CVEs with an EPSS score above 30%
Every CVE with at least a 30% EPSS chance of exploitation in the next 30 days: 7,160 as of 2026-11-07, highest first.
- CVE-2019-3964In OpenEMR 5.0.1 and earlier, controller.php contains a reflected XSS vulnerability in the doc_id parameter.OpenEMR
- CVE-2022-31470An XSS vulnerability in the index_mobile_changepass.hsp reset-password section of Axigen Mobile WebMail before 10.2.3.12 and 10.3.x before…
- CVE-2020-24435Acrobat Reader DC Heap-based Buffer Overflow Could Lead to Arbitrary Code ExecutionAdobe Acrobat Reader
- CVE-2022-37436Apache HTTP Server: mod_proxy prior to 2.4.55 allows a backend to trigger HTTP response splittingApache Software Foundation Apache HTTP Server
- CVE-2008-2370Apache Tomcat 4.1.0 through 4.1.37, 5.5.0 through 5.5.26, and 6.0.0 through 6.0.16, when a RequestDispatcher is used, performs path…org.apache.tomcat:tomcat
- CVE-2012-5691Buffer overflow in RealNetworks RealPlayer before 16.0.0.282 and RealPlayer SP 1.0 through 1.1.5 allows remote attackers to execute…
- CVE-2020-27615The Loginizer plugin before 1.6.4 for WordPress allows SQL injection (with resultant XSS), related to loginizer_login_failed and…
- CVE-2021-43778Path traversal in GLPI barcode pluginpluginsGLPI barcode
- CVE-2024-39931Gogs through 0.13.0 allows deletion of internal files.github.com/gogs/gogs · gogs.io/gogs
- CVE-2010-1428The Web Console (aka web-console) in JBossAs in Red Hat JBoss Enterprise Application Platform (aka JBoss EAP or JBEAP) 4.2 before 4.2.0.CP09
- CVE-2022-31126Unauthenticated Remote Code Execution in Roxy-wihap-wi roxy-wi
- CVE-2020-13943If an HTTP/2 client connecting to Apache Tomcat 10.0.0-M1 to 10.0.0-M7, 9.0.0.M1 to 9.0.37 or 8.5.0 to 8.5.57 exceeded the agreed maximum nuApache Tomcat · tomcat +1
- CVE-2008-0108Stack-based buffer overflow in wkcvqd01.dll in Microsoft Works 6 File Converter, as used in Office 2003 SP2 and SP3, Works 8.0, and Works…
- CVE-2008-2549Adobe Acrobat Reader 8.1.2 and earlier, and before 7.1.1, allows remote attackers to cause a denial of service (application crash) and…
- CVE-2003-1041Internet Explorer 5.x and 6.0 allows remote attackers to execute arbitrary programs via a modified directory traversal attack using a URL…
- CVE-2009-3958Multiple stack-based buffer overflows in the NOS Microsystems getPlus Helper ActiveX control before 1.6.2.49 in gp.ocx in the Download…
- CVE-2014-5468A File Inclusion vulnerability exists in Railo 4.2.1 and earlier via a specially-crafted URL request to the thumbnail.cfm to specify a…
- CVE-2023-44449NETGEAR ProSAFE Network Management System clearAlertByIds SQL Injection Privilege Escalation VulnerabilityNETGEAR ProSAFE Network Management System
- CVE-2019-11447An issue was discovered in CutePHP CuteNews 2.1.2.
- CVE-2018-11686The Publish Service in FlexPaper (later renamed FlowPaper) 2.3.6 allows remote code execution via setup.php and change_config.php.
- CVE-2017-8734Microsoft Edge in Microsoft Windows 10 Gold, 1511, 1607, 1703, and Windows Server 2016 allows an attacker to execute arbitrary code in the…Microsoft Edge
- CVE-2010-1157Apache Tomcat 5.5.0 through 5.5.29 and 6.0.0 through 6.0.26 might allow remote attackers to discover the server's hostname or IP address…org.apache.tomcat:tomcat
- CVE-2022-26148An issue was discovered in Grafana through 7.3.4, when integrated with Zabbix.
- CVE-2021-35592Vulnerability in the MySQL Cluster product of Oracle MySQL (component: Cluster: General).Oracle MySQL Cluster
- CVE-2012-5192Directory traversal vulnerability in gmap/view_overlay.php in Bitweaver 2.8.1 and earlier allows remote attackers to read arbitrary files…
- CVE-2024-41163A directory traversal vulnerability exists in the archive functionality of Veertu Anka Build 1.42.0.Veertu Anka Build
- CVE-2018-17281There is a stack consumption vulnerability in the res_http_websocket.so module of Asterisk through 13.23.0, 14.7.x through 14.7.7, and…
- CVE-2019-1367A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer, aka 'ScripMicrosoft Internet Explorer
- CVE-2021-20081Incomplete List of Disallowed Inputs in ManageEngine ServiceDesk Plus before version 11205 allows a remote, authenticated attacker to…ManageEngine ServiceDesk Plus
- CVE-2025-32375Insecure Deserialization leads to RCE in BentoML's runner serverBentoML
Get alerts when a CVE crosses 30% EPSS
Only want the packages you use? Check a lockfile to get a feed for your stack.
https://cve.now/epss/feed
Paste into Feedly or any RSS reader, or run /feed subscribe https://cve.now/epss/feed in Slack. For email alerts, give it to an RSS-to-email service.
https://cve.now/epss/feed?format=atom
The same entries as Atom, for readers that prefer it.
https://cve.now/epss/feed?format=json
The same entries as JSON Feed 1.1, for scripts and readers that support it.
Frequently asked questions
What is an EPSS score?
The Exploit Prediction Scoring System (EPSS) estimates the probability that a CVE will be exploited in the wild in the next 30 days, from 0 to 100%. FIRST.org publishes a new score for every published CVE each day, using a model trained on observed exploitation activity.
What does the EPSS percentile mean?
The percentile ranks a CVE's score against every other CVE's. A CVE in the 95th percentile scores higher than 95% of all CVEs, even when its probability looks small, because most CVEs score well under 1%. For example, a CVE with EPSS 0.42 and percentile 0.99 has a 42% chance of exploitation within 30 days and scores higher than 99% of CVEs.
What is the difference between EPSS and CVSS?
CVSS measures how severe a vulnerability would be if exploited; EPSS measures how likely exploitation is. A CVSS 9.8 bug nobody targets can have an EPSS under 1%, while a CVSS 6.5 bug in a widely scanned product can score above 50%. Use both: CVSS for impact, EPSS for likelihood.
What is a good EPSS threshold?
There is no single cutoff. Many teams prioritize CVEs above 10% (roughly the top 4% of all CVEs) and treat anything above 30% as urgent. cve.now flags a high-severity CVE as critical once its EPSS reaches 10%.
How do EPSS and CISA KEV work together?
KEV lists vulnerabilities already exploited; EPSS predicts which will be. Patch everything on KEV first, then work down by EPSS score, starting with the highest-severity CVEs in your stack.