CVEs with an EPSS score above 30%
Every CVE with at least a 30% EPSS chance of exploitation in the next 30 days: 7,152 as of 2026-11-04, highest first.
- CVE-2025-8110File overwrite in file update API in GogsGogs · gogs.io/gogs
- CVE-2001-0499Buffer overflow in Transparent Network Substrate (TNS) Listener in Oracle 8i 8.1.7 and earlier allows remote attackers to gain privileges…
- CVE-2018-6000An issue was discovered in AsusWRT before 3.0.0.4.384_10007.
- CVE-2006-5478Multiple stack-based buffer overflows in Novell eDirectory 8.8.x before 8.8.1 FTF1, and 8.x up to 8.7.3.8, and Novell NetMail before 3.52e…
- CVE-2014-0322Use-after-free vulnerability in Microsoft Internet Explorer 9 and 10 allows remote attackers to execute arbitrary code via vectors involving
- CVE-2019-20361There was a flaw in the WordPress plugin, Email Subscribers & Newsletters before 4.3.1, that allowed SQL statements to be passed to the…
- CVE-2023-40498LG Simple Editor cp Command Directory Traversal Remote Code Execution VulnerabilityLG Simple Editor
- CVE-2022-41142This vulnerability allows remote attackers to escalate privileges on affected installations of Centreon.Centreon
- CVE-2024-30255HTTP/2: CPU exhaustion due to CONTINUATION frame floodenvoyproxy envoy
- CVE-2009-2335WordPress and WordPress MU before 2.8.1 exhibit different behavior for a failed login attempt depending on whether the user account…
- CVE-2020-36221An integer underflow was discovered in OpenLDAP before 2.4.57 leading to slapd crashes in the Certificate Exact Assertion processing, resultopenldap
- CVE-2020-36228An integer underflow was discovered in OpenLDAP before 2.4.57 leading to a slapd crash in the Certificate List Exact Assertion processing, ropenldap
- CVE-2023-24955Microsoft SharePoint Server Remote Code Execution VulnerabilityMicrosoft SharePoint Enterprise Server · Microsoft SharePoi…
- CVE-2006-3439Buffer overflow in the Server Service in Microsoft Windows 2000 SP4, XP SP1 and SP2, and Server 2003 SP1 allows remote attackers…
- CVE-2017-1001000The register_routes function in wp-includes/rest-api/endpoints/class-wp-rest-posts-controller.php in the REST API in WordPress 4.7.x…
- CVE-2020-11023Potential XSS vulnerability in jQueryjQuery · jquery-rails +2
- CVE-2003-0772Multiple buffer overflows in WS_FTP 3 and 4 allow remote authenticated users to cause a denial of service and possibly execute arbitrary…
- CVE-2023-32164D-Link D-View TftpSendFileThread Directory Traversal Information Disclosure VulnerabilityD-Link D-View
- CVE-2013-3906GDI+ in Microsoft Windows Vista SP2 and Server 2008 SP2; Office 2003 SP3, 2007 SP3, and 2010 SP1 and SP2; Office Compatibility Pack SP3; and
- CVE-2023-41266A path traversal vulnerability found in Qlik Sense Enterprise for Windows for versions May 2023 Patch 3 and earlier, February 2023 Patch 7 a
- CVE-2024-20328ClamAV VirusEvent File Processing Command Injection VulnerabilityCisco ClamAV
- CVE-2019-7214SmarterTools SmarterMail 16.x before build 6985 allows deserialization of untrusted data.
- CVE-2021-2401Vulnerability in the Oracle BI Publisher product of Oracle Fusion Middleware (component: E-Business Suite - XDO).Oracle BI Publisher
- CVE-2023-44352Unauthenticate Reflected XSS on Adobe Coldfusion 2018 - 2021 - 2023 last versionAdobe ColdFusion
- CVE-2022-38111SolarWinds Platform Deserialization of Untrusted Data VulnerabilitySolarWinds Platform
- CVE-2023-21716Microsoft Word Remote Code Execution VulnerabilityMicrosoft 365 Apps for Enterprise · Microsoft Office +6
- CVE-2004-0493The ap_get_mime_headers_core function in Apache httpd 2.0.49 allows remote attackers to cause a denial of service (memory exhaustion), and…
- CVE-2022-24697Apache Kylin prior to 4.0.2 allows command injection when the configuration overwrites function overwrites system parametersApache Software Foundation Apache Kylin · org.apache.kyl… +2
- CVE-2023-28343OS command injection affects Altenergy Power Control Software C1.2.5 via shell metacharacters in the index.php/management/set_timezone…
- CVE-2002-0649Multiple buffer overflows in the Resolution Service for Microsoft SQL Server 2000 and Microsoft Desktop Engine 2000 (MSDE) allow remote…
Get alerts when a CVE crosses 30% EPSS
Only want the packages you use? Check a lockfile to get a feed for your stack.
https://cve.now/epss/feed
Paste into Feedly or any RSS reader, or run /feed subscribe https://cve.now/epss/feed in Slack. For email alerts, give it to an RSS-to-email service.
https://cve.now/epss/feed?format=atom
The same entries as Atom, for readers that prefer it.
https://cve.now/epss/feed?format=json
The same entries as JSON Feed 1.1, for scripts and readers that support it.
Frequently asked questions
What is an EPSS score?
The Exploit Prediction Scoring System (EPSS) estimates the probability that a CVE will be exploited in the wild in the next 30 days, from 0 to 100%. FIRST.org publishes a new score for every published CVE each day, using a model trained on observed exploitation activity.
What does the EPSS percentile mean?
The percentile ranks a CVE's score against every other CVE's. A CVE in the 95th percentile scores higher than 95% of all CVEs, even when its probability looks small, because most CVEs score well under 1%. For example, a CVE with EPSS 0.42 and percentile 0.99 has a 42% chance of exploitation within 30 days and scores higher than 99% of CVEs.
What is the difference between EPSS and CVSS?
CVSS measures how severe a vulnerability would be if exploited; EPSS measures how likely exploitation is. A CVSS 9.8 bug nobody targets can have an EPSS under 1%, while a CVSS 6.5 bug in a widely scanned product can score above 50%. Use both: CVSS for impact, EPSS for likelihood.
What is a good EPSS threshold?
There is no single cutoff. Many teams prioritize CVEs above 10% (roughly the top 4% of all CVEs) and treat anything above 30% as urgent. cve.now flags a high-severity CVE as critical once its EPSS reaches 10%.
How do EPSS and CISA KEV work together?
KEV lists vulnerabilities already exploited; EPSS predicts which will be. Patch everything on KEV first, then work down by EPSS score, starting with the highest-severity CVEs in your stack.