CVEs with an EPSS score above 30%
Every CVE with at least a 30% EPSS chance of exploitation in the next 30 days: 7,162 as of 2026-11-09, highest first.
- CVE-2025-32814An issue was discovered in Infoblox NETMRI before 7.6.1.
- CVE-2025-9316N-central unauthenticated sessionID generationN-able N-central
- CVE-2023-38146Windows Themes Remote Code Execution VulnerabilityMicrosoft Windows
- CVE-2021-37200A vulnerability has been identified in SINEC NMS (All versions < V1.0 SP1).Siemens SINEC NMS
- CVE-2017-0039Microsoft Windows Vista SP2 and Server 2008 SP2 mishandle dynamic link library (DLL) loading, which allows local users to gain privileges…Microsoft Windows DLL
- CVE-2022-39987A Command injection vulnerability in RaspAP 2.8.0 thru 2.9.2 allows an authenticated attacker to execute arbitrary OS commands as root via…billz/raspap-webgui
- CVE-2026-30824Flowise: Missing Authentication on NVIDIA NIM EndpointsFlowiseAI Flowise · flowise
- CVE-2010-3106The ienipp.ocx ActiveX control in the browser plugin in Novell iPrint Client before 5.42 does not properly validate the debug parameter…
- CVE-2014-5007Directory traversal vulnerability in the agentLogUploader servlet in ZOHO ManageEngine Desktop Central (DC) and Desktop Central Managed…
- CVE-2021-32955Delta Electronics DIAEnergie Version 1.7.5 and prior allows unrestricted file uploads, which may allow an attacker to remotely execute code.Delta Electronics DIAEnergie
- CVE-2023-0678Missing Authorization in phpipam/phpipamphpipam/phpipam
- CVE-2002-0419Information leaks in IIS 4 through 5.1 allow remote attackers to obtain potentially sensitive information or more easily conduct brute…
- CVE-2005-1985The Client Service for NetWare (CSNW) on Microsoft Windows 2000 SP4, XP SP1 and Sp2, and Server 2003 SP1 and earlier, allows remote…
- CVE-2014-0118The deflate_in_filter function in mod_deflate.c in the mod_deflate module in the Apache HTTP Server before 2.4.10, when request body…
- CVE-2022-25359On ICL ScadaFlex II SCADA Controller SC-1 and SC-2 1.03.07 devices, unauthenticated remote attackers can overwrite, delete, or create files.
- CVE-2017-14467An exploitable access control vulnerability exists in the data, program, and function file permissions functionality of Allen Bradley…Talos Allen Bradley
- CVE-2025-24514ingress-nginx controller - configuration injection via unsanitized auth-url annotationkubernetes ingress-nginx · k8s.io/ingress-nginx
- CVE-2006-3435PowerPoint in Microsoft Office 2000, XP, 2003, 2004 for Mac, and v.X for Mac does not properly parse the slide notes field in a document…
- CVE-2007-0018Stack-based buffer overflow in the NCTAudioFile2.AudioFile ActiveX control (NCTAudioFile2.dll), as used by multiple products, allows…
- CVE-2021-20323A POST based reflected Cross Site Scripting vulnerability on has been identified in Keycloak.keycloak-services · org.keycloak:keycloak-core
- CVE-2022-24629An issue was discovered in AudioCodes Device Manager Express through 7.8.20002.47752.
- CVE-2007-0221Integer overflow in the IMAP (IMAP4) support in Microsoft Exchange Server 2000 SP3 allows remote attackers to cause a denial of service…
- CVE-2024-2083Directory Traversal in zenml-io/zenmlzenml-io/zenml · zenml
- CVE-2014-3153The futex_requeue function in kernel/futex.c in the Linux kernel through 3.14.5 does not ensure that calls have two different futex addresse
- CVE-2016-3074Integer signedness error in GD Graphics Library 2.1.1 (aka libgd or libgd2) allows remote attackers to cause a denial of service (crash)…
- CVE-2020-24338An issue was discovered in picoTCP through 1.7.0.
- CVE-2014-8686CodeIgniter before 2.2.0 makes it easier for attackers to decode session cookies by leveraging fallback to a custom XOR-based encryption…
- CVE-2013-4450The HTTP server in Node.js 0.10.x before 0.10.21 and 0.8.x before 0.8.26 allows remote attackers to cause a denial of service (memory and…
- CVE-2013-3928Stack-based buffer overflow in the ReadFile function in flt_BMP.dll in Chasys Draw IES before 4.11.02 allows remote attackers to execute…
- CVE-2000-0854When a Microsoft Office 2000 document is launched, the directory of that document is first used to locate DLL's such as riched20.dll and…
Get alerts when a CVE crosses 30% EPSS
Only want the packages you use? Check a lockfile to get a feed for your stack.
https://cve.now/epss/feed
Paste into Feedly or any RSS reader, or run /feed subscribe https://cve.now/epss/feed in Slack. For email alerts, give it to an RSS-to-email service.
https://cve.now/epss/feed?format=atom
The same entries as Atom, for readers that prefer it.
https://cve.now/epss/feed?format=json
The same entries as JSON Feed 1.1, for scripts and readers that support it.
Frequently asked questions
What is an EPSS score?
The Exploit Prediction Scoring System (EPSS) estimates the probability that a CVE will be exploited in the wild in the next 30 days, from 0 to 100%. FIRST.org publishes a new score for every published CVE each day, using a model trained on observed exploitation activity.
What does the EPSS percentile mean?
The percentile ranks a CVE's score against every other CVE's. A CVE in the 95th percentile scores higher than 95% of all CVEs, even when its probability looks small, because most CVEs score well under 1%. For example, a CVE with EPSS 0.42 and percentile 0.99 has a 42% chance of exploitation within 30 days and scores higher than 99% of CVEs.
What is the difference between EPSS and CVSS?
CVSS measures how severe a vulnerability would be if exploited; EPSS measures how likely exploitation is. A CVSS 9.8 bug nobody targets can have an EPSS under 1%, while a CVSS 6.5 bug in a widely scanned product can score above 50%. Use both: CVSS for impact, EPSS for likelihood.
What is a good EPSS threshold?
There is no single cutoff. Many teams prioritize CVEs above 10% (roughly the top 4% of all CVEs) and treat anything above 30% as urgent. cve.now flags a high-severity CVE as critical once its EPSS reaches 10%.
How do EPSS and CISA KEV work together?
KEV lists vulnerabilities already exploited; EPSS predicts which will be. Patch everything on KEV first, then work down by EPSS score, starting with the highest-severity CVEs in your stack.