FixNext

Inspiration

92,205 vulnerabilities have been published in 2026 so far — more than double all of 2024. Fewer than 1 in 250 is ever confirmed to be used by attackers. Yet most teams still rank by CVSS severity, which measures how bad an attack could be, not whether anyone will bother. We wanted to build the ranking a security team actually needs: what will attackers use — so you know what to fix next.

What it does

FixNext ranks all 72,670 CVEs published January–September 2026 by how likely attackers are to actually use them, using only what was known at the end of each CVE's publish month. For every CVE it gives a score, the reasons, the three already-exploited CVEs it most resembles (IBM Granite), and — for the top 100 — a two-line "why fix this next" written by an IBM Granite language model. It exports top500.csv for the ticketing system and runs as a dashboard at fixnext.select and fixnext.streamlit.app. The dashboard opens on a showcase stage: each exploited CVE the standard scores buried is told as a four-beat story — day 0 (what CVSS, EPSS and exploit-code-first said), what FixNext saw, the day it was exploited, the verdict — and you can put any CVE of the top 500 on the stage. A filterable back-test chart shows where every ranking put each of the 39 exploited CVEs of 2025, and Google Gemini works the data three ways, all grounded in FixNext's own numbers and none touching the ranking: "Ask FixNext" answers questions about the project and the CVE on screen; "Draft the fix ticket" turns a CVE's signals into a P1/P2/P3 ticket with owner, due date, why-now and actions (structured JSON output, downloadable for Jira); "Monday briefing" writes the week's patch briefing for whatever the filters currently show and flags itself stale when they change.

What we found

Who issued the CVE matters more than its severity. Fifteen security teams issue 39% of CVEs but 72% of the ones attackers use. VMware's CVEs are exploited at 10× the base rate, Palo Alto 9×, Chrome 7×, Microsoft 6×.
98.7% of CRITICAL-rated CVEs are never exploited — and 100 of 813 exploited CVEs weren't even rated HIGH.
Attackers ignore the most common bugs. Cross-site scripting: 25,755 CVEs, 15 exploited. CSRF: 5,769, one. WordPress: 13,542, zero. Type confusion, auth bypass, missing authentication and deserialization run 4–12× the base rate.
Speed depends on who you are. Median 28 days from publish to exploitation; Apple 2, Chrome 4, Microsoft 6 — Apache 113, GitHub-assigned 132.
60% of our top 500 have an EPSS under 1% — EPSS-first would never surface them — yet 85% have public exploit code.

How we built it

One row per CVE (2024–2026) with leakage-safe features: description text, who issued it (assigner), weakness type (CWE), CVSS v3 vector, and the exploit signals at the snapshot month (EPSS, Exploit-DB, Metasploit, Nuclei, GitHub PoC). Labels from CISA KEV to 2025-12-31, excluding anything already on KEV in its first month (the benchmark's rule). IBM Granite (granite-embedding-small-english-r2) embeds every description; for each CVE we measure its similarity to CVEs already on KEV at that time — that "resembles a known-exploited CVE" signal is our #4 feature. LightGBM, blended with the exploit-code-then-EPSS ranking. Validated in time: train on 2024, test on Jan–Jun 2025. Granite-3.3-2b-instruct writes the rationales. Streamlit dashboard (three.js showcase stage, Plotly, hand-written SVG; Google Gemini for Ask FixNext), live at fixnext.select (in-browser, stlite) and fixnext.streamlit.app.

Results (Jan–Jun 2025 hold-out, 39 later-exploited CVEs)

Ranking	in top 100	in top 500
CVSS first	4	6
EPSS first	7	11
Public exploit code first, then EPSS	10	17
FixNext	15	19

Named catches the baselines missed: ConnectWise ScreenConnect, two Kentico Xperience auth bypasses, a Windows NTLM hash leak — all with near-zero EPSS and no exploit code when published, all later exploited. We also list the 18 nobody caught.

Challenges we ran into

Only 0.35% of CVEs are ever exploited; after the benchmark's first-month rule we had 122 positives across two years. Every choice had to fight overfitting, and we treated 1–2-hit differences as noise.
Today's NVD data leaks the future — NIST analyses exploited CVEs first. We excluded nvd_status, n_references, n_affected_cpes, last_modified, cvss3_source, references.csv and affected_products.csv for 2026, and our code refuses them (src/config.py).
Granite as a direct embedding feature did not beat simple TF-IDF with so few positives; Granite as a nearest-exploited-CVE similarity did. All ablations are in outputs/backtest.md.

Accomplishments that we're proud of

Beating every standard ranking on an honest time split; a validated, explainable model that a security engineer can read; and a live product at fixnext.select built in a day.

What we learned

Severity is not risk. Who ships the bug, what kind of bug it is, and whether it looks like something attackers already used tell you far more than a CVSS score — and an honest ablation table is worth more than a bigger model.

What's next

Monthly re-scoring as new CVEs land; per-month kNN cutoffs for training; calibrated probabilities; IBM X-Force Exchange references and external exploit telemetry.

Columns used / not used

Used: description, assigner, published (split only), cwe_ids, cvss3_score + vector components, scoreboard epss/exploitdb/metasploit/nuclei/poc_github, exploit_signals_2024/2025 at publish month, known_exploited.csv ≤ 2025-12-31 (labels), weakness_types.csv. Not used for 2026: nvd_status, n_references, n_affected_cpes, last_modified, cvss3_source, references.csv, affected_products.csv, live KEV feed.

Sources

NIST NVD (fkie-cad/nvd-json-data-feeds mirror, 2026-11-06) · CISA KEV (to 2025-12-31) · FIRST EPSS · t0sche/cvss-bt exploit flags · MITRE CWE v4.14 · IBM Granite (Hugging Face) · Google Gemini (Ask FixNext, dashboard only — not a model feature). No outside data in the ranking.