EPSS score: exploit prediction scores for every CVE
The Exploit Prediction Scoring System (EPSS), published daily by FIRST.org, estimates the probability that a CVE will be exploited in the wild in the next 30 days. The percentile ranks that score against every other CVE. For example, a CVE with EPSS 0.42 and percentile 0.99 has a 42% chance of exploitation within 30 days and scores higher than 99% of CVEs. Unlike CVSS, which rates how bad a vulnerability would be, EPSS rates how likely an attack is. Patch what is on the CISA KEV catalog first, then work down by EPSS.
FIRST has no EPSS score for CVE-2026-120450. New or rejected CVEs may not be scored yet. Open CVE-2026-120450.
- Scores dated
- 2026-11-02
- CVEs above 10%
- 17,508
- CVEs above 30%
- 7,152
- Newly above 10% today
- 2
Highest EPSS scores
The CVEs most likely to be exploited in the next 30 days, by today's score.
- CVE-2014-0160EPSS 100.0%, 99th percentile
- CVE-2014-3566EPSS 100.0%, 100th percentile
- CVE-2014-6271EPSS 100.0%, 99th percentile
- CVE-2015-1635EPSS 100.0%, 99th percentile
- CVE-2017-5638EPSS 100.0%, 99th percentile
- CVE-2017-9841EPSS 100.0%, 99th percentile
- CVE-2018-13379EPSS 100.0%, 99th percentile
- CVE-2019-0708EPSS 100.0%, 99th percentile
- CVE-2019-11510EPSS 100.0%, 99th percentile
- CVE-2019-19781EPSS 100.0%, 99th percentile
- CVE-2020-5902EPSS 100.0%, 100th percentile
- CVE-2021-1498EPSS 100.0%, 99th percentile
- CVE-2021-21985EPSS 100.0%, 99th percentile
- CVE-2021-22005EPSS 100.0%, 99th percentile
- CVE-2021-26084EPSS 100.0%, 99th percentile
- CVE-2021-26086EPSS 100.0%, 99th percentile
- CVE-2021-34473EPSS 100.0%, 99th percentile
- CVE-2021-35464EPSS 100.0%, 99th percentile
- CVE-2021-40438EPSS 100.0%, 99th percentile
- CVE-2021-44228EPSS 100.0%, 100th percentile
- CVE-2021-45105EPSS 100.0%, 99th percentile
- CVE-2022-26134EPSS 100.0%, 99th percentile
- CVE-2022-29464EPSS 100.0%, 99th percentile
- CVE-2023-0669EPSS 100.0%, 99th percentile
- CVE-2023-1389EPSS 100.0%, 99th percentile
Largest EPSS increases in 24 hours
CVEs whose score rose the most since yesterday's scores, among those now above 10%.
- CVE-2019-6446EPSS 27.3%, 98th percentile (was 17.5%)
- CVE-2008-4824EPSS 21.1%, 97th percentile (was 13.3%)
- CVE-2025-58434EPSS 82.6%, 99th percentile (was 76.4%)
- CVE-2020-5260EPSS 14.9%, 96th percentile (was 9.97%)
- CVE-2023-1718EPSS 28.7%, 98th percentile (was 24.1%)
- CVE-2015-9406EPSS 58.9%, 99th percentile (was 55.0%)
- CVE-2023-20048EPSS 20.0%, 97th percentile (was 16.2%)
- CVE-2023-46695EPSS 53.4%, 98th percentile (was 49.8%)
- CVE-2025-54136EPSS 31.5%, 98th percentile (was 28.5%)
- CVE-2021-28325EPSS 64.1%, 99th percentile (was 62.1%)
- CVE-2025-50154EPSS 31.8%, 98th percentile (was 30.0%)
- CVE-2018-18982EPSS 62.5%, 99th percentile (was 60.8%)
- CVE-2026-3662EPSS 20.3%, 97th percentile (was 18.6%)
- CVE-2026-3661EPSS 19.7%, 97th percentile (was 18.1%)
- CVE-2025-5473EPSS 25.0%, 97th percentile (was 23.5%)
- CVE-2026-30822EPSS 15.0%, 96th percentile (was 13.4%)
- CVE-2026-30821EPSS 16.7%, 97th percentile (was 15.2%)
- CVE-2016-5330EPSS 19.5%, 97th percentile (was 18.0%)
- CVE-2014-9463EPSS 16.0%, 96th percentile (was 14.8%)
- CVE-2021-22719EPSS 41.7%, 98th percentile (was 40.6%)
- CVE-2025-38562EPSS 13.0%, 96th percentile (was 11.9%)
- CVE-2021-22717EPSS 40.0%, 98th percentile (was 38.9%)
- CVE-2016-6483EPSS 12.9%, 96th percentile (was 11.9%)
- CVE-2006-6293EPSS 17.3%, 97th percentile (was 16.4%)
- CVE-2021-22720EPSS 31.5%, 98th percentile (was 30.5%)
Newly above 10%
CVEs whose EPSS crossed 10% since yesterday.
Newly above 30%
CVEs whose EPSS crossed 30% since yesterday.
EPSS questions.
What is an EPSS score?
The Exploit Prediction Scoring System (EPSS) estimates the probability that a CVE will be exploited in the wild in the next 30 days, from 0 to 100%. FIRST.org publishes a new score for every published CVE each day, using a model trained on observed exploitation activity.
What does the EPSS percentile mean?
The percentile ranks a CVE's score against every other CVE's. A CVE in the 95th percentile scores higher than 95% of all CVEs, even when its probability looks small, because most CVEs score well under 1%.
What is the difference between EPSS and CVSS?
CVSS measures how severe a vulnerability would be if exploited; EPSS measures how likely exploitation is. A CVSS 9.8 bug nobody targets can have an EPSS under 1%, while a CVSS 6.5 bug in a widely scanned product can score above 50%. Use both: CVSS for impact, EPSS for likelihood.
What is a good EPSS threshold?
There is no single cutoff. Many teams prioritize CVEs above 10% (roughly the top 4% of all CVEs) and treat anything above 30% as urgent. cve.now flags a high-severity CVE as critical once its EPSS reaches 10%.
How do EPSS and CISA KEV work together?
KEV lists vulnerabilities already exploited; EPSS predicts which will be. Patch everything on KEV first, then work down by EPSS score, starting with the highest-severity CVEs in your stack.