Surface hidden risk: mid-severity CVEs that carry attacker-friendly traits. This is where severity-only triage silently fails.
A CVE lands here when CVSS is Medium/Low but at least two of the following are true: network vector, no privileges required, no user interaction, high Confidentiality/Integrity/Availability, or listed in CISA KEV.
Why it matters: attackers chain "boring" 6.5s more often than they hunt for lone 9.8s. Silent Risk shows what a severity filter throws away.
Do next: promote the top rows into Priority Action Matrix review and check reachability with the latest scan.