CVEs with an EPSS score above 30%
Every CVE with at least a 30% EPSS chance of exploitation in the next 30 days: 7,156 as of 2026-11-06, highest first.
- CVE-2014-7186The redirection implementation in parse.y in GNU Bash through 4.3 bash43-026 allows remote attackers to cause a denial of service…
- CVE-2011-4828Unrestricted file upload vulnerability in includes/inline_image_upload.php in AutoSec Tools V-CMS 1.0 allows remote attackers to execute…
- CVE-2014-6277GNU Bash through 4.3 bash43-026 does not properly parse function definitions in the values of environment variables, which allows remote…
- CVE-2022-44574An improper authentication vulnerability exists in Avalanche version 6.3.x and below allows unauthenticated attacker to modify properties…Ivanti Avalanche
- CVE-2021-36450Verint Workforce Optimization (WFO) 15.2.8.10048 allows XSS via the control/my_notifications NEWUINAV parameter.
- CVE-1999-0504A Windows NT local user or administrator account has a default, null, blank, or missing password.
- CVE-2023-42326An issue in Netgate pfSense v.2.7.0 allows a remote attacker to execute arbitrary code via a crafted request to the…
- CVE-2016-2296Meteocontrol WEB'log Basic 100, Light, Pro, and Pro Unlimited does not require authentication for "post-admin" login pages, which allows…
- CVE-2018-7297Remote Code Execution in the TCL script interpreter in eQ-3 AG Homematic CCU2 2.29.2 and earlier allows remote attackers to obtain…
- CVE-2025-55183An information leak vulnerability exists in specific configurations of React Server Components versions 19.0.0, 19.0.1 19.1.0, 19.1.1…Meta react-server-dom-webpack · Meta react-server-dom-tu… +4
- CVE-2011-0922The client in HP Data Protector allows remote attackers to execute arbitrary programs via an EXEC_SETUP command that references a UNC…
- CVE-2006-5216Stack-based buffer overflow in Sergey Lyubka Simple HTTPD (shttpd) 1.34 allows remote attackers to execute arbitrary code via a long URI.
- CVE-2021-29442Authentication bypassalibaba nacos · com.alibaba.nacos:nacos-common
- CVE-2007-3524Multiple PHP remote file inclusion vulnerabilities in Ripe Website Manager 0.8.9 and earlier allow remote attackers to execute arbitrary…
- CVE-2017-11861Microsoft Edge in Windows 10 1607, 1703, 1709, Windows Server 2016 and Windows Server, version 1709 allows an attacker to gain the same…ChakraCore, Microsoft Edge
- CVE-2021-40865Unsafe Pre-Authentication Deserialization In WorkersApache Software Foundation Apache Storm · org.apache.storm:…
- CVE-2020-8625A vulnerability in BIND's GSSAPI security policy negotiation can be targeted by a buffer overflow attackISC BIND9
- CVE-2020-36243The Patient Portal of OpenEMR 5.0.2.1 is affected by a Command Injection vulnerability in /interface/main/backup.php.
- CVE-2016-1593Directory traversal vulnerability in the import users feature in Micro Focus Novell Service Desk before 7.2 allows remote authenticated…
- CVE-2020-6113An exploitable vulnerability exists in the object stream parsing functionality of Nitro Software, Inc.’s Nitro Pro 13.13.2.242 when…Nitro Pro
- CVE-2020-13934An h2c direct connection to Apache Tomcat 10.0.0-M1 to 10.0.0-M6, 9.0.0.M5 to 9.0.36 and 8.5.1 to 8.5.56 did not release the HTTP/1.1 procesApache Tomcat · tomcat +2
- CVE-2018-8384A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka…Microsoft ChakraCore · Microsoft.ChakraCore
- CVE-2008-5053PHP remote file inclusion vulnerability in admin.rssreader.php in the Simple RSS Reader (com_rssreader) 1.0 component for Joomla! allows…
- CVE-2021-28325Windows SMB Information Disclosure VulnerabilityMicrosoft Windows
- CVE-2018-10357A directory traversal vulnerability in Trend Micro Endpoint Application Control 2.0 could allow a remote attacker to execute arbitrary…Trend Micro Endpoint Application Control
- CVE-2018-1000207MODX Revolution version <=2.6.4 contains a Incorrect Access Control vulnerability in Filtering user parameters before passing them into…modx/revolution
- CVE-2023-39475Inductive Automation Ignition ParameterVersionJavaSerializationCodec Deserialization of Untrusted Data Remote Code Execution VulnerabilityInductive Automation Ignition
- CVE-2020-8466A command injection vulnerability in Trend Micro InterScan Web Security Virtual Appliance 6.5 SP2, with the improved password hashing…Trend Micro InterScan Web Security Virtual Appliance
- CVE-2022-1609The School Management < 9.9.7 - Unauthenticated RCE via REST apischool-management-pro
- CVE-2021-41081Zoho ManageEngine Network Configuration Manager before 125465 is vulnerable to SQL Injection in a configuration search.
Get alerts when a CVE crosses 30% EPSS
Only want the packages you use? Check a lockfile to get a feed for your stack.
https://cve.now/epss/feed
Paste into Feedly or any RSS reader, or run /feed subscribe https://cve.now/epss/feed in Slack. For email alerts, give it to an RSS-to-email service.
https://cve.now/epss/feed?format=atom
The same entries as Atom, for readers that prefer it.
https://cve.now/epss/feed?format=json
The same entries as JSON Feed 1.1, for scripts and readers that support it.
Frequently asked questions
What is an EPSS score?
The Exploit Prediction Scoring System (EPSS) estimates the probability that a CVE will be exploited in the wild in the next 30 days, from 0 to 100%. FIRST.org publishes a new score for every published CVE each day, using a model trained on observed exploitation activity.
What does the EPSS percentile mean?
The percentile ranks a CVE's score against every other CVE's. A CVE in the 95th percentile scores higher than 95% of all CVEs, even when its probability looks small, because most CVEs score well under 1%. For example, a CVE with EPSS 0.42 and percentile 0.99 has a 42% chance of exploitation within 30 days and scores higher than 99% of CVEs.
What is the difference between EPSS and CVSS?
CVSS measures how severe a vulnerability would be if exploited; EPSS measures how likely exploitation is. A CVSS 9.8 bug nobody targets can have an EPSS under 1%, while a CVSS 6.5 bug in a widely scanned product can score above 50%. Use both: CVSS for impact, EPSS for likelihood.
What is a good EPSS threshold?
There is no single cutoff. Many teams prioritize CVEs above 10% (roughly the top 4% of all CVEs) and treat anything above 30% as urgent. cve.now flags a high-severity CVE as critical once its EPSS reaches 10%.
How do EPSS and CISA KEV work together?
KEV lists vulnerabilities already exploited; EPSS predicts which will be. Patch everything on KEV first, then work down by EPSS score, starting with the highest-severity CVEs in your stack.