CVEs with an EPSS score above 30%
Every CVE with at least a 30% EPSS chance of exploitation in the next 30 days: 7,160 as of 2026-11-07, highest first.
- CVE-2023-27823An authentication bypass in Optoma 1080PSTX C02 allows an attacker to access the administration console without valid credentials.
- CVE-2021-22941Improper Access Control in Citrix ShareFile storage zones controller before 5.11.20 may allow an unauthenticated attacker to remotely comproCitrix ShareFile storage zones controller
- CVE-2021-27068Visual Studio Remote Code Execution VulnerabilityMicrosoft Visual Studio
- CVE-2002-1143Microsoft Word and Excel allow remote attackers to steal sensitive information via certain field codes that insert the information when…
- CVE-2023-44450NETGEAR ProSAFE Network Management System getNodesByTopologyMapSearch SQL Injection Remote Code Execution VulnerabilityNETGEAR ProSAFE Network Management System
- CVE-2019-19844Django before 1.11.27, 2.x before 2.2.9, and 3.x before 3.0.1 allows account takeover.django
- CVE-2023-45249Remote command execution due to use of default passwords.Acronis Cyber Infrastructure
- CVE-2022-23940SuiteCRM through 7.12.1 and 8.x through 8.0.1 allows Remote Code Execution.
- CVE-2023-32029Microsoft Excel Remote Code Execution VulnerabilityMicrosoft Office · Microsoft 365 Apps for Enterprise +1
- CVE-2002-1254Internet Explorer 5.5 and 6.0 allows remote attackers to bypass the cross-domain security model and access information on the local system…
- CVE-2024-9441Linear eMerge e3-Series Forgot Password Command InjectionLinear eMerge e3-Series
- CVE-2023-29689PyroCMS 3.9 contains a remote code execution (RCE) vulnerability that can be exploited through a server-side template injection (SSTI) flaw.pyrocms/pyrocms
- CVE-2021-23017A security issue in nginx resolver was identified, which might allow an attacker who is able to forge UDP packets from the DNS server to…Nginx Web Server, Nginx Plus
- CVE-2022-0513WP Statistics <= 13.1.4 Unauthenticated Blind SQL Injection via exclusion_reasonVeronaLabs WP Statistics
- CVE-2022-44793handle_ipv6IpForwarding in agent/mibgroup/ip-mib/ip_scalars.c in Net-SNMP 5.4.3 through 5.9.3 has a NULL Pointer Exception bug that can be…
- CVE-2023-46695An issue was discovered in Django 3.2 before 3.2.23, 4.1 before 4.1.13, and 4.2 before 4.2.7.django
- CVE-2011-0104Microsoft Excel 2002 SP3 and 2003 SP3, Office 2004 and 2008 for Mac, and Open XML File Format Converter for Mac allow remote attackers to…
- CVE-2006-5702Tikiwiki 1.9.5 allows remote attackers to obtain sensitive information (MySQL username and password) via an empty sort_mode parameter in…
- CVE-2024-23116Centreon updateLCARelation SQL Injection Remote Code Execution VulnerabilityCentreon · centreon/centreon
- CVE-2024-23117Centreon updateContactServiceCommands SQL Injection Remote Code Execution VulnerabilityCentreon · centreon/centreon
- CVE-2024-23118Centreon updateContactHostCommands SQL Injection Remote Code Execution VulnerabilityCentreon · centreon/centreon
- CVE-2018-8021Versions of Superset prior to 0.23 used an unsafe load method from the pickle library to deserialize data leading to possible remote code…Superset
- CVE-2023-41064A buffer overflow issue was addressed with improved memory handling.Apple macOS · Apple iOS and iPadOS
- CVE-2016-2211The AntiVirus Decomposer engine in Symantec Advanced Threat Protection (ATP); Symantec Data Center Security:Server (SDCS:S) 6.x through…
- CVE-2021-28640Adobe Acrobat Reader Use-After-Free Arbitrary Code Execution VulnerabilityAdobe Acrobat Reader
- CVE-2005-1978COM+ in Microsoft Windows does not properly "create and use memory structures," which allows local users or remote attackers to execute…
- CVE-2005-2847img.pl in Barracuda Spam Firewall running firmware 3.1.16 and 3.1.17 allows remote attackers to execute arbitrary commands via shell…
- CVE-2021-22175When requests to the internal network for webhooks are enabled, a server-side request forgery vulnerability in GitLab affecting all versionsGitLab
- CVE-2006-6761Stack-based buffer overflow in the IMAP daemon (IMAPD) in Novell NetMail before 3.52e FTF2 allows remote authenticated users to execute…
- CVE-2014-9118The web administrative portal in Zhone zNID GPON 2426A before S3.0.501 allows remote attackers to execute arbitrary commands via shell…
Get alerts when a CVE crosses 30% EPSS
Only want the packages you use? Check a lockfile to get a feed for your stack.
https://cve.now/epss/feed
Paste into Feedly or any RSS reader, or run /feed subscribe https://cve.now/epss/feed in Slack. For email alerts, give it to an RSS-to-email service.
https://cve.now/epss/feed?format=atom
The same entries as Atom, for readers that prefer it.
https://cve.now/epss/feed?format=json
The same entries as JSON Feed 1.1, for scripts and readers that support it.
Frequently asked questions
What is an EPSS score?
The Exploit Prediction Scoring System (EPSS) estimates the probability that a CVE will be exploited in the wild in the next 30 days, from 0 to 100%. FIRST.org publishes a new score for every published CVE each day, using a model trained on observed exploitation activity.
What does the EPSS percentile mean?
The percentile ranks a CVE's score against every other CVE's. A CVE in the 95th percentile scores higher than 95% of all CVEs, even when its probability looks small, because most CVEs score well under 1%. For example, a CVE with EPSS 0.42 and percentile 0.99 has a 42% chance of exploitation within 30 days and scores higher than 99% of CVEs.
What is the difference between EPSS and CVSS?
CVSS measures how severe a vulnerability would be if exploited; EPSS measures how likely exploitation is. A CVSS 9.8 bug nobody targets can have an EPSS under 1%, while a CVSS 6.5 bug in a widely scanned product can score above 50%. Use both: CVSS for impact, EPSS for likelihood.
What is a good EPSS threshold?
There is no single cutoff. Many teams prioritize CVEs above 10% (roughly the top 4% of all CVEs) and treat anything above 30% as urgent. cve.now flags a high-severity CVE as critical once its EPSS reaches 10%.
How do EPSS and CISA KEV work together?
KEV lists vulnerabilities already exploited; EPSS predicts which will be. Patch everything on KEV first, then work down by EPSS score, starting with the highest-severity CVEs in your stack.