CVETodo prioritises software vulnerabilities using exploitability, exposure and threat intelligence for security teams.
- Based in
- Tauranga, New Zealand
- Ownership
- Private
About CVETodo
CVETodo is a vulnerability intelligence service that helps security and IT teams decide which published flaws need attention first. It gathers CVE records from official sources, adds exploitability and threat signals, and matches them against the software, appliances and codebases a customer actually runs. The result is a ranked list of findings with a remediation priority score and plain guidance on whether to patch, mitigate or track. The company sells subscriptions to security teams, IT operations, developers and managed service providers. Paid plans cover scanning an estate, alerting, triage and reporting, while the CVE database stays free to read without an account. CVETodo is based in Tauranga, New Zealand, and is funded by subscribers rather than advertising or data resale. What sets it apart is its stated method. Version matching, priority scoring and published figures are computed in code from source data, and language models are used only to read and explain, not to decide exposure. Analyses are checked against cited sources before publication, and anything unverified is discarded.
Products
- CVETodoA vulnerability intelligence platform that scores and ranks CVEs against a customer's inventory.
- Remediation Priority ScoreA composite 0 to 100 score combining severity, exploit probability, exploit availability and known exploitation status.
- SSVC Decision CalculatorAn interactive tool based on CISA's methodology for categorising vulnerabilities by exploitation, exposure and impact.
- Analyst Deep DiveSource-grounded technical analysis of high-signal CVEs, reviewed under a named analyst byline.
- AI Technical AnalysisA structured six-section work-up covering overview, impact, technical details, affected versions, mitigations and context.
- Exploitation Maturity LadderA visual indicator of how far a CVE has progressed from theoretical to actively exploited.