skills.rest
blamejs
blamejsOFFICIAL
Explore all skills by this author →
WebsiteGitHub

exploit-scoring

Calculate RWEP priority scores for CVEs using exploit availability and threat patterns.

Updated May 11, 2026
Search Tags:#vulnerability management#threat intelligence#cve prioritization#compliance gaps#rwep scoring#exploit risk#cvss alternative
One-click install
npx skills add https://github.com/blamejs/exceptd-skills --skill exploit-scoring
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: exploit-scoring
Source: https://github.com/blamejs/exceptd-skills/tree/main/skills/exploit-scoring
Command: npx skills add https://github.com/blamejs/exceptd-skills --skill exploit-scoring

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

CVSS only measures the theoretical worst-case severity of a vulnerability, ignoring real-world exploit availability, AI-accelerated weaponization, CISA KEV status, and operational constraints like reboot requirements. This leads organizations to waste resources on low-risk high-CVSS bugs while under-prioritizing critical threats like AI-discovered kernel LPEs with public exploits that require 4-hour remediation windows.

Core Features & Use Cases

  • RWEP Scoring Formula: A weighted scoring model that factors in CISA KEV listing, public PoC availability, AI-assisted discovery, confirmed active exploitation, blast radius, patch availability, and live-patch support to generate a 0-100 priority score.
  • Pre-Calculated 2026 CVE Scores: Includes validated scores for high-profile vulnerabilities like Copy Fail (CVE-2026-31431, RWEP 90) and Fragnesia (CVE-2026-46300, RWEP 20) to demonstrate CVSS vs. real-world priority divergence.
  • Framework Gap Analysis: Explicitly maps how major compliance frameworks (NIST 800-53, PCI DSS, ISO 27001, CIS Controls) fail to account for modern threat patterns, plus D3FEND defensive technique mappings per priority band.
  • Use Case: A security operations team can use this skill to correctly prioritize CVE-2026-31431 (CVSS 7.8, RWEP 90) as a 4-hour emergency over a CVSS 9.8 bug with no public exploit, avoiding compliance theater from CVSS-banded SLAs.

Quick Start

Use the exploit-scoring skill to calculate the RWEP priority score and required 4-hour remediation timeline for CVE-2026-31431.

Frequently Asked Questions about exploit-scoring

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I prioritize CVEs by real-world exploit risk instead of just CVSS severity?▼

To prioritize CVEs by real-world exploit risk, calculate a Real-World Exploit Priority (RWEP) score that weighs CISA KEV status, public PoC availability, and AI-discovered weaponization trends rather than relying solely on theoretical CVSS severity bands.

Why does a CVSS 9.8 vulnerability sometimes have a lower real-world priority than a CVSS 7.8 bug?▼

A CVSS 9.8 vulnerability can have a lower real-world priority because CVSS measures theoretical worst-case severity, whereas RWEP scoring penalizes bugs lacking public exploits and rewards confirmed active exploitation, correctly prioritizing a CVSS 7.8 kernel LPE with a public PoC.

How do I map vulnerability remediation timelines to compliance frameworks like NIST and PCI DSS?▼

Map vulnerability remediation timelines to compliance frameworks like NIST and PCI DSS by using exploit-availability-weighted RWEP scores to align patching SLAs with actual exploitation risk, explicitly addressing framework gaps that fail to account for modern AI-accelerated threat patterns.

What factors should I include in an exploit risk scoring model for 2026 threat patterns?▼

An exploit risk scoring model for 2026 threat patterns should include CISA KEV listing, public PoC availability, AI-assisted discovery, confirmed active exploitation, blast radius, patch availability, and live-patch support to generate an accurate 0-100 priority score.

Can I use RWEP scoring for vulnerability management under ISO 27001 and CIS Controls?▼

You can use RWEP scoring for vulnerability management under ISO 27001 and CIS Controls because it explicitly maps framework gap analysis and D3FEND defensive techniques to priority bands, satisfying compliance governance requirements for exploit-availability-weighted remediation timelines.

When should I trigger a 4-hour emergency remediation window for a CVE?▼

Trigger a 4-hour emergency remediation window for a CVE when its RWEP score indicates immediate danger, such as an AI-discovered kernel LPE with public exploit availability and confirmed active exploitation, overriding standard CVSS-banded SLAs to prevent compliance theater.

Related Skills

Explore More Legal & Compliance Skills→
camgrimseccamgrimsec
3

vulnerability-context-enricher

Aggregate CVE data from multiple sources into enriched vulnerability profiles with risk scores and remediation guidance.

Community
Advanced
blamejsblamejs

framework-gap-analysis

Analyze compliance framework controls against current attacker TTPs to produce structured gap declarations.

Official
Advanced
matteocervellimatteocervelli
25

vulnerability-assessor

Assess software vulnerabilities with CVSS scoring and remediation planning.

Community
Advanced
GRCEngClubGRCEngClub
367

aws-inspector-expert

Map AWS Inspector findings to SCF controls for SOC 2, FedRAMP, PCI DSS, and NIST 800-53.

Official
Intermediate