Vulnerabilities

    Vulnerability management: patch first what attackers actually exploit

    FlowPro NG keeps a local copy of the NVD CVE database, adds the CISA KEV catalogue and EPSS scores and matches vulnerabilities to your devices. You see which ones affect you and where to start.
    Try it free for 14 daysOnline demo
    flowpro.local/cve
    CVE Monitor in FlowPro NG

    Tens of thousands of new vulnerabilities a year. You cannot patch them all at once.

    By CVSS alone, so many vulnerabilities are "critical" that the list never shrinks, yet most of them are never exploited in practice. A small team needs to know which flaws affect its own devices and which ones attackers already use.

    That is why FlowPro NG combines three sources: CVSS says how severe a flaw is, EPSS estimates how likely it is to be exploited, and the CISA KEV catalogue confirms that it already is. NIS2 also requires vulnerability handling, so a record of what you have fixed helps too.

    What you get

    Vulnerability management in FlowPro NG

    Local CVE database from NVD

    After installation, all records are downloaded from the NVD API 2.0 (hundreds of thousands of CVEs); after that only changes are fetched every hour. Search by CVE ID, keywords, vendor, product or date.

    CISA KEV catalogue

    Vulnerabilities that the US agency CISA lists as actively exploited carry a KEV flag in lists and detail views. The catalogue is refreshed with every sync.

    EPSS scores

    Once a day each CVE gets its EPSS score from FIRST: the probability of exploitation in the next 30 days. You can filter and sort by EPSS.

    CVEs matched to devices

    The CVE ↔ Assets module compares CVEs with the operating systems, software and models of your devices. For each device you see the vulnerabilities that affect it with severity, CVSS, EPSS and KEV.

    Remediation status and export

    Set a status for each CVE and device pair: open, in progress, resolved or accepted risk. Export the whole table to CSV for an audit or a patch plan.

    Product watchlist

    Add the vendors and products you use, or specific CVEs, to the watchlist. When a new vulnerability appears for a watched product, you get an alert.

    • CVE
    • NVD API 2.0
    • CISA KEV
    • FIRST EPSS
    • CVSS v3.1
    • CPE
    • Elastic Agent
    • NIS2

    How it works

    Up and running in a few steps

    1. 01

      Enable the CVE module

      It is part of the Security license and above. The server needs outbound access to NVD, CISA and FIRST. The first download takes a while, later updates are quick.

    2. 02

      Keep your asset inventory

      Devices running the Elastic Agent register themselves; add the rest manually. The more accurate the OS and software versions, the more accurate the CVE matching.

    3. 03

      Work by priority

      Start with vulnerabilities flagged KEV, then high EPSS combined with high CVSS. Record the remediation status right on the device.

    FAQ

    Frequently asked questions

    What is EPSS?

    EPSS (Exploit Prediction Scoring System) is a model by FIRST that estimates, for every CVE, the probability of exploitation in the next 30 days (0–100%). Unlike CVSS, it does not say how severe a flaw is but how likely it is to be used. Scores are recalculated daily.

    What is the CISA KEV catalogue?

    Known Exploited Vulnerabilities is a public list maintained by the US agency CISA. It contains only vulnerabilities with evidence of real-world exploitation. It is a small fraction of all CVEs and therefore a good starting point for patching.

    What is the difference between CVSS and EPSS?

    CVSS (0–10) rates the severity of a vulnerability, i.e. what an attacker could do. EPSS estimates how likely it is to be exploited. The top priority goes to flaws with both high CVSS and high EPSS, and above all to those in the KEV catalogue.

    How does FlowPro NG know which CVEs affect my devices?

    It compares CPE identifiers from the CVE database with the operating system, version, model and software of your registered devices. Data for devices running the Elastic Agent are filled in automatically. The result is a vulnerability list for each device.

    Does information about my devices leave my network?

    No. The server downloads public data from NVD, CISA and FIRST itself, and matching against your devices runs locally. Neither your device list nor its vulnerabilities are sent anywhere.

    Related solutions

    SIEM and log managementLogs from servers, workstations and network devices in one place. Search, detection rules and alerts on your own server.Intrusion detection (IDS)Suricata IDS inspects network traffic packet by packet and alerts you to intrusion attempts, malware and exploits. DNS, HTTP, TLS and FTP included.Active Directory monitoringUsers, computers and groups from Active Directory in one place. Automatic checks find inactive accounts, old passwords and risky settings.
    How FlowPro NG compares to Wazuh, Elastic, Splunk and Flowmon

    Try it on your own network

    The 14-day Enterprise trial unlocks every module. You install it on your own server, no credit card needed.

    Start Free TrialOnline Demo