CVEs with an EPSS score above 30%
Every CVE with at least a 30% EPSS chance of exploitation in the next 30 days: 7,156 as of 2026-11-06, highest first.
- CVE-2003-0812Stack-based buffer overflow in a logging function for Windows Workstation Service (WKSSVC.DLL) allows remote attackers to execute…
- CVE-2023-38096NETGEAR ProSAFE Network Management System MyHandlerInterceptor Authentication Bypass VulnerabilityNETGEAR ProSAFE Network Management System
- CVE-2023-36469Code injection through NotificationRSSService in XWiki Platformxwiki-platform · org.xwiki.platform:xwiki-platform-notifica…
- CVE-2022-1175Improper neutralization of user input in GitLab CE/EE versions 14.4 before 14.7.7, all versions starting from 14.8 before 14.8.5, all…GitLab
- CVE-2024-28182Reading unbounded number of HTTP/2 CONTINUATION frames to cause excessive CPU usagenghttp2
- CVE-2018-0886The Credential Security Support Provider protocol (CredSSP) in Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1…Microsoft Windows
- CVE-2023-40492LG Simple Editor deleteCheckSession Directory Traversal Arbitrary File Deletion VulnerabilityLG Simple Editor
- CVE-2023-40494LG Simple Editor deleteFolder Directory Traversal Arbitrary File Deletion VulnerabilityLG Simple Editor
- CVE-2023-40502LG Simple Editor cropImage Directory Traversal Arbitrary File Deletion VulnerabilityLG Simple Editor
- CVE-2014-8440Adobe Flash Player before 13.0.0.252 and 14.x and 15.x before 15.0.0.223 on Windows and OS X and before 11.2.202.418 on Linux, Adobe AIR…
- CVE-2021-40449Win32k Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2020-35578An issue was discovered in the Manage Plugins page in Nagios XI before 5.8.0.
- CVE-2023-1698WAGO: WBM Command Injection in multiple productsWAGO Compact Controller CC100 · WAGO Edge Controller +5
- CVE-2022-36958SolarWinds Platform Deserialization of Untrusted DataSolarWinds Platform · SolarWinds Orion Platform
- CVE-2016-10372The Eir D1000 modem does not properly restrict the TR-064 protocol, which allows remote attackers to execute arbitrary commands via TCP…
- CVE-2026-88771A remote code execution vulnerability exists due to improper input validation, which can allow an unauthenticated attacker to execute arbitrary commandsCitrix NetScaler ADC · Citrix NetScaler Gateway
- CVE-2009-2526Microsoft Windows Vista Gold, SP1, and SP2 and Server 2008 Gold and SP2 do not properly validate fields in SMBv2 packets, which allows…
- CVE-2020-7200A potential security vulnerability has been identified in HPE Systems Insight Manager (SIM) version 7.6.HPE Systems Insight Manager
- CVE-2015-6128Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, and Windows 7 SP1 mishandle library loading, which allows local users to…
- CVE-2023-46263An unrestricted upload of file with dangerous type vulnerability exists in Avalanche versions 6.4.1 and below that could allow an attacker…Ivanti Avalanche
- CVE-2009-4324Use-after-free vulnerability in the Doc.media.newPlayer method in Multimedia.api in Adobe Reader and Acrobat 9.x before 9.3, and 8.x before
- CVE-2016-3087Apache Struts 2.3.19 to 2.3.20.2, 2.3.21 to 2.3.24.1, and 2.3.25 to 2.3.28, when Dynamic Method Invocation is enabled, allow remote…org.apache.struts:struts2-core
- CVE-2019-7254Linear eMerge E3-Series devices allow File Inclusion.
- CVE-2004-0597Multiple buffer overflows in libpng 1.2.5 and earlier, as used in multiple products, allow remote attackers to execute arbitrary code via…
- CVE-2022-20615Jenkins Matrix Project Plugin 1.19 and earlier does not escape HTML metacharacters in node and label names, and label descriptions…Jenkins project Jenkins Matrix Project Plugin · org.jenkins…
- CVE-2022-32214The llhttp parser <v14.20.1, <v16.17.1 and <v18.9.1 in the http module in Node.js does not strictly use the CRLF sequence to delimit HTTP…NodeJS Node · llhttp
- CVE-2021-20034An improper access control vulnerability in SMA100 allows a remote unauthenticated attacker to bypass the path traversal checks and delete…SonicWall SMA100
- CVE-2021-25114Paid Memberships Pro < 2.6.7 - Unauthenticated Blind SQL InjectionPaid Memberships Pro
- CVE-2023-2915Rockwell Automation ThinManager Thinserver Software Vulnerable to Input Validation VulnerabilityRockwell Automation ThinManager ThinServer
- CVE-2020-9465An issue was discovered in EyesOfNetwork eonweb 5.1 through 5.3 before 5.3-3.
Get alerts when a CVE crosses 30% EPSS
Only want the packages you use? Check a lockfile to get a feed for your stack.
https://cve.now/epss/feed
Paste into Feedly or any RSS reader, or run /feed subscribe https://cve.now/epss/feed in Slack. For email alerts, give it to an RSS-to-email service.
https://cve.now/epss/feed?format=atom
The same entries as Atom, for readers that prefer it.
https://cve.now/epss/feed?format=json
The same entries as JSON Feed 1.1, for scripts and readers that support it.
Frequently asked questions
What is an EPSS score?
The Exploit Prediction Scoring System (EPSS) estimates the probability that a CVE will be exploited in the wild in the next 30 days, from 0 to 100%. FIRST.org publishes a new score for every published CVE each day, using a model trained on observed exploitation activity.
What does the EPSS percentile mean?
The percentile ranks a CVE's score against every other CVE's. A CVE in the 95th percentile scores higher than 95% of all CVEs, even when its probability looks small, because most CVEs score well under 1%. For example, a CVE with EPSS 0.42 and percentile 0.99 has a 42% chance of exploitation within 30 days and scores higher than 99% of CVEs.
What is the difference between EPSS and CVSS?
CVSS measures how severe a vulnerability would be if exploited; EPSS measures how likely exploitation is. A CVSS 9.8 bug nobody targets can have an EPSS under 1%, while a CVSS 6.5 bug in a widely scanned product can score above 50%. Use both: CVSS for impact, EPSS for likelihood.
What is a good EPSS threshold?
There is no single cutoff. Many teams prioritize CVEs above 10% (roughly the top 4% of all CVEs) and treat anything above 30% as urgent. cve.now flags a high-severity CVE as critical once its EPSS reaches 10%.
How do EPSS and CISA KEV work together?
KEV lists vulnerabilities already exploited; EPSS predicts which will be. Patch everything on KEV first, then work down by EPSS score, starting with the highest-severity CVEs in your stack.