CVEs with an EPSS score above 30%
Every CVE with at least a 30% EPSS chance of exploitation in the next 30 days: 7,160 as of 2026-11-07, highest first.
- CVE-2000-1200Windows NT allows remote attackers to list all users in a domain by obtaining the domain SID with the LsaQueryInformationPolicy policy funct
- CVE-2021-3712Read buffer overruns processing ASN.1 stringsOpenSSL · openssl-src
- CVE-2014-2424Unspecified vulnerability in the Oracle Event Processing component in Oracle Fusion Middleware 11.1.1.7.0 allows remote authenticated…
- CVE-2002-0642The registry key containing the SQL Server service account information in Microsoft SQL Server 2000, including Microsoft SQL Server…
- CVE-2018-11235In Git before 2.13.7, 2.14.x before 2.14.4, 2.15.x before 2.15.2, 2.16.x before 2.16.4, and 2.17.x before 2.17.1, remote code execution…
- CVE-2018-5430TIBCO JasperReports Server Information Disclosure VulnerabilityTIBCO Software TIBCO JasperReports Server · TIBCO Softwa… +1
- CVE-2006-3835Apache Tomcat 5 before 5.5.17 allows remote attackers to list directories via a semicolon (;) preceding a filename with a mapped…org.apache.tomcat:tomcat
- CVE-2021-26829OpenPLC ScadaBR through 0.9.1 on Linux and through 1.12.4 on Windows allows stored XSS via system_settings.shtm.
- CVE-2024-12849Error Log Viewer By WP Guru <= 1.0.1.3 - Missing Authorization to Unauthenticated Arbitrary File Readwpguruin Error Log Viewer By WP Guru
- CVE-2019-1040Windows NTLM Tampering VulnerabilityMicrosoft Windows
- CVE-2016-8530A remote denial of service vulnerability in HPE iMC PLAT version v7.2 E0403P06 and earlier was found.Hewlett Packard Enterprise iMC PLAT
- CVE-2023-28709Apache Tomcat: Fix for CVE-2023-24998 is incompleteApache Software Foundation Apache Tomcat · org.apache.to… +1
- CVE-2026-28318SolarWinds Serv-U Unauthenticated Denial of Service VulnerabilitySolarWinds Serv-U
- CVE-2018-16843nginx before versions 1.15.6 and 1.14.1 has a vulnerability in the implementation of HTTP/2 that can allow for excessive memory consumption.[UNKNOWN] nginx
- CVE-2025-54988Apache Tika PDF parser module: XXE vulnerability in PDFParser's handling of XFAApache Software Foundation org.apache.tika:tika-parser-p… +1
- CVE-2006-2766Buffer overflow in INETCOMM.DLL, as used in Microsoft Internet Explorer 6.0 through 6.0 SP2, Windows Explorer, Outlook Express 6, and…
- CVE-2012-2110The asn1_d2i_read_bio function in crypto/asn1/a_d2i_fp.c in OpenSSL before 0.9.8v, 1.0.0 before 1.0.0i, and 1.0.1 before 1.0.1a does not…
- CVE-2008-4032Microsoft Office SharePoint Server 2007 Gold and SP1 and Microsoft Search Server 2008 do not properly perform authentication and…
- CVE-2013-0232includes/functions.php in ZoneMinder Video Server 1.24.0, 1.25.0, and earlier allows remote attackers to execute arbitrary commands via…
- CVE-2024-45802Squid Denial of Servicesquid-cache squid
- CVE-2023-6018MLflow Arbitrary File Writemlflow/mlflow · mlflow
- CVE-2009-0932Directory traversal vulnerability in framework/Image/Image.php in Horde before 3.2.4 and 3.3.3 and Horde Groupware before 1.1.5 allows…
- CVE-2020-10914This vulnerability allows remote attackers to execute arbitrary code on affected installations of VEEAM One Agent 9.5.4.4587.VEEAM One Agent
- CVE-2022-36067vm2 vulnerable to Sandbox Escape before v3.9.11patriksimek vm2 · vm2
- CVE-2006-3654Buffer overflow in wksss.exe 8.4.702.0 in Microsoft Works Spreadsheet 8.0 allows remote attackers to cause a denial of service (CPU…
- CVE-2010-4701Heap-based buffer overflow in the CDrawPoly::Serialize function in fxscover.exe in Microsoft Windows Fax Services Cover Page Editor 5.2 r2…
- CVE-2022-0679Narnoo Distributor <= 2.5.1 - Unauthenticated LFI to Arbitrary File Read / RCENarnoo Distributor
- CVE-2023-50919An issue was discovered on GL.iNet devices before version 4.5.0.
- CVE-2012-4361lhn/public/network/ping in HP SAN/iQ before 9.5 on the HP Virtual SAN Appliance allows remote authenticated users to execute arbitrary…
- CVE-2022-31698The vCenter Server contains a denial-of-service vulnerability in the content library service.VMware vCenter Server, VMware Cloud Foundation
Get alerts when a CVE crosses 30% EPSS
Only want the packages you use? Check a lockfile to get a feed for your stack.
https://cve.now/epss/feed
Paste into Feedly or any RSS reader, or run /feed subscribe https://cve.now/epss/feed in Slack. For email alerts, give it to an RSS-to-email service.
https://cve.now/epss/feed?format=atom
The same entries as Atom, for readers that prefer it.
https://cve.now/epss/feed?format=json
The same entries as JSON Feed 1.1, for scripts and readers that support it.
Frequently asked questions
What is an EPSS score?
The Exploit Prediction Scoring System (EPSS) estimates the probability that a CVE will be exploited in the wild in the next 30 days, from 0 to 100%. FIRST.org publishes a new score for every published CVE each day, using a model trained on observed exploitation activity.
What does the EPSS percentile mean?
The percentile ranks a CVE's score against every other CVE's. A CVE in the 95th percentile scores higher than 95% of all CVEs, even when its probability looks small, because most CVEs score well under 1%. For example, a CVE with EPSS 0.42 and percentile 0.99 has a 42% chance of exploitation within 30 days and scores higher than 99% of CVEs.
What is the difference between EPSS and CVSS?
CVSS measures how severe a vulnerability would be if exploited; EPSS measures how likely exploitation is. A CVSS 9.8 bug nobody targets can have an EPSS under 1%, while a CVSS 6.5 bug in a widely scanned product can score above 50%. Use both: CVSS for impact, EPSS for likelihood.
What is a good EPSS threshold?
There is no single cutoff. Many teams prioritize CVEs above 10% (roughly the top 4% of all CVEs) and treat anything above 30% as urgent. cve.now flags a high-severity CVE as critical once its EPSS reaches 10%.
How do EPSS and CISA KEV work together?
KEV lists vulnerabilities already exploited; EPSS predicts which will be. Patch everything on KEV first, then work down by EPSS score, starting with the highest-severity CVEs in your stack.