# Cve Triage

> Scoring rubric for prioritizing CVEs by severity, exploitability, and exposure

- Skill: `leonmelamud/cve-triage` (Agent Skill)
- Install (CLI): `npx skillmds@latest add leonmelamud/cve-triage`
- Raw SKILL.md: https://api.skillmd.com/api/skills/leonmelamud/cve-triage/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Coding & Dev Tools
- Author: leonmelamud (https://skillmd.com/u/leonmelamud)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/leonmelamud/cve-triage

---


# CVE Triage Rubric

Assign priority:

| Priority | Criteria |
|---|---|
| P1 | CVSS ≥ 9.0, or known exploited (KEV), internet-facing asset |
| P2 | CVSS 7.0–8.9 with public PoC, or KEV on internal asset |
| P3 | CVSS 4.0–6.9, no known exploitation |
| P4 | CVSS < 4.0, or not applicable to our stack |

Always check: is the vulnerable component actually reachable in our deployment? If not, downgrade one level and note why.