A CVE triage pipeline that keeps asking, because day one tells you nothing

The Rappaport CVE triage pipeline ranks vulnerabilities by exploitation signal instead of severity, re-asking items whose signal has not yet arrived and treating its language model as the least-trusted component.