From cd30f4203e720eb91bdfc633fb4cbfd88a34c57c Mon Sep 17 00:00:00 2001
From: dogboat <dogboat@users.noreply.github.com>
Date: Tue, 27 Feb 2024 00:12:29 -0500
Subject: [PATCH] EPSS Data Displayed Everywhere (#9621)

* On Findings list, separate EPSS scores and percentiles into separate columns for sorting. Specify the sort function for datatables to use.

* On Test view Findings list, show EPSS scores and percentiles.

* Show EPSS score/percentile on similar Findings listing

* Show EPSS info on Finding listing on Endpoint view

* Add a template tag for formatting EPSS values; use that when displaying EPSS-related values

* Show EPSS score/percentile on product tag/type count metrics views

* Show EPPS info on vulnerabilities section of simple search

* Remove repeated "%" sign from EPSS outputs

* Add EPSS data to report builder findings list and html report

* Show EPSS data on product endpoint report

* Show EPSS data on product report request findings table

* Show EPSS data on product report

* Show EPSS data on product type report

* Remove unneeded % suffix from test findings list

* Show EPSS data on view risk acceptance findings list

* Show EPSS data in Test report

* Add EPSS data to finding report

* Show EPSS data on engagement report

* Show EPSS data on asciidoc report

* Show EPSS data on asciidoc report: endpoints

* Show EPSS data on endpoint pdf report

* Show EPSS data on custom report endpoint list

* Spacing on asciidoc report

* Show EPSS data on custom asciidoc reports

* Fix custom report endpoint list to remove unneeded nested <td>

* Show EPSS data on metrics page
---
 dojo/reports/views.py                         |  2 +-
 dojo/templates/dojo/asciidoc_report.html      | 15 +++++++++-
 .../custom_asciidoc_report_endpoints.html     |  7 +++++
 .../dojo/custom_asciidoc_report_findings.html |  6 ++++
 .../custom_html_report_endpoint_list.html     |  6 ++++
 .../dojo/custom_html_report_finding_list.html |  4 +++
 dojo/templates/dojo/endpoint_pdf_report.html  |  6 ++++
 .../templates/dojo/engagement_pdf_report.html | 14 +++++++++
 dojo/templates/dojo/finding_pdf_report.html   |  6 ++++
 dojo/templates/dojo/finding_related_list.html |  6 ++--
 dojo/templates/dojo/finding_related_row.html  |  2 ++
 .../templates/dojo/findings_list_snippet.html | 30 ++++++++++---------
 dojo/templates/dojo/metrics.html              |  6 ++++
 .../dojo/product_endpoint_pdf_report.html     | 20 ++++++++-----
 dojo/templates/dojo/product_pdf_report.html   |  6 ++++
 .../dojo/product_type_pdf_report.html         | 20 ++++++++-----
 dojo/templates/dojo/pt_counts.html            |  6 ++++
 dojo/templates/dojo/report_findings.html      |  5 ++++
 dojo/templates/dojo/request_report.html       |  7 +++++
 dojo/templates/dojo/simple_search.html        |  6 ++++
 dojo/templates/dojo/test_pdf_report.html      | 14 +++++++++
 dojo/templates/dojo/view_endpoint.html        |  7 +++++
 dojo/templates/dojo/view_finding.html         |  8 +++++
 dojo/templates/dojo/view_risk_acceptance.html |  6 ++++
 dojo/templates/dojo/view_test.html            | 20 +++++++++++++
 dojo/templatetags/display_tags.py             |  7 +++++
 26 files changed, 210 insertions(+), 32 deletions(-)

diff --git a/dojo/reports/views.py b/dojo/reports/views.py
index d4697dd2dd9..b40efb85ffc 100644
--- a/dojo/reports/views.py
+++ b/dojo/reports/views.py
@@ -288,7 +288,7 @@ def product_endpoint_report(request, pid):
                            'verified_findings': verified_findings,
                            'engagement': None,
                            'test': None,
-                           'endpoints': endpoints,
+                           'endpoints': endpoints.qs,
                            'endpoint': None,
                            'findings': None,
                            'include_finding_notes': include_finding_notes,
diff --git a/dojo/templates/dojo/asciidoc_report.html b/dojo/templates/dojo/asciidoc_report.html
index 0327ad9f731..5ec7cd584a5 100644
--- a/dojo/templates/dojo/asciidoc_report.html
+++ b/dojo/templates/dojo/asciidoc_report.html
@@ -222,12 +222,13 @@ <h3 id="test_notes">== Test Notes ==</h3>
     {% if engagement.risk_acceptance.count %}
         <h3 id="risk_acceptance">== ?Risk Accepted Findings ==</h3>
         |===<br>
-        |Name |Date |Severity<br>
+        |Name |Date |Severity |EPSS Score / Percentile<br>
         {% for risk in engagement.risk_acceptance.all %}
             {% for finding in risk.accepted_findings.all %}
                 |{{ finding.title }}<br>
                 |{{ finding.date }}<br>
                 |{{ finding.severity }}<br>
+                |{{ finding.epss_score|format_epss }} / {{ finding.epss_percentile|format_epss }}<br>
             {% endfor %}
         {% endfor %}
         |===<br>
@@ -279,6 +280,12 @@ <h4>==== Finding {{ find.id }}: {{ find.title | nice_title }} {% if find.mitigat
 {{ find.severity }} ({{ find.numerical_severity }})
 </span>
         </p>
+        <br>
+        <p><b>==== EPSS Score / Percentile: ====</b>
+            <br>
+            {{ find.epss_score|format_epss }} / {{ find.epss_percentile|format_epss }}
+        </p>
+        <br>
         <p><b>==== Description / Exploit: ====</b>
             <br>
             {{ find.description|linebreaksbr }}
@@ -432,6 +439,12 @@ <h5>==== Finding {{ find.id }}: {{ find.title | nice_title }} {% if find.mitigat
 {{ find.severity }} ({{ find.numerical_severity }})
 </span>
                 </p>
+                <br>
+                <p><b>==== EPSS Score / Percentile: ====</b>
+                    <br>
+                    {{ find.epss_score|format_epss }} / {{ find.epss_percentile|format_epss }}
+                </p>
+                <br>
                 <p><b>==== Description / Exploit: ====</b>
                     <br>
                     {{ find.description|linebreaksbr }}
diff --git a/dojo/templates/dojo/custom_asciidoc_report_endpoints.html b/dojo/templates/dojo/custom_asciidoc_report_endpoints.html
index 6fba89de8a4..1b4840a458c 100644
--- a/dojo/templates/dojo/custom_asciidoc_report_endpoints.html
+++ b/dojo/templates/dojo/custom_asciidoc_report_endpoints.html
@@ -31,6 +31,7 @@ <h5>==== Finding {{ find.id }}: {{ find.title | nice_title }} {% if find.mitigat
                 <br>
                 {{ find.status }}
             </p>
+            <br>
             <p><b>==== CVSSv3: ====</b>
             <br>
                 {{ find.cvssv3|linebreaksbr }}
@@ -47,6 +48,12 @@ <h5>==== Finding {{ find.id }}: {{ find.title | nice_title }} {% if find.mitigat
 {{ find.severity }} ({{ find.numerical_severity }})
 </span>
             </p>
+            <br>
+            <p><b>==== EPSS Score / Percentile: ====</b>
+                <br>
+                {{ find.epss_score|format_epss }} / {{ find.epss_percentile|format_epss }}
+            </p>
+            <br>
             <p><b>==== Description / Exploit: ====</b>
                 <br>
                 {{ find.description|linebreaksbr }}
diff --git a/dojo/templates/dojo/custom_asciidoc_report_findings.html b/dojo/templates/dojo/custom_asciidoc_report_findings.html
index 8f23f3cb005..2482545f3d2 100644
--- a/dojo/templates/dojo/custom_asciidoc_report_findings.html
+++ b/dojo/templates/dojo/custom_asciidoc_report_findings.html
@@ -48,6 +48,12 @@ <h4>==== {{ find.title | nice_title }} {% if find.mitigated %}
 {{ find.severity }} ({{ find.numerical_severity }})
 </span>
     </p>
+    <br>
+    <p><b>==== EPSS Score / Percentile: ====</b>
+        <br>
+        {{ find.epss_score|format_epss }} / {{ find.epss_percentile|format_epss }}
+    </p>
+    <br>
     <p><b>==== Description / Exploit: ====</b>
         <br>
         {{ find.description|linebreaksbr }}
diff --git a/dojo/templates/dojo/custom_html_report_endpoint_list.html b/dojo/templates/dojo/custom_html_report_endpoint_list.html
index 00832acac48..9d1614605f8 100644
--- a/dojo/templates/dojo/custom_html_report_endpoint_list.html
+++ b/dojo/templates/dojo/custom_html_report_endpoint_list.html
@@ -49,6 +49,7 @@ <h5>
                     <table id="heading" class="table-striped table table-condensed table-hover centered">
                         <tr>
                             <th>Severity</th>
+                            <th>EPSS Score / Percentile</th>
                             <th>Status</th>
                             {% if finding.risk_acceptance_set.all %}
                                 <th>Acceptance</th>
@@ -75,6 +76,11 @@ <h5>
                                 {% endif %}
                             </span>
                             </td>
+                            <td>
+                                {{ finding.epss_score|format_epss }}
+                                /
+                                {{ finding.epss_percentile|format_epss }}
+                            </td>
                             <td>{{ finding.status }}</td>
                             {% if finding.risk_acceptance_set.all %}
                                 <td>
diff --git a/dojo/templates/dojo/custom_html_report_finding_list.html b/dojo/templates/dojo/custom_html_report_finding_list.html
index a74ef42f4f9..631461c585d 100644
--- a/dojo/templates/dojo/custom_html_report_finding_list.html
+++ b/dojo/templates/dojo/custom_html_report_finding_list.html
@@ -34,6 +34,7 @@ <h5>
                  <table id="heading" class="table-striped table table-condensed table-hover centered">
                     <tr>
                         <th>Severity</th>
+                        <th>EPSS Score / Percentile</th>
                         <th>Status</th>
                         {% if finding.risk_acceptance_set.all %}
                             <th>Acceptance</th>
@@ -66,6 +67,9 @@ <h5>
                                 {% endif %}
                             </span>
                         </td>
+                        <td>
+                            {{ finding.epss_score|format_epss }} / {{ finding.epss_percentile|format_epss }}
+                        </td>
                         <td>{{ finding.status }}</td>
                         {% if finding.risk_acceptance_set.all %}
                             <td>
diff --git a/dojo/templates/dojo/endpoint_pdf_report.html b/dojo/templates/dojo/endpoint_pdf_report.html
index b53c8337422..55322e80eef 100644
--- a/dojo/templates/dojo/endpoint_pdf_report.html
+++ b/dojo/templates/dojo/endpoint_pdf_report.html
@@ -112,6 +112,7 @@ <h5>
                             <table id="notes" class="table-striped table table-condensed table-hover centered">
                                 <tr>
                                     <th>Severity</th>
+                                    <th>EPSS Score / Percentile</th>
                                     <th>Status</th>
                                     {% if finding.risk_acceptance_set.all %}
                                         <th>Acceptance</th>
@@ -137,6 +138,11 @@ <h5>
                                         {% endif %}
                                     </span>
                                     </td>
+                                    <td>
+                                        {{ finding.epss_score|format_epss }}
+                                        /
+                                        {{ finding.epss_percentile|format_epss }}
+                                    </td>
                                     <td>{{ finding.status }}</td>
                                     {% if finding.risk_acceptance_set.all %}
                                         <td>
diff --git a/dojo/templates/dojo/engagement_pdf_report.html b/dojo/templates/dojo/engagement_pdf_report.html
index 154f79130e1..108cb4fc8d9 100644
--- a/dojo/templates/dojo/engagement_pdf_report.html
+++ b/dojo/templates/dojo/engagement_pdf_report.html
@@ -194,6 +194,9 @@ <h3 id="risk_acceptance">Risk Accepted Findings</h3>
                             <th style="text-align: center;padding: 4px;vertical-align: top;border: 1px solid #DDDDDD;">
                                 Severity
                             </th>
+                            <th style="text-align: center;padding: 4px;vertical-align: top;border: 1px solid #DDDDDD;">
+                                EPSS Score / Percentile
+                            </th>
                         </tr>
                         {% for risk in engagement.risk_acceptance.all %}
                             {% for finding in risk.accepted_findings.all %}
@@ -201,6 +204,11 @@ <h3 id="risk_acceptance">Risk Accepted Findings</h3>
                                     <td style="padding: 4px;vertical-align: top;border: 1px solid #DDDDDD;">{{ finding.title }}</td>
                                     <td style="padding: 4px;vertical-align: top;border: 1px solid #DDDDDD;">{{ finding.date }}</td>
                                     <td style="padding: 4px;vertical-align: top;border: 1px solid #DDDDDD;">{{ finding.severity }}</td>
+                                    <td style="padding: 4px;vertical-align: top;border: 1px solid #DDDDDD;">
+                                        {{ finding.epss_score|format_epss }}
+                                        /
+                                        {{ finding.epss_percentile|format_epss }}
+                                    </td>
                                 </tr>
                             {% endfor %}
                         {% endfor %}
@@ -236,6 +244,7 @@ <h5>
                             <table id="notes" class="table-striped table table-condensed table-hover centered">
                                 <tr>
                                     <th>Severity</th>
+                                    <th>EPSS Score / Percentile</th>
                                     <th>Status</th>
                                     {% if finding.risk_acceptance_set.all %}
                                         <th>Acceptance</th>
@@ -262,6 +271,11 @@ <h5>
                                         {% endif %}
                                     </span>
                                     </td>
+                                    <td>
+                                        {{ finding.epss_score|format_epss }}
+                                        /
+                                        {{ finding.epss_percentile|format_epss }}
+                                    </td>
                                     <td>{{ finding.status }}</td>
                                     {% if finding.risk_acceptance_set.all %}
                                         <td>
diff --git a/dojo/templates/dojo/finding_pdf_report.html b/dojo/templates/dojo/finding_pdf_report.html
index a37b0faf71b..8a229b072ac 100644
--- a/dojo/templates/dojo/finding_pdf_report.html
+++ b/dojo/templates/dojo/finding_pdf_report.html
@@ -88,6 +88,7 @@ <h5>
                             <table id="notes" class="table-striped table table-condensed table-hover centered">
                                 <tr>
                                     <th>Severity</th>
+                                    <th>EPSS Score / Percentile</th>
                                     <th>Status</th>
                                     {% if finding.risk_acceptance_set.all %}
                                         <th>Acceptance</th>
@@ -113,6 +114,11 @@ <h5>
                                         {% endif %}
                                     </span>
                                     </td>
+                                    <td>
+                                        {{ finding.epss_score|format_epss }}
+                                        /
+                                        {{ finding.epss_percentile|format_epss }}
+                                    </td>
                                     <td>{{ finding.status }}</td>
                                     {% if finding.risk_acceptance_set.all %}
                                         <td>
diff --git a/dojo/templates/dojo/finding_related_list.html b/dojo/templates/dojo/finding_related_list.html
index 8cac161abeb..5354346a5fb 100644
--- a/dojo/templates/dojo/finding_related_list.html
+++ b/dojo/templates/dojo/finding_related_list.html
@@ -4,7 +4,7 @@
     {% include "dojo/paging_snippet.html" with page=finding_list prefix=prefix page_size=True %}
 </div>
 <table id="{{prefix}}_findings_table" class="table table-striped table-hover centered no-bottom-margin">
-    <tr>
+    <thead>
         <th>Relationship</th>
         <th>Severity</th>
         <th>Title</th>
@@ -15,12 +15,14 @@
         <th>Product</th>
         <th>CWE</th>
         <th>Vulnerability Id</th>
+        <th>EPSS Score</th>
+        <th>EPSS Percentile</th>
         <th>File</th>
         {% if system_settings.enable_jira %}
             <th>JIRA</th>
         {% endif %}
         <th>Action</th>
-    </tr>
+    </thead>
 
     {% if finding_first_related %}
         {% include "dojo/finding_related_row.html" with similar_finding=finding_first_related finding_context=finding %}
diff --git a/dojo/templates/dojo/finding_related_row.html b/dojo/templates/dojo/finding_related_row.html
index f3659364ac7..204e2875375 100644
--- a/dojo/templates/dojo/finding_related_row.html
+++ b/dojo/templates/dojo/finding_related_row.html
@@ -49,6 +49,8 @@
         {% endif %}
     </td>
     <td>{{ similar_finding.cve }}</td>
+    <td>{{ similar_finding.epss_score|format_epss }}</td>
+    <td>{{ similar_finding.epss_percentile|format_epss }}</td>
     {% if similar_finding.file_path %}
         <td title="{{similar_finding.file_path}}{% if similar_finding.line > 0 %} (Line {{ similar_finding.line }}){% endif %}">
             {{ similar_finding.file_path|truncatechars_html:20 }}{% if similar_finding.line > 0 %} (Line {{ similar_finding.line }}){% endif %}
diff --git a/dojo/templates/dojo/findings_list_snippet.html b/dojo/templates/dojo/findings_list_snippet.html
index 514c6e1a96c..85a5d45862d 100644
--- a/dojo/templates/dojo/findings_list_snippet.html
+++ b/dojo/templates/dojo/findings_list_snippet.html
@@ -2,7 +2,6 @@
 {% load display_tags %}
 {% load authorization_tags %}
 {% load get_endpoint_status %}
-{% load multiply %}
 {% load static %}
 {% load i18n %}
 {% block findings_list %}
@@ -324,7 +323,10 @@ <h3 class="has-filters">
                                         {% trans "Vulnerability Id" %}
                                     </th>
                                     <th>
-                                        {% trans "EPSS Score" %} / {% trans "Percentile" %}
+                                        {% trans "EPSS Score" %}
+                                    </th>
+                                    <th>
+                                        {% trans "EPSS Percentile" %}
                                     </th>
                                     <th class="nowrap">
                                         {% if filter_name == 'Closed' %}
@@ -598,17 +600,10 @@ <h3 class="has-filters">
                                             {% endwith %}
                                         </td>
                                         <td class="nowrap">
-                                            {% if finding.epss_score is not None %}
-                                                {{ finding.epss_score|multiply:100|floatformat:"2" }}%
-                                            {% else %}
-                                                N.A.
-                                            {% endif %}
-                                            /
-                                            {% if finding.epss_percentile is not None %}
-                                                {{ finding.epss_percentile|multiply:100|floatformat:"2" }}%
-                                            {% else %}
-                                                N.A.
-                                            {% endif %}
+                                            {{ finding.epss_score|format_epss }}
+                                        </td>
+                                        <td class="nowrap">
+                                            {{ finding.epss_percentile|format_epss }}
                                         </td>
                                         <td class="nowrap">
                                             {% if filter_name == 'Closed' %}
@@ -727,6 +722,12 @@ <h3 class="has-filters">
     <script type="application/javascript" src="{% static "chosen-js/chosen.jquery.min.js" %}"></script>
     <script type="application/javascript">
         {% block datatables_columns %}
+            var percentSort = function(data, type, row, meta) {
+                if(type === 'sort') {
+                    return (data && data.endsWith("%")) ? parseFloat(data.slice(0, -1)) : -1.00;
+                }
+                return data;
+            }
             var datatables_columns = [
                 {% if not product_tab or product_tab and product_tab.product|has_object_permission:"Finding_Edit" %}
                     { "data": "checkbox" },
@@ -738,7 +739,8 @@ <h3 class="has-filters">
                     }},
                     { "data": "cwe" },
                     { "data": "cve" },
-                    { "data": "epss"},
+                    { "data": "epss_score", "type": "num", "render": percentSort },
+                    { "data": "epss_percentile", "type": "num", "render": percentSort },
                     { "data": "found_date" },
                     { "data": "finding_age" },
                 {% if system_settings.enable_finding_sla %}
diff --git a/dojo/templates/dojo/metrics.html b/dojo/templates/dojo/metrics.html
index 1b3588329f9..fd32fb06876 100644
--- a/dojo/templates/dojo/metrics.html
+++ b/dojo/templates/dojo/metrics.html
@@ -335,6 +335,7 @@ <h3>{% trans "Metric Counts" %}</h3>
                                                 <th class="nowrap">{% trans "Team" %}</th>
                                                 <th class="">{% trans "Product" %}</th>
                                                 <th>{% trans "Severity" %}</th>
+                                                <th>{% trans "EPSS Score / Percentile" %}</th>
                                                 <th>{% trans "Description" %}</th>
                                                 <th class="nowrap">{% trans "Days<br/>Open" %}</th>
                                                 <th class="nowrap">{% trans "Status" %}</th>
@@ -350,6 +351,11 @@ <h3>{% trans "Metric Counts" %}</h3>
                                         </span>
                                                     </td>
                                                     <td>{{ finding.severity_display }}</td>
+                                                    <td>
+                                                        {{ finding.epss_score|format_epss }}
+                                                        /
+                                                        {{ finding.epss_percentile|format_epss }}
+                                                    </td>
                                                     <td><a href="{% url 'view_finding' finding.id %}"
                                                            title="{{ finding.title }}">{{ finding.title|truncatechars_html:20 }}</a>
                                                     </td>
diff --git a/dojo/templates/dojo/product_endpoint_pdf_report.html b/dojo/templates/dojo/product_endpoint_pdf_report.html
index df11ea38706..372b2873ee6 100644
--- a/dojo/templates/dojo/product_endpoint_pdf_report.html
+++ b/dojo/templates/dojo/product_endpoint_pdf_report.html
@@ -160,6 +160,7 @@ <h5>
                                 <table id="notes" class="table-striped table table-condensed table-hover centered">
                                     <tr>
                                         <th>Severity</th>
+                                        <th>EPSS Score / Percentile</th>
                                         <th>Status</th>
                                         {% if finding.risk_acceptance_set.all %}
                                             <th>Acceptance</th>
@@ -177,13 +178,18 @@ <h5>
                                     </tr>
                                     <tr>
                                         <td>
-                                    <span class="label severity severity-{{ finding.severity }}">
-                                        {% if finding.severity %}
-                                            {{ finding.severity }}
-                                        {% else %}
-                                            Unknown
-                                        {% endif %}
-                                    </span>
+                                            <span class="label severity severity-{{ finding.severity }}">
+                                                {% if finding.severity %}
+                                                    {{ finding.severity }}
+                                                {% else %}
+                                                    Unknown
+                                                {% endif %}
+                                            </span>
+                                        </td>
+                                        <td>
+                                            {{ finding.epss_score|format_epss }}
+                                            /
+                                            {{ finding.epss_percentile|format_epss }}
                                         </td>
                                         <td>{{ finding.status }}</td>
                                         {% if finding.risk_acceptance_set.all %}
diff --git a/dojo/templates/dojo/product_pdf_report.html b/dojo/templates/dojo/product_pdf_report.html
index aa413c72d1d..cf142acd7c3 100644
--- a/dojo/templates/dojo/product_pdf_report.html
+++ b/dojo/templates/dojo/product_pdf_report.html
@@ -216,6 +216,7 @@ <h5>
                             <table id="notes" class="table-striped table table-condensed table-hover centered">
                                 <tr>
                                     <th>Severity</th>
+                                    <th>EPSS Score / Percentile</th>
                                     <th>Status</th>
                                     {% if finding.risk_acceptance_set.all %}
                                         <th>Acceptance</th>
@@ -242,6 +243,11 @@ <h5>
                                         {% endif %}
                                     </span>
                                     </td>
+                                    <td>
+                                        {{ finding.epss_score|format_epss }}
+                                        /
+                                        {{ finding.epss_percentile|format_epss }}
+                                    </td>
                                     <td>{{ finding.status }}</td>
                                     {% if finding.risk_acceptance_set.all %}
                                         <td>
diff --git a/dojo/templates/dojo/product_type_pdf_report.html b/dojo/templates/dojo/product_type_pdf_report.html
index f8c4175e5de..a2ff7b4ae04 100644
--- a/dojo/templates/dojo/product_type_pdf_report.html
+++ b/dojo/templates/dojo/product_type_pdf_report.html
@@ -146,6 +146,7 @@ <h5>
                                 <table id="notes" class="table-striped table table-condensed table-hover centered">
                                     <tr>
                                         <th>Severity</th>
+                                        <th>EPSS Score / Percentile</th>
                                         <th>Status</th>
                                         {% if finding.risk_acceptance_set.all %}
                                             <th>Acceptance</th>
@@ -163,13 +164,18 @@ <h5>
                                     </tr>
                                     <tr>
                                         <td>
-                                        <span class="label severity severity-{{ finding.severity }}">
-                                            {% if finding.severity %}
-                                                {{ finding.severity }}
-                                            {% else %}
-                                                Unknown
-                                            {% endif %}
-                                        </span>
+                                            <span class="label severity severity-{{ finding.severity }}">
+                                                {% if finding.severity %}
+                                                    {{ finding.severity }}
+                                                {% else %}
+                                                    Unknown
+                                                {% endif %}
+                                            </span>
+                                        </td>
+                                        <td>
+                                            {{ finding.epss_score|format_epss }}
+                                            /
+                                            {{ finding.epss_percentile|format_epss }}
                                         </td>
                                         <td>{{ finding.status }}</td>
                                         {% if finding.risk_acceptance_set.all %}
diff --git a/dojo/templates/dojo/pt_counts.html b/dojo/templates/dojo/pt_counts.html
index 5cfc6a96934..9b50cb08b87 100644
--- a/dojo/templates/dojo/pt_counts.html
+++ b/dojo/templates/dojo/pt_counts.html
@@ -244,6 +244,7 @@ <h4>{% blocktrans %}{{ pt }} Open Findings{% endblocktrans %}</h4>
                     <th>{% trans "Name" %}</th>
                     <th>{% trans "Date" %}</th>
                     <th>{% trans "Severity" %}</th>
+                    <th>{% trans "EPSS Score / Percentile" %}</th>
                     <th>{% trans "Age" %}</th>
                     <th>{% trans "Product" %}</th>
                 </tr>
@@ -259,6 +260,11 @@ <h4>{% blocktrans %}{{ pt }} Open Findings{% endblocktrans %}</h4>
                         <td>{% if finding.severity == "Critical" or finding.severity == "High" %}
                             <p class="text-danger">
                         {% else %}<p>{% endif %}{{ finding.severity_display }}</p></td>
+                        <td>
+                            {{ finding.epss_score|format_epss }}
+                            /
+                            {{ finding.epss_percentile|format_epss }}
+                        </td>
                         <td>{{ finding.age }}</td>
                         <td><a
                                 href="{% url 'view_product' finding.test.engagement.product.id %}"
diff --git a/dojo/templates/dojo/report_findings.html b/dojo/templates/dojo/report_findings.html
index 7bb72e5d50c..6f1e5c3b7fe 100644
--- a/dojo/templates/dojo/report_findings.html
+++ b/dojo/templates/dojo/report_findings.html
@@ -1,3 +1,4 @@
+{% load display_tags %}
 {% load navigation_tags %}
 <div data-multiple='true' class="panel panel-available-widget">
     <div class="panel-heading tight" title="Click and drag to move" data-toggle="tooltip">
@@ -36,6 +37,8 @@ <h6>Filters</h6>
                         <th class="nowrap">{% dojo_sort request 'Date' 'date' %}</th>
                         {% comment %} The display field is translated in the function. No need to translate here as well{% endcomment %}
                         <th class="nowrap">{% dojo_sort request 'Severity' 'numerical_severity' 'asc' %}</th>
+                        <th class="nowrap">{% dojo_sort request 'EPSS Score' 'epss_score' %}</th>
+                        <th class="nowrap">{% dojo_sort request 'EPSS Percentile' 'epss_percentile' %}</th>
                         <th class="nowrap">Status</th>
                         {% comment %} The display field is translated in the function. No need to translate here as well{% endcomment %}
                         <th class="nowrap">{% dojo_sort request 'Product' 'test__engagement__product__name' %}</th>
@@ -50,6 +53,8 @@ <h6>Filters</h6>
                             </td>
                             <td class="nowrap">{{ finding.date }}</td>
                             <td>{{ finding.severity }}</td>
+                            <td>{{ finding.epss_score|format_epss }}</td>
+                            <td>{{ finding.epss_percentile|format_epss }}</td>
                             <td>{{ finding.status }}</td>
                             <td>{{ finding.test.engagement.product }}</td>
                         </tr>
diff --git a/dojo/templates/dojo/request_report.html b/dojo/templates/dojo/request_report.html
index a1724697d35..8aa7d6dc9fd 100644
--- a/dojo/templates/dojo/request_report.html
+++ b/dojo/templates/dojo/request_report.html
@@ -1,5 +1,6 @@
 {% extends "base.html" %}
 {% load humanize %}
+{% load display_tags %}
 {% block content %}
     {{ block.super }}
     <div class="row">
@@ -70,6 +71,7 @@ <h3 class="has-filters">
                             <th>Status</th>
                             <th>Mitigated</th>
                             <th>Severity</th>
+                            <th>EPSS Score / Percentile</th>
                             <th>Product</th>
                         </tr>
                         </thead>
@@ -86,6 +88,11 @@ <h3 class="has-filters">
                                 <td>{% if finding.severity == "Critical" or finding.severity == "High" %}
                                     <p class="text-error">
                                 {% else %}<p>{% endif %}{{ finding.severity }}</p></td>
+                                <td>
+                                    {{ finding.epss_score|format_epss }}
+                                    /
+                                    {{ finding.epss_percentile|format_epss }}
+                                </td>
                                 <td>{{ finding.test.engagement.product }}</td>
                             </tr>
                         {% endfor %}
diff --git a/dojo/templates/dojo/simple_search.html b/dojo/templates/dojo/simple_search.html
index b7401c04f5c..2ec93c55371 100644
--- a/dojo/templates/dojo/simple_search.html
+++ b/dojo/templates/dojo/simple_search.html
@@ -112,6 +112,7 @@ <h2> {{ name }} <i class="fa-solid fa-circle-question has-popover" data-trigger=
                         <thead>
                         <tr>
                             <th>{% trans "Vulnerability Id" %}</th>
+                            <th>{% trans "EPSS Score / Percentile" %}</th>
                             <th>{% trans "Product" %}</th>
                             <th>{% trans "Engagement" %}</th>
                             <th>{% trans "Test" %}</th>
@@ -126,6 +127,11 @@ <h2> {{ name }} <i class="fa-solid fa-circle-question has-popover" data-trigger=
                                     <a class="search-finding" href="{% url 'view_finding' vulnerability_id.finding.id %}">
                                         {{ vulnerability_id.vulnerability_id }}</a>
                                 </td>
+                                <td>
+                                    {{ vulnerability_id.finding.epss_score|format_epss }}
+                                    /
+                                    {{ vulnerability_id.finding.epss_percentile|format_epss }}
+                                </td>
                                 <td>
                                     <a href="{% url 'view_product' vulnerability_id.finding.test.engagement.product.id %}">
                                         {{ vulnerability_id.finding.test.engagement.product.name }}</a>
diff --git a/dojo/templates/dojo/test_pdf_report.html b/dojo/templates/dojo/test_pdf_report.html
index 756d85192fb..7885ba119ef 100644
--- a/dojo/templates/dojo/test_pdf_report.html
+++ b/dojo/templates/dojo/test_pdf_report.html
@@ -208,6 +208,9 @@ <h3 id="risk_acceptance">Risk Accepted Findings</h3>
                             <th style="text-align: center;padding: 4px;vertical-align: top;border: 1px solid #DDDDDD;">
                                 Severity
                             </th>
+                            <th style="text-align: center;padding: 4px;vertical-align: top;border: 1px solid #DDDDDD;">
+                                EPSS Score / Percentile
+                            </th>
                         </tr>
                         {% for risk in test.engagement.risk_acceptance.all %}
                             {% for finding in risk.accepted_findings.all %}
@@ -215,6 +218,11 @@ <h3 id="risk_acceptance">Risk Accepted Findings</h3>
                                     <td style="padding: 4px;vertical-align: top;border: 1px solid #DDDDDD;">{{ finding.title }}</td>
                                     <td style="padding: 4px;vertical-align: top;border: 1px solid #DDDDDD;">{{ finding.date }}</td>
                                     <td style="padding: 4px;vertical-align: top;border: 1px solid #DDDDDD;">{{ finding.severity }}</td>
+                                    <td style="padding: 4px;vertical-align: top;border: 1px solid #DDDDDD;">
+                                        {{ finding.epss_score|format_epss }}
+                                        /
+                                        {{ finding.epss_percentile|format_epss }}
+                                    </td>
                                 </tr>
                             {% endfor %}
                         {% endfor %}
@@ -250,6 +258,7 @@ <h5>
                             <table id="notes" class="table-striped table table-condensed table-hover centered">
                                 <tr>
                                     <th>Severity</th>
+                                    <th>EPSS Score / Percentile</th>
                                     <th>Status</th>
                                     {% if finding.risk_acceptance_set.all %}
                                         <th>Acceptance</th>
@@ -276,6 +285,11 @@ <h5>
                                         {% endif %}
                                     </span>
                                     </td>
+                                    <td>
+                                        {{ finding.epss_score|format_epss }}
+                                        /
+                                        {{ finding.epss_percentile|format_epss }}
+                                    </td>
                                     <td>{{ finding.status }}</td>
                                     {% if finding.risk_acceptance_set.all %}
                                     <td>
diff --git a/dojo/templates/dojo/view_endpoint.html b/dojo/templates/dojo/view_endpoint.html
index 915fd098749..30d974b8a67 100644
--- a/dojo/templates/dojo/view_endpoint.html
+++ b/dojo/templates/dojo/view_endpoint.html
@@ -3,6 +3,7 @@
 {% load humanize %}
 {% load display_tags %}
 {% load authorization_tags %}
+{% load multiply %}
 {% load static %}
 {% block add_styles %}
     {{ block.super }}
@@ -259,6 +260,7 @@ <h4>Active Verified Findings</h4>
                 <tr>
                     <th>Title</th>
                     <th class="text-center">Severity</th>
+                    <th class="text-center">EPSS Score / Percentile</th>
                     <th class="text-center">Date</th>
                     <th class="text-center">Age</th>
                     <th>Found by</th>
@@ -275,6 +277,11 @@ <h4>Active Verified Findings</h4>
                             {{ finding.severity }}
                             </span>
                         </td>
+                        <td class="text-center">
+                            {{ finding.epss_score|format_epss }}
+                            /
+                            {{ finding.epss_percentile|format_epss }}
+                        </td>
                         <td class="text-center">
                             {{ finding.date }}
                         </td>
diff --git a/dojo/templates/dojo/view_finding.html b/dojo/templates/dojo/view_finding.html
index 9517bc0eab3..167d1727633 100755
--- a/dojo/templates/dojo/view_finding.html
+++ b/dojo/templates/dojo/view_finding.html
@@ -1481,6 +1481,12 @@ <h4>Credential
         $(document).ready(function() {
             date =  new Date().toISOString().slice(0, 10);
             var fileDated = 'Findings_List_' + date;
+            var percentSort = function(data, type, row, meta) {
+                if(type === 'sort') {
+                    return (data && data.endsWith("%")) ? parseFloat(data.slice(0, -1)) : -1.00;
+                }
+                return data;
+            }
             var columns = [
                 { "data": "relationship" },
                 { "data": "severity" },
@@ -1494,6 +1500,8 @@ <h4>Credential
                 { "data": "product" },
                 { "data": "cwe" },
                 { "data": "cve" },
+                { "data": "epss_score", "type": "num", "render": percentSort },
+                { "data": "epss_percentile", "type": "num", "render": percentSort },
                 { "data": "file_path" },
                 {% if system_settings.enable_jira %}
                     { "data": "jira_id" },
diff --git a/dojo/templates/dojo/view_risk_acceptance.html b/dojo/templates/dojo/view_risk_acceptance.html
index dfba51cd07e..5364c077868 100644
--- a/dojo/templates/dojo/view_risk_acceptance.html
+++ b/dojo/templates/dojo/view_risk_acceptance.html
@@ -165,6 +165,7 @@ <h3>Findings Accepted</h3>
                 <thead>
                 <tr>
                     <th>Severity</th>
+                    <th>EPSS Score / Percentile</th>
                     <th>Name</th>
                     <th>Date</th>
                     <th>Active</th>
@@ -178,6 +179,11 @@ <h3>Findings Accepted</h3>
                               {{ finding.severity_display }}
                           </span>
                         </td>
+                        <td>
+                            {{ finding.epss_score|format_epss }}
+                            /
+                            {{ finding.epss_percentile|format_epss }}
+                        </td>
                         <td><a href="{% url 'view_finding' finding.id %}"
                                title="{{ finding.title }}">{{ finding.title|truncatechars_html:140 }}</a></td>
                         <td>{{ finding.date }}</td>
diff --git a/dojo/templates/dojo/view_test.html b/dojo/templates/dojo/view_test.html
index b6ec0575cdc..11e75510b42 100644
--- a/dojo/templates/dojo/view_test.html
+++ b/dojo/templates/dojo/view_test.html
@@ -921,6 +921,12 @@ <h4 class="has-filters">
                                 <th>
                                     {% trans "Vulnerability Id" %}
                                 </th>
+                                <th>
+                                    {% trans "EPSS Score" %}
+                                </th>
+                                <th>
+                                    {% trans "EPSS Percentile" %}
+                                </th>
                                 <th>
                                     {% trans "Date" %}
                                 </th>
@@ -1186,6 +1192,12 @@ <h4 class="has-filters">
                                             {% endif %}
                                         {% endwith %}
                                     </td>
+                                    <td class="nowrap">
+                                        {{ finding.epss_score|format_epss }}
+                                    </td>
+                                    <td class="nowrap">
+                                        {{ finding.epss_percentile|format_epss }}
+                                    </td>
                                     <td class="nowrap">
                                         {{ finding.date }}
                                     </td>
@@ -1566,6 +1578,12 @@ <h4>
     <script type="text/javascript" src="{% static "jquery-highlight/jquery.highlight.js" %}"></script>
     <script type="application/javascript">
         {% block datatables_columns %}
+            var percentSort = function(data, type, row, meta) {
+                if(type === 'sort') {
+                    return (data && data.endsWith("%")) ? parseFloat(data.slice(0, -1)) : -1.00;
+                }
+                return data;
+            }
             var datatables_columns = [
                 {% if test|has_object_permission:"Test_Edit" or test|has_object_permission:"Test_Delete" %}
                     { "data": "checkbox" },
@@ -1577,6 +1595,8 @@ <h4>
                 }},
                 { "data": "cwe" },
                 { "data": "cve" },
+                { "data": "epss_score", "type": "num", "render": percentSort },
+                { "data": "epss_percentile", "type": "num", "render": percentSort },
                 { "data": "date" },
                 { "data": "age" },
                 {% if system_settings.enable_finding_sla %}
diff --git a/dojo/templatetags/display_tags.py b/dojo/templatetags/display_tags.py
index 0095428194e..6e5bcb9e85d 100644
--- a/dojo/templatetags/display_tags.py
+++ b/dojo/templatetags/display_tags.py
@@ -181,6 +181,13 @@ def percentage(fraction, value):
     return return_value
 
 
+@register.filter
+def format_epss(value):
+    if value is None:
+        return 'N.A.'
+    return f'{value:.2%}'
+
+
 def asvs_calc_level(benchmark_score):
     total = 0
     total_pass = 0