CVEs with an EPSS score above 30%
Every CVE with at least a 30% EPSS chance of exploitation in the next 30 days: 7,156 as of 2026-11-06, highest first.
- CVE-2014-0257Microsoft .NET Framework 1.0 SP3, 1.1 SP1, 2.0 SP2, 3.5, 3.5.1, 4, 4.5, and 4.5.1 does not properly determine whether it is safe to…
- CVE-2010-2703Stack-based buffer overflow in the execvp_nc function in the ov.dll module in HP OpenView Network Node Manager (OV NNM) 7.51 and 7.53…
- CVE-2020-10770A flaw was found in Keycloak before 13.0.0, where it is possible to force the server to call out an unverified URL using the OIDC…keycloak · org.keycloak:keycloak-core
- CVE-2023-4347Cross-site Scripting (XSS) - Reflected in librenms/librenmslibrenms/librenms
- CVE-2002-0661Directory traversal vulnerability in Apache 2.0 through 2.0.39 on Windows, OS2, and Netware allows remote attackers to read arbitrary…
- CVE-2023-1177Path Traversal: '\..\filename' in mlflow/mlflowmlflow/mlflow · mlflow
- CVE-2010-3654Adobe Flash Player before 9.0.289.0 and 10.x before 10.1.102.64 on Windows, Mac OS X, Linux, and Solaris and 10.1.95.1 on Android, and…
- CVE-2023-3368Chamilo LMS Unauthenticated Command InjectionChamilo
- CVE-2023-22463KubePi's Hardcoded Jwtsigkeys allows malicious actor to login with a forged JWT tokenKubeOperator KubePi · github.com/KubeOperator/kubepi
- CVE-2005-0241The httpProcessReplyHeader function in http.c for Squid 2.5-STABLE7 and earlier does not properly set the debug context when it is…
- CVE-2016-7287The scripting engines in Microsoft Internet Explorer 11 and Microsoft Edge allow remote attackers to execute arbitrary code or cause a…
- CVE-2004-0627The check_scramble_323 function in MySQL 4.1.x before 4.1.3, and 5.0, allows remote attackers to bypass authentication via a zero-length…
- CVE-2021-21805An OS Command Injection vulnerability exists in the ping.php script functionality of Advantech R-SeeNet v 2.4.12 (20.10.2020).Advantech
- CVE-2011-1567Multiple stack-based buffer overflows in IGSSdataServer.exe 9.00.00.11063 and earlier in 7-Technologies Interactive Graphical SCADA System…
- CVE-2007-6204Multiple stack-based buffer overflows in HP OpenView Network Node Manager (OV NNM) 6.41, 7.01, and 7.51 allow remote attackers to execute…
- CVE-2020-7774Prototype Pollutiony18n
- CVE-2016-11021setSystemCommand on D-Link DCS-930L devices before 2.12 allows a remote attacker to execute code via an OS command in the SystemCommand para
- CVE-2021-22873Revive Adserver before 5.1.0 is vulnerable to open redirects via the `dest`, `oadest`, and/or `ct0` parameters of the lg.php and ck.php…https://github.com/revive-adserver/revive-adserver
- CVE-2023-5074Authentication Bypass in D-Link D-View 8D-Link D-View
- CVE-2009-4484Multiple stack-based buffer overflows in the CertDecoder::GetName function in src/asn.cpp in TaoCrypt in yaSSL before 1.9.9, as used in…
- CVE-2022-0364Modern Events Calendar Lite < 6.4.0 - Contributor+ Stored Cross Site ScriptingModern Events Calendar Lite
- CVE-2021-39836Adobe Acrobat Reader DC AcroForm buttonGetIcon Use-After-Free Remote Code Execution VulnerabilityAdobe Acrobat Reader
- CVE-2026-55040Microsoft SharePoint Server Security Feature Bypass VulnerabilityMicrosoft SharePoint Enterprise Server · Microsoft SharePoi…
- CVE-2012-4284A Privilege Escalation vulnerability exists in Viscosity 1.4.1 on Mac OS X due to a path name validation issue in the setuid-set…
- CVE-2019-8900A vulnerability in the SecureROM of some Apple devices can be exploited by an unauthenticated local attacker to execute arbitrary code…Apple SecureROM
- CVE-2009-4188HP Operations Dashboard has a default password of j2deployer for the j2deployer account, which allows remote attackers to execute…
- CVE-2024-27292Docassemble unauthorized access through URL manipulationjhpyle docassemble · docassemble-base +1
- CVE-2005-0560Heap-based buffer overflow in the SvrAppendReceivedChunk function in xlsasink.dll in the SMTP service of Exchange Server 2000 and 2003…
- CVE-2008-1117Directory traversal vulnerability in the Notes (aka Flash Notes or instant messages) feature in tb2ftp.dll in Timbuktu Pro 8.6.5 for…
- CVE-2024-38472Apache HTTP Server on WIndows UNC SSRFApache Software Foundation Apache HTTP Server · apache
Get alerts when a CVE crosses 30% EPSS
Only want the packages you use? Check a lockfile to get a feed for your stack.
https://cve.now/epss/feed
Paste into Feedly or any RSS reader, or run /feed subscribe https://cve.now/epss/feed in Slack. For email alerts, give it to an RSS-to-email service.
https://cve.now/epss/feed?format=atom
The same entries as Atom, for readers that prefer it.
https://cve.now/epss/feed?format=json
The same entries as JSON Feed 1.1, for scripts and readers that support it.
Frequently asked questions
What is an EPSS score?
The Exploit Prediction Scoring System (EPSS) estimates the probability that a CVE will be exploited in the wild in the next 30 days, from 0 to 100%. FIRST.org publishes a new score for every published CVE each day, using a model trained on observed exploitation activity.
What does the EPSS percentile mean?
The percentile ranks a CVE's score against every other CVE's. A CVE in the 95th percentile scores higher than 95% of all CVEs, even when its probability looks small, because most CVEs score well under 1%. For example, a CVE with EPSS 0.42 and percentile 0.99 has a 42% chance of exploitation within 30 days and scores higher than 99% of CVEs.
What is the difference between EPSS and CVSS?
CVSS measures how severe a vulnerability would be if exploited; EPSS measures how likely exploitation is. A CVSS 9.8 bug nobody targets can have an EPSS under 1%, while a CVSS 6.5 bug in a widely scanned product can score above 50%. Use both: CVSS for impact, EPSS for likelihood.
What is a good EPSS threshold?
There is no single cutoff. Many teams prioritize CVEs above 10% (roughly the top 4% of all CVEs) and treat anything above 30% as urgent. cve.now flags a high-severity CVE as critical once its EPSS reaches 10%.
How do EPSS and CISA KEV work together?
KEV lists vulnerabilities already exploited; EPSS predicts which will be. Patch everything on KEV first, then work down by EPSS score, starting with the highest-severity CVEs in your stack.