Patch the CVEs that actually matter this week.
A daily-regeneratable prioritization report that ranks active CVEs using Plan B scoring — KEV, EPSS, CVSS, vendor advisories, and patch availability. $49. One-time purchase. Yours forever after checkout.
Frozen sample shows Patch Tuesday October 13, 2026. Daily-regeneratable CLI ships with purchase.
How it works
Pull
Pull CVE data from NVD, CISA KEV catalog, and EPSS scores. Bring your NVD API key.
Score
Plan B formula weights signals: 35% KEV, 25% EPSS percentile, 15% EPSS probability bucket, 10% CVSS severity, 10% vendor advisory recency, 5% patch availability, -10% rejected/disputed.
Ship
One bundle per run: markdown, JSON, PDF, and ranked CSV — all in the same output directory. Sort, filter, paste into your patch-Tuesday ticket. Done.
Plan B scoring — the methodology
Plan B is an opinionated linear weighting of public CVE signals. It is built for engineering teams that need an actionable patch order, not a perfect academic prioritization model.
This isn’t the only way to score CVEs. It is a defensible one that surfaces the patch-this-week list in under a minute, keeps the logic inspectable, and makes tradeoffs explicit enough to tune for your environment.
Source: Companion CLI (MIT-licensed) reproduces this scoring at github.com/aislabs-ai/cve-rank.
score = 35*kev
+ 25*epss_percentile
+ 15*epss_probability_bucket
+ 10*cvss_severity_bucket
+ 10*recent_vendor_advisory
+ 5*patch_available
- 10*rejected_or_disputed Quickstart
After purchase, you get a Python package (requires Python 3.12) and a CLI. Bring your own NVD API key (free from NIST).
# requires Python 3.12 pip install aislabs_cve_priority-<version>.whl # point at your NVD API key (free at https://nvd.nist.gov/developers/request-an-api-key) export NVD_API_KEY=your_key_here # regenerate today's report bundle (Markdown, JSON, PDF, and ranked CSV) ais-cve-priority run --output ./reports/today
Wire it into cron or your CI of choice. Reports regenerate from scratch each day — no state to manage.
Frozen sample · Patch Tuesday October 13, 2026
This is the exact format you get every day. The frozen sample is from Patch Tuesday October 13, 2026 — the daily-regeneratable version ships with purchase.
| Rank | CVE ID | Affected | Score | KEV | EPSS pct | CVSS | Description |
|---|---|---|---|---|---|---|---|
| 1 | CVE-2026-96951 | Microsoft | 68 | Yes | 0 | 8.8 | Improper neutralization of special elements used in a command ('command injection') in Windows Shell allows an unauthorized attacker to bypa… |
| 2 | CVE-2026-97816 | Microsoft | 20 | No | 0 | 9.8 | Use after free in OpenSSH for Windows allows an unauthorized attacker to execute code over a network. |
| 3 | CVE-2026-97815 | Microsoft | 20 | No | 0 | 9.8 | Heap-based buffer overflow in Windows Error Reporting allows an unauthorized attacker to execute code over a network. |
| 4 | CVE-2026-97814 | Microsoft | 20 | No | 0 | 9.8 | Heap-based buffer overflow in Windows Text Shaping allows an unauthorized attacker to execute code over a network. |
| 5 | CVE-2026-97805 | Microsoft | 20 | No | 0 | 9.8 | Out-of-bounds read in Windows Partition Management Driver allows an unauthorized attacker to execute code over a network. |
| 6 | CVE-2026-97749 | Microsoft | 20 | No | 0 | 9.8 | Double free in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network. |
| 7 | CVE-2026-97016 | Microsoft | 20 | No | 0 | 9.8 | Heap-based buffer overflow in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network. |
| 8 | CVE-2026-96934 | Microsoft | 20 | No | 0 | 9.8 | Use after free in Windows DHCP Server allows an unauthorized attacker to execute code over a network. |
| 9 | CVE-2026-96924 | Microsoft | 20 | No | 0 | 9.8 | Untrusted pointer dereference in Windows OLE allows an unauthorized attacker to execute code over a network. |
| 10 | CVE-2026-96909 | Microsoft | 20 | No | 0 | 9.8 | Heap-based buffer overflow in Windows BitLocker allows an unauthorized attacker to execute code over a network. |
Want the manifest? See what’s in the kit →
What you get
The CLI
Python package (aislabs_cve_priority) + ais-cve-priority CLI. Runs offline once data is fetched.
Daily-regeneratable reports
Markdown, JSON, PDF, and ranked CSV in one output directory. Sort, filter, paste, or pipe into your tooling.
Methodology docs
Plan B scoring explained in 20 minutes. Every weight justified. Tweak it for your environment if you want.
Companion CLI (MIT)
cve-rank for ad-hoc one-off scoring. Public, open, hackable.
How this is different
Other tools either show you everything (overwhelming) or hide their logic behind a sales call (unauditable). This is the middle path.
Vanilla NVD / CISA KEV feed
- Free, but unranked
- You’re the prioritization layer
- No defensible patch-this-first output
AIS CVE Priority Kit
$49 · one-time- Plan B scoring (auditable formula above)
- Daily report regen (you run it; data stays local)
- $49, yours forever
- MIT companion CLI for ad-hoc
Enterprise vulnerability platforms
- $20k-$80k/yr
- Black-box scoring
- Sales call to see pricing
- Locks your data into their cloud
Pricing
CVE Priority Kit — $49
One-time purchase. No subscription. No upsells.
- The full Python package + CLI
- Daily-regeneratable Plan B prioritization
- Methodology docs (every weight justified)
- MIT companion CLI (cve-rank)
- Email support at [email protected]
Pay once by card or crypto. Yours forever after checkout.
License
What you can do: Use the kit internally for your team or organization, on as many machines as you need. Modify scoring weights for your environment. Pipe outputs into your internal tooling. Run it on a schedule. Keep using it indefinitely after purchase.
What you can’t do: Resell the kit, redistribute it as your own product, or strip the attribution and re-publish. The companion CLI (cve-rank) is MIT-licensed and unrestricted — use it however you want.
Defensive use only
The CVE Priority Kit and the companion CLI (cve-rank) are intended for defensive
security work — patch prioritization, internal vulnerability triage, and engineering team
workflows. The Plan B scoring is designed to surface the patches that protect your systems, not
to prioritize offensive operations against systems you do not have authorization to test.
By purchasing or using the kit, you agree to use it only on systems you own or have explicit written authorization to assess. Compliance with applicable laws (CFAA, GDPR, and your local equivalents) is your responsibility.
Support
[email protected] — For purchase questions, install issues, or anything else. Reply within two business days.
GitHub
github.com/aislabs-ai/cve-rank — For issues with the open-source companion CLI. Issues and PRs welcome.
Ready to stop scrolling NVD on Patch Tuesday?
$49. One purchase. Pays itself back the first time you skip patching a low-priority CVE that turns out to be hype.
Buy the CVE Priority Kit — $49 →