CVEs with an EPSS score above 30%
Every CVE with at least a 30% EPSS chance of exploitation in the next 30 days: 7,156 as of 2026-11-06, highest first.
- CVE-2022-1179Non-Privilege User Can Created New Rule and Lead to Stored Cross Site Scripting in openemr/openemropenemr/openemr
- CVE-2024-23334aiohttp.web.static(follow_symlinks=True) is vulnerable to directory traversalaio-libs aiohttp · aiohttp
- CVE-2022-41800Appliance mode iControl REST vulnerabilityF5 BIG-IP
- CVE-2006-5779OpenLDAP before 2.3.29 allows remote attackers to cause a denial of service (daemon crash) via LDAP BIND requests with long authcid names…
- CVE-2020-13638lib/crud/userprocess.php in rConfig 3.9.x before 3.9.7 has an authentication bypass, leading to administrator account creation.
- CVE-2021-29156ForgeRock OpenAM before 13.5.1 allows LDAP injection via the Webfinger protocol.
- CVE-2024-5932GiveWP – Donation Plugin and Fundraising Platform <= 3.14.1 - Unauthenticated PHP Object Injection to Remote Code Executionstellarwp GiveWP – Donation Plugin and Fundraising Platform
- CVE-2003-0190OpenSSH-portable (OpenSSH) 3.6.1p1 and earlier with PAM support enabled immediately sends an error message when a user does not exist…
- CVE-2018-15877The Plainview Activity Monitor plugin before 20180826 for WordPress is vulnerable to OS command injection via shell metacharacters in the…
- CVE-2017-9101import.php (aka the Phonebook import feature) in PlaySMS 1.4 allows remote code execution via vectors involving the User-Agent HTTP header…
- CVE-2017-0070A remote code execution vulnerability exists in the way affected Microsoft scripting engines render when handling objects in memory in…Microsoft Browser
- CVE-2017-9554An information exposure vulnerability in forget_passwd.cgi in Synology DiskStation Manager (DSM) before 6.1.3-15152 allows remote…
- CVE-2023-36899ASP.NET Elevation of Privilege VulnerabilityMicrosoft .NET Framework 2.0 Service Pack · Microsoft .N… +1
- CVE-2009-2685Stack-based buffer overflow in the login form in the management web server in HP Power Manager allows remote attackers to execute…
- CVE-2010-3600Unspecified vulnerability in the Client System Analyzer component in Oracle Database Server 11.1.0.7 and 11.2.0.1 and Enterprise Manager…
- CVE-2012-1440The ELF file parser in Norman Antivirus 6.06.12, eSafe 7.0.17.0, CA eTrust Vet Antivirus 36.1.8511, Fortinet Antivirus 4.2.254.0, and…
- CVE-2021-39843Adobe Acrobat Reader XObject Out-of-Bound Write VulnerabilityAdobe Acrobat Reader
- CVE-2007-5423tiki-graph_formula.php in TikiWiki 1.9.8 allows remote attackers to execute arbitrary code via PHP sequences in the f array parameter…
- CVE-2022-2185A critical issue has been discovered in GitLab affecting all versions starting from 14.0 prior to 14.10.5, 15.0 prior to 15.0.4, and 15.1…GitLab
- CVE-2019-7238Sonatype Nexus Repository Manager before 3.15.0 has Incorrect Access Control.
- CVE-2021-35478Nagios Log Server before 2.1.9 contains Reflected XSS in the dropdown box for the alert history and audit log function.
- CVE-2024-22120Time Based SQL Injection in Zabbix Server Audit LogZabbix
- CVE-2025-6204Improper Control of Generation of Code (Code Injection) vulnerability affecting DELMIA Apriso from Release 2020 through Release 2025Dassault Systèmes DELMIA Apriso
- CVE-2022-45699Command injection in the administration interface in APSystems ECU-R version 5203 allows a remote unauthenticated attacker to execute…
- CVE-2005-3081wzdftpd 0.5.4 allows remote authenticated users to execute arbitrary commands via shell metacharacters in the SITE command.
- CVE-2020-13965An issue was discovered in Roundcube Webmail before 1.3.12 and 1.4.x before 1.4.5.
- CVE-2022-44267ImageMagick 7.1.0-49 is vulnerable to Denial of Service.
- CVE-2008-0015Stack-based buffer overflow in the CComVariant::ReadFromStream function in the Active Template Library (ATL), as used in the MPEG2TuneReques
- CVE-2018-15133In Laravel Framework through 5.5.40 and 5.6.x through 5.6.29, remote code execution might occur as a result of an unserialize call on a potelaravel/framework
- CVE-2026-88772Memory overflow vulnerability leading to Remote Code Execution or Denial of ServiceCitrix NetScaler ADC · Citrix NetScaler Gateway
Get alerts when a CVE crosses 30% EPSS
Only want the packages you use? Check a lockfile to get a feed for your stack.
https://cve.now/epss/feed
Paste into Feedly or any RSS reader, or run /feed subscribe https://cve.now/epss/feed in Slack. For email alerts, give it to an RSS-to-email service.
https://cve.now/epss/feed?format=atom
The same entries as Atom, for readers that prefer it.
https://cve.now/epss/feed?format=json
The same entries as JSON Feed 1.1, for scripts and readers that support it.
Frequently asked questions
What is an EPSS score?
The Exploit Prediction Scoring System (EPSS) estimates the probability that a CVE will be exploited in the wild in the next 30 days, from 0 to 100%. FIRST.org publishes a new score for every published CVE each day, using a model trained on observed exploitation activity.
What does the EPSS percentile mean?
The percentile ranks a CVE's score against every other CVE's. A CVE in the 95th percentile scores higher than 95% of all CVEs, even when its probability looks small, because most CVEs score well under 1%. For example, a CVE with EPSS 0.42 and percentile 0.99 has a 42% chance of exploitation within 30 days and scores higher than 99% of CVEs.
What is the difference between EPSS and CVSS?
CVSS measures how severe a vulnerability would be if exploited; EPSS measures how likely exploitation is. A CVSS 9.8 bug nobody targets can have an EPSS under 1%, while a CVSS 6.5 bug in a widely scanned product can score above 50%. Use both: CVSS for impact, EPSS for likelihood.
What is a good EPSS threshold?
There is no single cutoff. Many teams prioritize CVEs above 10% (roughly the top 4% of all CVEs) and treat anything above 30% as urgent. cve.now flags a high-severity CVE as critical once its EPSS reaches 10%.
How do EPSS and CISA KEV work together?
KEV lists vulnerabilities already exploited; EPSS predicts which will be. Patch everything on KEV first, then work down by EPSS score, starting with the highest-severity CVEs in your stack.