How often are EPSS scores refreshed?

Vulmatch
1

In some case it seems the scores are updated daily, but I also notice gaps in the history of some CVEs. Is this expected?

e.g

for

It was created on 2025-11-19, but EPSS data only exists for 2025-11-24, 2025-11-22, 2025-11-21.

{
  "created": "2025-11-19T18:15:48.017Z",
  "created_by_ref": "identity--9779a2db-f98c-5f4b-8d08-8ee04e02dbb5",
  "extensions": {
    "extension-definition--efd26d23-d37d-5cf2-ac95-a101e46ce11d": {
      "extension_type": "toplevel-property-extension"
    }
  },
  "external_references": [
    {
      "source_name": "cve",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-13316",
      "external_id": "CVE-2025-13316"
    },
    {
      "source_name": "arango_cve_processor",
      "external_id": "cve-epss"
    }
  ],
  "id": "report--4d9787a3-0a82-5d4a-8e1d-b0bb428a51cf",
  "labels": [
    "epss"
  ],
  "modified": "2025-11-24T00:00:00.000Z",
  "name": "EPSS Scores: CVE-2025-13316",
  "object_marking_refs": [
    "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
    "marking-definition--152ecfe1-5015-522b-97e4-86b60c57036d"
  ],
  "object_refs": [
    "vulnerability--7c3c7c0f-c388-5f77-a044-70b1e3c702fa"
  ],
  "published": "2025-11-19T18:15:48.017Z",
  "spec_version": "2.1",
  "type": "report",
  "x_epss": [
    {
      "date": "2025-11-24",
      "epss": 0.00041,
      "percentile": 0.12086
    },
    {
      "date": "2025-11-22",
      "epss": 0.00041,
      "percentile": 0.12152
    },
    {
      "date": "2025-11-21",
      "epss": 0.00041,
      "percentile": 0.12144
    }
  ]
}
2

Firstly, this feature is still a little unstable, but let me explain how the logic currently works (and where it can be problematic ATM)…

When we index a CVE, we get an EPSS score for the day we index it. Note, there can be up to a 24 hour delay in publish and index into Vulmatch (at most). This is what you see here.

Secondly, we use the FIRST EPSS API to get the EPSS scores each day. Often this API can be slow to return a response, and occasionally completely down. Our code currently does it’s best to handle this, but it is not foolproof. Sometimes when we can’t get a response after a polite amount of retries, we give up, hence the data might be missing.

I’m hoping in the next few weeks to make this process more stable so we don’t get gaps like this.