CVEs with an EPSS score above 30%
Every CVE with at least a 30% EPSS chance of exploitation in the next 30 days: 7,156 as of 2026-11-06, highest first.
- CVE-2018-10660An issue was discovered in multiple models of Axis IP Cameras.
- CVE-2020-26258Server-Side Forgery Request can be activated unmarshalling with XStreamx-stream xstream · com.thoughtworks.xstream:xstream
- CVE-2020-9315* PRODUCT NOT SUPPORTED WHEN ASSIGNED * Oracle iPlanet Web Server 7.0.x has Incorrect Access Control for admingui/version URIs in the…
- CVE-2023-43177CrushFTP prior to 10.5.1 is vulnerable to Improperly Controlled Modification of Dynamically-Determined Object Attributes.
- CVE-2004-1172Stack-based buffer overflow in the Agent Browser in Veritas Backup Exec 8.x before 8.60.3878 Hotfix 68, and 9.x before 9.1.4691 Hotfix 40…
- CVE-2025-34026Versa Concerto Actuator Authentication Bypass Information LeakVersa Concerto
- CVE-2026-105134Ahsay AhsayCBS Replication Receiver UpdateReceivers.do os command injectionAhsayCBS
- CVE-2015-7871Crypto-NAK packets in ntpd in NTP 4.2.x before 4.2.8p4, and 4.3.x before 4.3.77 allows remote attackers to bypass authentication.
- CVE-2022-34169Apache Xalan Java XSLT library is vulnerable to an integer truncation issue when processing malicious XSLT stylesheetsApache Software Foundation Apache Xalan-J · xalan:xalan
- CVE-2022-34783Jenkins Plot Plugin 2.1.10 and earlier does not escape plot descriptions, resulting in a stored cross-site scripting (XSS) vulnerability…Jenkins project Jenkins Plot Plugin · org.jenkins-ci.plugin…
- CVE-2020-27868This vulnerability allows remote attackers to execute arbitrary code on affected installations of Qognify Ocularis 5.9.0.395.Qognify Ocularis
- CVE-2012-2763Buffer overflow in the readstr_upto function in plug-ins/script-fu/tinyscheme/scheme.c in GIMP 2.6.12 and earlier, and possibly 2.6.13…
- CVE-2023-34992A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet allows attacker to…Fortinet FortiSIEM
- CVE-2018-13382An Improper Authorization vulnerability in Fortinet FortiOS 6.0.0 to 6.0.4, 5.6.0 to 5.6.8 and 5.4.1 to 5.4.10 and FortiProxy 2.0.0, 1.2.0 tFortinet FortiOS, FortiProxy
- CVE-2014-8516Unrestricted file upload vulnerability in Visual Mining NetCharts Server allows remote attackers to execute arbitrary code by uploading a…
- CVE-2020-8864This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of D-Link DIR-867, DIR-878, and…D-Link Multiple Routers
- CVE-2019-0752A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer, aka 'ScripMicrosoft Internet Explorer
- CVE-2021-26411Internet Explorer Memory Corruption VulnerabilityMicrosoft Internet Explorer · Microsoft Edge
- CVE-2010-3971Use-after-free vulnerability in the CSharedStyleSheet::Notify function in the Cascading Style Sheets (CSS) parser in mshtml.dll, as used…
- CVE-2014-4114Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and
- CVE-2007-0774Stack-based buffer overflow in the map_uri_to_worker function (native/common/jk_uri_worker_map.c) in mod_jk.so for Apache Tomcat JK Web…
- CVE-2021-42125An unrestricted file upload vulnerability exists in Ivanti Avalanche before 6.3.3 allows an attacker with access to the Inforail Service…Ivanti Avalance
- CVE-2024-23478SolarWinds Access Rights Manager (ARM) Deserialization of Untrusted Data Remote Code ExecutionSolarWinds Access Rights Manager
- CVE-2018-5955An issue was discovered in GitStack through 2.3.10.
- CVE-2019-9513Some HTTP/2 implementations are vulnerable to resource loops, potentially leading to a denial of service
- CVE-2023-31099Zoho ManageEngine OPManager through 126323 allows an authenticated user to achieve remote code execution via probe servers.
- CVE-2020-9294An improper authentication vulnerability in FortiMail 5.4.10, 6.0.7, 6.2.2 and earlier and FortiVoiceEntreprise 6.0.0 and 6.0.1 may allow…Fortinet FortiMail · Fortinet FortiVoiceEnterprise
- CVE-2024-5806MOVEit Transfer Authentication Bypass VulnerabilityProgress MOVEit Transfer
- CVE-2019-10092In Apache HTTP Server 2.4.0-2.4.39, a limited cross-site scripting issue was reported affecting the mod_proxy error page.Apache HTTP Server
- CVE-2023-32031Microsoft Exchange Server Remote Code Execution VulnerabilityMicrosoft Exchange Server 2019 Cumulative Update · Microsof…
Get alerts when a CVE crosses 30% EPSS
Only want the packages you use? Check a lockfile to get a feed for your stack.
https://cve.now/epss/feed
Paste into Feedly or any RSS reader, or run /feed subscribe https://cve.now/epss/feed in Slack. For email alerts, give it to an RSS-to-email service.
https://cve.now/epss/feed?format=atom
The same entries as Atom, for readers that prefer it.
https://cve.now/epss/feed?format=json
The same entries as JSON Feed 1.1, for scripts and readers that support it.
Frequently asked questions
What is an EPSS score?
The Exploit Prediction Scoring System (EPSS) estimates the probability that a CVE will be exploited in the wild in the next 30 days, from 0 to 100%. FIRST.org publishes a new score for every published CVE each day, using a model trained on observed exploitation activity.
What does the EPSS percentile mean?
The percentile ranks a CVE's score against every other CVE's. A CVE in the 95th percentile scores higher than 95% of all CVEs, even when its probability looks small, because most CVEs score well under 1%. For example, a CVE with EPSS 0.42 and percentile 0.99 has a 42% chance of exploitation within 30 days and scores higher than 99% of CVEs.
What is the difference between EPSS and CVSS?
CVSS measures how severe a vulnerability would be if exploited; EPSS measures how likely exploitation is. A CVSS 9.8 bug nobody targets can have an EPSS under 1%, while a CVSS 6.5 bug in a widely scanned product can score above 50%. Use both: CVSS for impact, EPSS for likelihood.
What is a good EPSS threshold?
There is no single cutoff. Many teams prioritize CVEs above 10% (roughly the top 4% of all CVEs) and treat anything above 30% as urgent. cve.now flags a high-severity CVE as critical once its EPSS reaches 10%.
How do EPSS and CISA KEV work together?
KEV lists vulnerabilities already exploited; EPSS predicts which will be. Patch everything on KEV first, then work down by EPSS score, starting with the highest-severity CVEs in your stack.