Add dedicated EPSS score model and related pipeline

PIPELINES-AVID.rst

@@ -96,9 +96,6 @@ The following table describes how each pipeline constructs its AVID.
    * - ruby_importer_v2
      - ruby_advisory_db
      - {file_id}
-   * - epss_importer_v2
-     - epss
-     - CVE ID of the record
    * - gentoo_importer_v2
      - gentoo
      - GLSA ID of the record

vulnerabilities/importers/__init__.py

@@ -20,7 +20,6 @@
 from vulnerabilities.pipelines.v2_importers import (
     elixir_security_importer as elixir_security_importer_v2,
 )
-from vulnerabilities.pipelines.v2_importers import epss_importer_v2
 from vulnerabilities.pipelines.v2_importers import fireeye_importer_v2
 from vulnerabilities.pipelines.v2_importers import gentoo_importer as gentoo_importer_v2
 from vulnerabilities.pipelines.v2_importers import github_osv_importer as github_osv_importer_v2
@@ -77,7 +76,6 @@
         project_kb_statements_importer_v2.ProjectKBStatementsPipeline,
         project_kb_msr2019_importer_v2.ProjectKBMSR2019Pipeline,
         ruby_importer_v2.RubyImporterPipeline,
-        epss_importer_v2.EPSSImporterPipeline,
         gentoo_importer_v2.GentooImporterPipeline,
         nginx_importer_v2.NginxImporterPipeline,
         debian_importer_v2.DebianImporterPipeline,

vulnerabilities/improvers/__init__.py

@@ -17,6 +17,7 @@
 from vulnerabilities.pipelines.v2_improvers import (
     enhance_with_metasploit as enhance_with_metasploit_v2,
 )
+from vulnerabilities.pipelines.v2_improvers import epss_pipeline
 from vulnerabilities.pipelines.v2_improvers import flag_ghost_packages as flag_ghost_packages_v2
 from vulnerabilities.pipelines.v2_improvers import (
     group_advisories_for_packages as group_advisories_for_packages_v2,
@@ -43,5 +44,6 @@
         enhance_with_github_poc.GithubPocsImproverPipeline,
         mark_unfurl_version_range.MarkUnfurlVersionRangePipeline,
         group_advisories_for_packages_v2.GroupAdvisoriesForPackages,
+        epss_pipeline.EPSSPipeline,
     ]
 )

vulnerabilities/migrations/0145_epss_score_model.py

@@ -0,0 +1,28 @@
+# Generated by Django 5.2.11 on 2026-10-28 10:46
+
+import django.db.models.deletion
+from django.db import migrations, models
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ('vulnerabilities', '0144_remove_advisoryv2_advisory_latest_by_avid_idx_and_more'),
+    ]
+
+    operations = [
+        migrations.CreateModel(
+            name='EPSSScore',
+            fields=[
+                ('id', models.AutoField(auto_created=True, primary_key=True, serialize=False, verbose_name='ID')),
+                ('date', models.DateField(help_text='Date for which this EPSS score was published')),
+                ('score', models.DecimalField(decimal_places=6, help_text='EPSS probability score', max_digits=7)),
+                ('percentile', models.DecimalField(decimal_places=6, help_text='EPSS percentile ranking', max_digits=7)),
+                ('is_latest', models.BooleanField(default=False, help_text='Indicates whether this is the latest EPSS score')),
+                ('alias', models.ForeignKey(help_text='The CVE alias associated with this EPSS score', on_delete=django.db.models.deletion.CASCADE, related_name='epss_scores', to='vulnerabilities.advisoryalias')),
+            ],
+            options={
+                'unique_together': {('alias', 'date')},
+            },
+        ),
+    ]

vulnerabilities/models.py

@@ -2837,6 +2837,43 @@ def url(self):
             return f"https://github.com/nodejs/security-wg/blob/main/vuln/npm/{id}.json"
 
 
+class EPSSScore(models.Model):
+    """
+    Tracks daily EPSS (Exploit Prediction Scoring System) scores for CVE aliases.
+    """
+
+    alias = models.ForeignKey(
+        AdvisoryAlias,
+        related_name="epss_scores",
+        on_delete=models.CASCADE,
+        help_text="The CVE alias associated with this EPSS score",
+    )
+
+    date = models.DateField(
+        help_text="Date for which this EPSS score was published",
+    )
+
+    score = models.DecimalField(
+        max_digits=7,
+        decimal_places=6,
+        help_text="EPSS probability score",
+    )
+
+    percentile = models.DecimalField(
+        max_digits=7,
+        decimal_places=6,
+        help_text="EPSS percentile ranking",
+    )
+
+    is_latest = models.BooleanField(
+        default=False,
+        help_text="Indicates whether this is the latest EPSS score",
+    )
+
+    class Meta:
+        unique_together = (("alias", "date"),)
+
+
 class Patch(models.Model):
     """
     A generic patch linked to an advisory.