prioritization: NVD vs CISA KEV vs EPSS (guide)
How the three data sources combine into a triage workflow.
- Contact
Request a demo.
Frequently asked questions
Next steps
See critical CVE alerts in a demo
Walk through technology detection, CVE correlation, and Critical CVEs under Security Operations.