CVEs with an EPSS score above 30%
Every CVE with at least a 30% EPSS chance of exploitation in the next 30 days: 7,160 as of 2026-11-07, highest first.
- CVE-2022-2234mySCADA myPRO Command InjectionmySCADA Technologies mySCADA myPRO
- CVE-2025-2775SysAid On-Prem <= 23.3.40 Checkin Proceessing XML External Entity InjectionSysAid On-Prem
- CVE-2023-21818Windows Secure Channel Denial of Service VulnerabilityMicrosoft Windows
- CVE-2015-1587Unrestricted file upload vulnerability in file_to_index.php in Maarch LetterBox 2.8 and earlier and GEC/GED 1.4 and earlier allows remote…
- CVE-2019-14928An issue was discovered on Mitsubishi Electric Europe B.V.
- CVE-2022-47071In NVS365 V01, the background network test function can trigger command execution.
- CVE-2017-0061The Color Management Module (ICM32.dll) memory handling functionality in Windows Vista SP2, Windows Server 2008 SP2 and R2, and Windows 7…Microsoft Color Management
- CVE-2013-3591vTiger CRM 5.3 and 5.4: 'files' Upload Folder Arbitrary PHP Code Execution VulnerabilityvTiger CRM
- CVE-2013-3629ISPConfig 3.0.5.2 has Arbitrary PHP Code ExecutionISPConfig
- CVE-2013-3894The kernel-mode drivers in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2…
- CVE-2020-6092An exploitable code execution vulnerability exists in the way Nitro Pro 13.9.1.155 parses Pattern objects.Nitro Pro
- CVE-2003-0659Buffer overflow in a function in User32.dll on Windows NT through Server 2003 allows local users to execute arbitrary code via long (1)…
- CVE-2023-25826Remote Code Execution in OpenTSDBOpenTSDB · net.opentsdb:opentsdb
- CVE-2008-4841The WordPad Text Converter for Word 97 files in Microsoft Windows 2000 SP4, XP SP2, and Server 2003 SP1 and SP2 allows remote attackers to…
- CVE-2020-4000The SD-WAN Orchestrator 3.3.2 prior to 3.3.2 P3, 3.4.x prior to 3.4.4, and 4.0.x prior to 4.0.1 allows for executing files through…VMware SD-WAN Orchestrator
- CVE-2024-3848Path Traversal Bypass in mlflow/mlflowmlflow/mlflow · mlflow
- CVE-2021-42292Microsoft Excel Security Feature Bypass VulnerabilityMicrosoft 365 Apps for Enterprise · Microsoft Excel 2013… +3
- CVE-2006-3445Integer overflow in the ReadWideString function in agentdpv.dll in Microsoft Agent on Microsoft Windows 2000 SP4, XP SP2, and Server 2003…
- CVE-2009-0238Microsoft Office Excel 2000 SP3, 2002 SP3, 2003 SP3, and 2007 SP1; Excel Viewer 2003 Gold and SP3; Excel Viewer; Compatibility Pack for Word
- CVE-2011-1574Stack-based buffer overflow in the ReadS3M method in load_s3m.cpp in libmodplug before 0.8.8.2 allows remote attackers to execute…
- CVE-2025-68664LangChain serialization injection vulnerability enables secret extraction in dumps/loads APIslangchain-ai langchain · langchain-core
- CVE-2023-0448The WP Helper Lite WordPress plugin, in versions < 4.3, returns all GET parameters unsanitized in the response, resulting in a reflected…WP Helper Lite Wordpress Plugin
- CVE-2023-49231An authentication bypass vulnerability was found in Stilog Visual Planning 8.
- CVE-2014-1691The framework/Util/lib/Horde/Variables.php script in the Util library in Horde before 5.1.1 allows remote attackers to conduct object…
- CVE-2009-0836Foxit Reader 2.3 before Build 3902 and 3.0 before Build 1506, including 1120 and 1301, does not require user confirmation before…
- CVE-2024-30080Microsoft Message Queuing (MSMQ) Remote Code Execution VulnerabilityMicrosoft Windows
- CVE-2013-2266libdns in ISC BIND 9.7.x and 9.8.x before 9.8.4-P2, 9.8.5 before 9.8.5b2, 9.9.x before 9.9.2-P2, and 9.9.3 before 9.9.3b2 on UNIX…
- CVE-2025-29513Cross-Site Scripting (XSS) vulnerability in NodeBB v4.0.4 and before allows remote attackers to store arbitrary code in the admin API…
- CVE-2004-0897The Indexing Service for Microsoft Windows XP and Server 2003 does not properly validate the length of a message, which allows remote…
- CVE-2023-32714Path Traversal in Splunk App for Lookup File EditingSplunk App for Lookup File Editing
Get alerts when a CVE crosses 30% EPSS
Only want the packages you use? Check a lockfile to get a feed for your stack.
https://cve.now/epss/feed
Paste into Feedly or any RSS reader, or run /feed subscribe https://cve.now/epss/feed in Slack. For email alerts, give it to an RSS-to-email service.
https://cve.now/epss/feed?format=atom
The same entries as Atom, for readers that prefer it.
https://cve.now/epss/feed?format=json
The same entries as JSON Feed 1.1, for scripts and readers that support it.
Frequently asked questions
What is an EPSS score?
The Exploit Prediction Scoring System (EPSS) estimates the probability that a CVE will be exploited in the wild in the next 30 days, from 0 to 100%. FIRST.org publishes a new score for every published CVE each day, using a model trained on observed exploitation activity.
What does the EPSS percentile mean?
The percentile ranks a CVE's score against every other CVE's. A CVE in the 95th percentile scores higher than 95% of all CVEs, even when its probability looks small, because most CVEs score well under 1%. For example, a CVE with EPSS 0.42 and percentile 0.99 has a 42% chance of exploitation within 30 days and scores higher than 99% of CVEs.
What is the difference between EPSS and CVSS?
CVSS measures how severe a vulnerability would be if exploited; EPSS measures how likely exploitation is. A CVSS 9.8 bug nobody targets can have an EPSS under 1%, while a CVSS 6.5 bug in a widely scanned product can score above 50%. Use both: CVSS for impact, EPSS for likelihood.
What is a good EPSS threshold?
There is no single cutoff. Many teams prioritize CVEs above 10% (roughly the top 4% of all CVEs) and treat anything above 30% as urgent. cve.now flags a high-severity CVE as critical once its EPSS reaches 10%.
How do EPSS and CISA KEV work together?
KEV lists vulnerabilities already exploited; EPSS predicts which will be. Patch everything on KEV first, then work down by EPSS score, starting with the highest-severity CVEs in your stack.