Low Severity
CVE-2026-102895
Published: Nov 10, 2026
How good is your vulnerability triage? Score any prioritization method against real CISA KEV + FIRST EPSS data, replayed day by day with no future data.
# 🎯 triage-scorecard
**How good is your vulnerability triage, really?** Score any prioritization method against **real** public data, the CISA Known Exploited Vulnerabilities catalog (KEV) and FIRST's daily EPSS scores, replayed day by day with **no future data**.
[](https://github.com/milesgurule-png/triage-scorecard/actions/workflows/test.yml)   
Most teams pick a rule like "only CRITICAL" or "EPSS above 0.1" and hope. This tool shows what that rule actually costs you: how many alerts a day, how many known-exploited vulnerabilities it misses, and whether it warns you *before* a CVE is exploited.
<!-- kev-watch:start -->
## 🔴 KEV Watch (updates daily)
**9 of 12** vulnerabilities CISA confirmed as exploited in the last 14 days had an EPSS score under 0.1 the day before, so an "EPSS ≥ 0.1" filter would not have flagged them.
| Added to KEV | CVE | Vendor / product | EPSS day before | Percentile | EPSS ≥ 0.1? |
|---|---|---|---:|---:|:---:|
| 2026-11-09 | [CVE-2026-102895](https://nvd.nist.gov/vuln/detail/CVE-2026-102895) | GPUStack GPUStack | 0.003 | 26.4% | ❌ missed |
| 2026-11-09 | [CVE-2026-116779](https://nvd.nist.gov/vuln/detail/CVE-2026-116779) | SignalWire FreeSwitch | 0.013 | 70.6% | ❌ missed |
| 2026-11-09 | [CVE-2026-123158](https://nvd.nist.gov/vuln/detail/CVE-2026-123158) | OpenBSD OpenSSH | 0.010 | 63.5% | ❌ missed |
| 2026-11-09 | [CVE-2026-123218](https://nvd.nist.gov/vuln/detail/CVE-2026-123218) | IBM Aspera Faspex | 0.004 | 34.1% | ❌ missed |
| 2026-11-06 | [CVE-2026-19868](https://nvd.nist.gov/vuln/detail/CVE-2026-19868) | SonicWall SonicOS SSLVPN | not scored | – | – |
| 2026-11-04 | [CVE-2024-2783