Researching CVEs in Vulners, then building your own ranking logic to decide what comes first?
Free plan: 500 CVEs a month, no sales call.
Vulners is a vulnerability intelligence platform with a searchable graph of 230+ sources, Lucene queries and audit endpoints. DevSecure Intelligence answers the next question: given these CVEs, in what order should they be reviewed, and why?
Vulners details from Vulners's public material, last reviewed 20/10/2026 (sources below).
DevSecure capabilities shown in this comparison reflect the DevSecure Intelligence launch specification. Commercial availability may vary by plan and rollout status.
| Dimension | DevSecure Intelligence | Vulners | Why it matters |
|---|---|---|---|
| Core purpose | Prioritisation: send CVE IDs, get a ranked, banded answer | Vulnerability intelligence and search across a linked graph of advisories, exploits and CVEs | Search tells you what exists; prioritisation tells you what to look at first. |
| Scoring | RPS: a published formula over CVSS, EPSS percentile and KEV, with documented band rules | AI Score: a machine-learning prediction of CVSS-style severity (0–10), shown with CVSS, EPSS and KEV | A predicted severity and an exploitation-weighted priority answer different questions. |
| Output | A ranked list with band, score, inputs and what would change the priority | Search results and records (JSON bulletins) via REST API, Python SDK and MCP | Ranked output drops into automation; records need a triage layer on top. |
| Query flexibility | Focused: CVE lookups, batch prioritisation, Movers | Full Lucene queries over the whole corpus, CPE search, software and package audit | For open-ended research, Vulners is more flexible. |
| Sources | A curated set with the source and licence of each field in the response | 230+ sources (Vulners' figure) | Breadth helps research; per-field provenance helps audits. |
| Pricing | Published plans, including a free tier | Published plans: Free ($0, 100 API credits a month), Basic $600 a month, Pro $1,300 a month | Predictable costs and no procurement cycle for a first evaluation. |
| AI agents | MCP server exposing prioritisation with explanations | Open-source MCP server for search and audit, from Vulners' GitHub organisation | Agents can ask either 'what is known?' or 'what first, and why?'. |
Use them together: research in Vulners, then send the CVE list to POST /api/v1/prioritize. The response ranks the list, names the rule behind each band (RPS threshold, KEV floor or EPSS gate) and shows what would change it.
curl -X POST https://api.intelligence.devsecure.io/api/v1/prioritize \
-H "Authorization: Bearer $DEVSECURE_API_KEY" \
-H "Content-Type: application/json" \
-d '{"cve_ids": ["CVE-2021-44228", "CVE-2024-3400"]}'{
"ranked": [
{
"rank_in_request": 1,
"cve_id": "CVE-2021-44228",
"rps_score": 105.0,
"priority_band": "critical_priority",
"recommended_next_step": "review_against_internal_sla"
},
...
]
}RPS = [(0.4 × CVSS/10) + (0.3 × EPSS percentile)] × KEV amplifier × 100
The KEV amplifier is 1.5 for CVEs in CISA KEV, otherwise 1.0. A KEV-listed CVE is never below High, and neither is one with an EPSS percentile of 0.99 or more and CVSS 9 or more. Full detail: methodology. API: prioritise scanner output.
Vulners is excellent for research: its Lucene search, broad source graph and audit endpoints suit analysts and builders exploring vulnerability data. DevSecure Intelligence is for the step after research, when a list of CVEs needs a defensible order.
Yes. Research in Vulners, then send the resulting CVE IDs to DevSecure for a ranked, explained order.
Vulners describes its AI Score as a machine-learning prediction of CVSS-style severity. RPS is a published formula that weights CVSS, the EPSS percentile (likelihood of exploitation) and CISA KEV, with documented band rules, so anyone can recompute it.
RPS = [(0.4 × CVSS/10) + (0.3 × EPSS percentile)] × KEV amplifier × 100, with the KEV floor and EPSS gate described on the methodology page.
Yes. The Free plan includes 500 CVEs a month with one API key.
Send the CVEs you already have and get a ranked answer with the evidence for every rank. Your organisation applies its own SLA.
Vulners is a trademark of its owner, used here only to identify the product compared; no affiliation or endorsement is implied. Figures attributed to Vulners are Vulners's own claims. Something out of date? Report an inaccuracy or email legal@devsecure.io. Changes since publication: changelog.