Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

The CVSS standard has a "temporal" component that models the changing risk associated with a vulnerability over time, such as the publication of a working exploit. But NIST's NVD doesn't provide that kind of temporal information.

Do you know of any location or service (free or paid) that provides temporal data for CVSS?

share|improve this question
up vote 2 down vote accepted

I used to contract for iDefense and then later on for iSIGHT Partners, at both places we used the full CVSSv2 scoring including temporal data and reports were updated as exploit code came out/etc. (in fact this was on of the major priorities for us). iDefense got acquired by Verisign, I can only assume they still do this kind of work (it's been like 4+ years since I was there) and iSIGHT is definitely still doing it (barring some major shift in their products/etc.). and I assume the other major vulnerability services like Secunia and so on do the same, but I've never used their products or contracted for them so I can't say. I do know that tracking all that data properly is a lot of work so most people don't =).

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.