Most Exploitable CVEs - EPSS Rankings
CVEs ranked by EPSS (Exploit Prediction Scoring System) probability. Higher scores mean a greater likelihood of exploitation in the wild within the next 30 days.
164
EPSS > 50%
156
CISA KEV Listed
35,468
CVEs with EPSS
0.7%
Avg EPSS Score
| Rank | CVE ID | EPSS Score | Percentile | CVSS | Flags | Summary |
|---|---|---|---|---|---|---|
| 5351 | CVE-2025-46407 |
|
43.7th | 8.8 | A memory corruption vulnerability in SAIL Image Decoding Library's BMPv3 palette decoding allows rem | |
| 5352 | CVE-2025-32468 |
|
43.7th | 8.8 | A memory corruption vulnerability in SAIL Image Decoding Library's BMPv3 decoder allows remote code | |
| 5353 | CVE-2025-58179 |
|
43.7th | 7.2 | This CVE describes a Server-Side Request Forgery (SSRF) vulnerability in Astro's Cloudflare adapter. | |
| 5354 | CVE-2025-59291 |
|
43.7th | 8.2 | This vulnerability in Azure Container Instances allows authorized attackers to manipulate file paths | |
| 5355 | CVE-2025-61976 |
|
43.6th | 7.5 | CVE-2025-61976 is an improper condition check vulnerability in CHOCO TEI WATCHER mini (IB-MCT001) th | |
| 5356 | CVE-2026-20856 |
|
43.6th | 8.1 | This vulnerability allows an unauthorized attacker to execute arbitrary code on Windows Server Updat | |
| 5357 | CVE-2025-29149 |
|
43.6th | 7.5 | This vulnerability allows remote attackers to execute arbitrary code on Tenda i12 routers by exploit | |
| 5358 | CVE-2025-29121 |
|
43.6th | 7.5 | A stack-based buffer overflow vulnerability exists in Tenda AC6 routers version V15.03.05.16. Attack | |
| 5359 | CVE-2025-29214 |
|
43.6th | 7.5 | Tenda AX12 routers running firmware version 22.03.01.46_CN contain a stack-based buffer overflow vul | |
| 5360 | CVE-2024-56346 |
|
43.6th | 10.0 | This critical vulnerability in IBM AIX's nimesis NIM master service allows remote attackers to execu | |
| 5361 | CVE-2024-13780 |
|
43.6th | 6.5 | The Hero Mega Menu WordPress plugin has an arbitrary file deletion vulnerability that allows unauthe | |
| 5362 | CVE-2025-3737 |
|
43.5th | 5.9 | This vulnerability in the Drupal Google Maps: Store Locator module allows attackers to execute arbit | |
| 5363 | CVE-2025-3735 |
|
43.5th | 5.9 | This vulnerability affects the obsolete Drupal Panelizer module, allowing attackers to exploit unspe | |
| 5364 | CVE-2019-25223 |
|
43.5th | 4.9 | This SQL injection vulnerability in the Team Circle Image Slider With Lightbox WordPress plugin allo | |
| 5365 | CVE-2025-4288 |
|
43.5th | 7.3 | A critical buffer overflow vulnerability in PCMan FTP Server 2.0.7 allows remote attackers to execut | |
| 5366 | CVE-2025-4253 |
|
43.5th | 7.3 | A critical buffer overflow vulnerability exists in PCMan FTP Server 2.0.7's HASH command handler, al | |
| 5367 | CVE-2025-4251 |
|
43.5th | 7.3 | A critical buffer overflow vulnerability in PCMan FTP Server 2.0.7 allows remote attackers to execut | |
| 5368 | CVE-2025-4240 |
|
43.5th | 7.3 | A critical buffer overflow vulnerability exists in PCMan FTP Server 2.0.7's LCD Command Handler comp | |
| 5369 | CVE-2025-4238 |
|
43.5th | 7.3 | CVE-2025-4238 is a critical buffer overflow vulnerability in PCMan FTP Server 2.0.7's MGET command h | |
| 5370 | CVE-2025-4236 |
|
43.5th | 7.3 | A critical buffer overflow vulnerability exists in PCMan FTP Server 2.0.7's MDIR command handler, al | |
| 5371 | CVE-2025-35042 |
|
43.6th | 9.8 | Airship AI Acropolis uses a default administrative account with identical hardcoded credentials acro | |
| 5372 | CVE-2025-10146 |
|
43.5th | 6.1 | The Download Manager WordPress plugin up to version 3.3.23 contains a reflected cross-site scripting | |
| 5373 | CVE-2025-0501 |
|
43.4th | 7.5 | This CVE describes a man-in-the-middle vulnerability in Amazon WorkSpaces native clients using the P | |
| 5374 | CVE-2024-51741 |
|
43.4th | 4.4 | An authenticated attacker with sufficient privileges can create a malformed ACL selector in Redis th | |
| 5375 | CVE-2024-56897 |
|
43.5th | 9.8 | This vulnerability allows unauthenticated attackers to download/upload files and execute API command | |
| 5376 | CVE-2024-13722 |
|
43.4th | 5.4 | The NagVis component in Checkmk is vulnerable to reflected cross-site scripting (XSS), allowing atta | |
| 5377 | CVE-2024-35224 |
|
43.4th | 7.6 | This vulnerability allows stored cross-site scripting (XSS) in OpenProject's Cost Report feature via | |
| 5378 | CVE-2025-3697 |
|
43.4th | 6.3 | This critical SQL injection vulnerability in SourceCodester Web-based Pharmacy Product Management Sy | |
| 5379 | CVE-2025-3397 |
|
43.5th | 4.3 | This vulnerability allows attackers to inject malicious scripts via the 'gourl' parameter in YzmCMS | |
| 5380 | CVE-2025-1264 |
|
43.4th | 6.5 | This SQL injection vulnerability in the Broken Link Checker WordPress plugin allows authenticated at | |
| 5381 | CVE-2025-8323 |
|
43.4th | 8.8 | CVE-2025-8323 is an arbitrary file upload vulnerability in e-School from Ventem that allows unauthen | |
| 5382 | CVE-2020-26799 |
|
43.5th | 9.8 | A reflected cross-site scripting (XSS) vulnerability in Luxcal 4.5.2 allows unauthenticated attacker | |
| 5383 | CVE-2025-62254 |
|
43.4th | 7.5 | This vulnerability in Liferay Portal and DXP allows remote attackers to trigger denial of service at | |
| 5384 | CVE-2025-55085 |
|
43.4th | 7.5 | This vulnerability in NextX Duo's HTTP client module allows a malicious server response to trigger u | |
| 5385 | CVE-2025-21329 |
|
43.2th | 4.3 | This vulnerability allows attackers to bypass security zone restrictions in Windows when processing | |
| 5386 | CVE-2025-1026 |
|
43.2th | 8.6 | CVE-2025-1026 is a local file inclusion vulnerability in spatie/browsershot PHP package versions bef | |
| 5387 | CVE-2025-27836 |
|
43.2th | 9.8 | A buffer overflow vulnerability in the BJ10V device driver in Ghostscript allows attackers to execut | |
| 5388 | CVE-2025-27831 |
|
43.2th | 9.8 | A buffer overflow vulnerability in Artifex Ghostscript's DOCXWRITE/TXTWRITE device allows attackers | |
| 5389 | CVE-2022-43847 |
|
43.2th | 5.4 | IBM Aspera Console versions 3.4.0 through 3.4.4 are vulnerable to HTTP header injection due to impro | |
| 5390 | CVE-2025-46468 |
|
43.2th | 9.8 | This vulnerability allows attackers to include local files on the server through improper filename c | |
| 5391 | CVE-2025-39406 |
|
43.2th | 9.8 | This vulnerability allows attackers to include arbitrary local files through PHP's include/require s | |
| 5392 | CVE-2025-6678 |
|
43.4th | 7.5 | This vulnerability allows remote attackers to access sensitive information from Autel MaxiCharger AC | |
| 5393 | CVE-2025-6758 |
|
43.3th | 9.8 | This vulnerability allows unauthenticated attackers to register as administrators on WordPress sites | |
| 5394 | CVE-2017-20208 |
|
43.2th | 9.8 | This vulnerability allows unauthenticated attackers to execute arbitrary PHP code on WordPress sites | |
| 5395 | CVE-2017-20206 |
|
43.2th | 9.8 | The Appointments plugin for WordPress has a PHP object injection vulnerability that allows unauthent | |
| 5396 | CVE-2025-59371 |
|
43.2th | N/A | An authentication bypass vulnerability in the IFTTT integration feature allows authenticated attacke | |
| 5397 | CVE-2024-41746 |
|
43.1th | 7.2 | IBM CICS TX Advanced and Standard are vulnerable to stored cross-site scripting (XSS) that allows au | |
| 5398 | CVE-2024-47572 |
|
43.2th | 9.0 | This vulnerability allows attackers to execute arbitrary code on Fortinet FortiSOAR systems by manip | |
| 5399 | CVE-2024-13106 |
|
43.1th | 5.3 | This vulnerability in D-Link DIR-816 routers allows unauthorized access to the IP QoS configuration | |
| 5400 | CVE-2023-46606 |
|
43.1th | 5.3 | This CVE describes a missing authorization vulnerability in the AtomChat WordPress plugin that allow |
What is EPSS?
The Exploit Prediction Scoring System (EPSS) is a data-driven model developed by FIRST.org that estimates the probability a CVE will be exploited in the wild within the next 30 days. Unlike CVSS which measures severity, EPSS measures likelihood of exploitation — making it ideal for prioritizing which vulnerabilities to patch first.
Why EPSS matters: With thousands of CVEs published monthly, not all vulnerabilities are equally dangerous. EPSS helps security teams focus on the CVEs most likely to be actively exploited, rather than patching solely by CVSS score. A critical CVSS 9.8 vulnerability with 0.1% EPSS may be less urgent than a high CVSS 7.5 with 90% EPSS.
Prioritize by Exploit Risk
Scan your servers and see which vulnerabilities have the highest EPSS scores. Focus on what attackers are actually targeting.
Start Monitoring Free