July 29, 2026
Combine your compliance data with CVE and KEV data for reporting
Combine your patch vulnerabilities from scans with CVE and KEV data to understand the risk for your network devices.
By Dale Bingham
3 min read
Combine your patch vulnerabilities from scans like Tenable Nessus with common vulnerabilities and exposures (CVE) data and known exploited vulnerability (KEV) data to understand the risk for your servers, workstations, laptops, and connected network devices.
We are going to use our public repo at https://github.com/SoteriaSoftwareLLC/cyrinae-portfolio-manager-scripts to show the model of what you need to do. You can use this same setup with your own data to still get the CVE and KEV data to match your patch vulnerabilities or even your container / image scan vulnerabilities as well.
What the heck is CVE and KEV anyway
The CVE data is a public dictionary and list that gives a unique name to known computer security flaws. This list goes back several years and is continuously updated.
The KEV data is maintained by the U.S. Cybersecurity and Infrastructure Security Agency (CISA). It is an authoritative list of software flaws that have been confirmed to be actively attacked in the wild. KEV data usually shows reporting requirements and due dates.
You use these types of data combined with your vulnerability scans and your own knowledge of your network, devices, connections, and network boundaries per device to score risk and prioritize fixing issues.
Generate your Combined CVE List
To get a combined CVE listing, go to the CVE data and download the ZIP files containing the data. Then export them into the correct cve directory per the instructions to get setup. After all the *.json files from the zips are in there you can run the "combine script" to push them all into a .csv file, clean them up, and get them ready to go.
python patch-vulnerability/combine_cve_data.pypython patch-vulnerability/combine_cve_data.pyNow that you have that combined CEV CSV (these acronyms suck, right!?!?) you can run the CVE report and get all your patch vulnerabilities listed with their proper base (overall), exploit (ease of use), and impact (actual harm) scores. Keep this in mind: the higher the number, the worse it is.
Run the CVE Reports
The command to use for OpenRMF Professional hosted data against our external API is something like below. And the image shows what the PDF will look like. Run this command below to get all your current patch vulnerabilities, match them against your latest downloaded and combined CEV data and put into a PDF for readability and reporting.
Realize that patch vulnerability scans and even the CVE (and KEV) data are updated and ongoing. This is not a one-time thing. This is something to put into your routine or automate to get the data and act on it accordingly.
python patch-vulnerability/patch_vulnerability_cve_pdf.py \
https://{server-name} {applicationKey} {api token} {systemKey}python patch-vulnerability/patch_vulnerability_cve_pdf.py \
https://{server-name} {applicationKey} {api token} {systemKey}Download the latest KEV Data
You also can download the latest KEV data in *.json format and then use it in the python scripts at https://github.com/SoteriaSoftwareLLC/cyrinae-portfolio-manager-scripts as well.
When you have that place it in the proper "kev" data directory per instructions, save the file to use. It is that easy.
Run KEV and CVE / KEV Reports
Now you can run the KEV reports with some of the commands shown below. You can just show proper KEV data with your latest patch vulnerabilities. Or you can combine CVE and KEV data to show it all at once.
python patch-vulnerability/patch_vulnerability_kev_pdf.py \
https://{server-name} {applicationKey} {api token} {systemKey}
python patch-vulnerability/patch_vulnerability_cve_with_kev_pdf.py \
https://{server-name} {applicationKey} {api token} {systemKey}python patch-vulnerability/patch_vulnerability_kev_pdf.py \
https://{server-name} {applicationKey} {api token} {systemKey}
python patch-vulnerability/patch_vulnerability_cve_with_kev_pdf.py \
https://{server-name} {applicationKey} {api token} {systemKey}What to do with the Information
You can use the scoring as well as the KEV (it is being exploited, not just reported) and due dates to prioritize patching your devices.
Realize you need to add into that mix where the device sits, if it has external connections or paths to it from other systems or the public Internet, as well as its importance and what is running on it to perform your final patch priority list.
That usually involves your smart teammates that understand connections, network boundaries, and the use of the devices. With that information, and plan of action and milestones (POA&M) you can set the risk, completion date, resources and more to track.
In OpenRMF Professional we use our included live POA&M to do just that. However you do it, track it all the way to completion and keep updating the data with this cycle. And automate AS MUCH OF IT as you can!
Where to go Next
The public GitHub repo is found at https://github.com/SoteriaSoftwareLLC/cyrinae-portfolio-manager-scripts. And we are actively updating and adding more items here as we move forward for all OpenRMF Professional customers and evaluators. Note that these scripts are specifically designed to use the OpenRMF Professional API.
We also are showcasing the use and results with our YouTube channel videos to easily show how to leverage these across your data.
That said, the ideas around these are not only for OpenRMF Professional. They are for any user, any group, that is working to automate cyber compliance as much as possible. To influence cyber hygiene and cyber security from that. And to inform their team on where to concentrate to not only be compliant — to be as secure as possible while managing risk effectively based on real data.