CVEs with an EPSS score above 30%
Every CVE with at least a 30% EPSS chance of exploitation in the next 30 days: 7,152 as of 2026-11-04, highest first.
- CVE-2021-22123An OS command injection vulnerability in FortiWeb's management interface 6.3.7 and below, 6.2.3 and below, 6.1.x, 6.0.x, 5.9.x may allow a…Fortinet FortiWeb
- CVE-2020-12641rcube_image.php in Roundcube Webmail before 1.4.4 allows attackers to execute arbitrary code via shell metacharacters in a configuration set
- CVE-2013-7285Xstream API versions up to 1.4.6 and version 1.4.10, if the security framework has not been initialized, may allow a remote attacker to run com.thoughtworks.xstream:xstream
- CVE-2023-3388Beautiful Cookie Consent Banner <= 2.10.1 - Unauthenticated Stored Cross-Site Scriptingnikelschubert Beautiful Cookie Consent Banner
- CVE-2025-47916Invision Community 5.0.0 before 5.0.7 allows remote code execution via crafted template strings to themeeditor.php.invisioncommunity Invision Power Board
- CVE-2019-12257Wind River VxWorks 6.6 through 6.9 has a Buffer Overflow in the DHCP client component.
- CVE-2018-17246Kibana versions before 6.4.3 and 5.6.13 contain an arbitrary file inclusion flaw in the Console plugin.Elastic Kibana
- CVE-2020-5722The HTTP interface of the Grandstream UCM6200 series is vulnerable to an unauthenticated remote SQL injection via crafted HTTP request.Grandstream UCM6200 Series
- CVE-2024-43451NTLM Hash Disclosure Spoofing VulnerabilityMicrosoft Windows Server · Microsoft Windows
- CVE-2017-0213Windows COM Aggregate Marshaler in Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2Microsoft Windows COM
- CVE-2010-3563Unspecified vulnerability in the Deployment component in Oracle Java SE and Java for Business 6 Update 21 allows remote attackers to…
- CVE-2024-38077Windows Remote Desktop Licensing Service Remote Code Execution VulnerabilityMicrosoft Windows Server
- CVE-2024-38112Windows MSHTML Platform Spoofing VulnerabilityMicrosoft Windows
- CVE-2021-25080Contact Form Entries < 1.1.7 - Unauthenticated Stored Cross-Site ScriptingContact Form Entries – Contact Form 7, WPforms and more
- CVE-2014-6037Directory traversal vulnerability in the agentUpload servlet in ZOHO ManageEngine EventLog Analyzer 9.0 build 9002 and 8.2 build 8020…
- CVE-2025-40551SolarWinds Web Help Desk Deserialization of Untrusted Data Remote Code Execution VulnerabilitySolarWinds Web Help Desk
- CVE-2015-2857Accellion File Transfer Appliance before FTA_9_11_210 allows remote attackers to execute arbitrary code via shell metacharacters in the…
- CVE-2017-11317Telerik.Web.UI in Progress Telerik UI for ASP.NET AJAX before R1 2017 and R2 before R2 2017 SP2 uses weak RadAsyncUpload encryption, which a
- CVE-2021-21224Type confusion in V8 in Google Chrome prior to 90.0.4430.85 allowed a remote attacker to execute arbitrary code inside a sandbox via a craftGoogle Chrome
- CVE-2024-12856Four-Faith Industrial Router adjust_sys_time OS Command InjectionFour-Faith F3x24 · Four-Faith F3x36
- CVE-2024-6782Calibre Remote Code ExecutionCalibre
- CVE-2021-24155Backup Guard < 1.6.0 - Authenticated Arbitrary File UploadWordPress Backup and Migrate Plugin – Backup Guard
- CVE-2020-25681A flaw was found in dnsmasq before version 2.83.dnsmasq
- CVE-2018-17552SQL Injection in login.php in Naviwebs Navigate CMS 2.8 allows remote attackers to bypass authentication via the navigate-user cookie.
- CVE-2009-3129Microsoft Office Excel 2002 SP3, 2003 SP3, and 2007 SP1 and SP2; Office 2004 and 2008 for Mac; Open XML File Format Converter for Mac; Offic
- CVE-2023-28128An unrestricted upload of file with dangerous type vulnerability exists in Avalanche versions 6.3.x and below that could allow an attacker…Avalanche
- CVE-2023-28432Minio Information Disclosure in Cluster Deploymentminio
- CVE-2015-3035Directory traversal vulnerability in TP-LINK Archer C5 (1.2) with firmware before 150317, C7 (2.0) with firmware before 150304, and C8 (1.0)
- CVE-2022-28368Dompdf 1.2.1 allows remote code execution via a .php file in the src:url field of an @font-face Cascading Style Sheets (CSS) statement…dompdf/dompdf
- CVE-2023-48022Anyscale Ray 2.6.3 and 2.8.0 allows a remote attacker to execute arbitrary code via the job submission API.ray
Get alerts when a CVE crosses 30% EPSS
Only want the packages you use? Check a lockfile to get a feed for your stack.
https://cve.now/epss/feed
Paste into Feedly or any RSS reader, or run /feed subscribe https://cve.now/epss/feed in Slack. For email alerts, give it to an RSS-to-email service.
https://cve.now/epss/feed?format=atom
The same entries as Atom, for readers that prefer it.
https://cve.now/epss/feed?format=json
The same entries as JSON Feed 1.1, for scripts and readers that support it.
Frequently asked questions
What is an EPSS score?
The Exploit Prediction Scoring System (EPSS) estimates the probability that a CVE will be exploited in the wild in the next 30 days, from 0 to 100%. FIRST.org publishes a new score for every published CVE each day, using a model trained on observed exploitation activity.
What does the EPSS percentile mean?
The percentile ranks a CVE's score against every other CVE's. A CVE in the 95th percentile scores higher than 95% of all CVEs, even when its probability looks small, because most CVEs score well under 1%. For example, a CVE with EPSS 0.42 and percentile 0.99 has a 42% chance of exploitation within 30 days and scores higher than 99% of CVEs.
What is the difference between EPSS and CVSS?
CVSS measures how severe a vulnerability would be if exploited; EPSS measures how likely exploitation is. A CVSS 9.8 bug nobody targets can have an EPSS under 1%, while a CVSS 6.5 bug in a widely scanned product can score above 50%. Use both: CVSS for impact, EPSS for likelihood.
What is a good EPSS threshold?
There is no single cutoff. Many teams prioritize CVEs above 10% (roughly the top 4% of all CVEs) and treat anything above 30% as urgent. cve.now flags a high-severity CVE as critical once its EPSS reaches 10%.
How do EPSS and CISA KEV work together?
KEV lists vulnerabilities already exploited; EPSS predicts which will be. Patch everything on KEV first, then work down by EPSS score, starting with the highest-severity CVEs in your stack.