Most Exploitable CVEs - EPSS Rankings
CVEs ranked by EPSS (Exploit Prediction Scoring System) probability. Higher scores mean a greater likelihood of exploitation in the wild within the next 30 days.
164
EPSS > 50%
156
CISA KEV Listed
35,468
CVEs with EPSS
0.7%
Avg EPSS Score
| Rank | CVE ID | EPSS Score | Percentile | CVSS | Flags | Summary |
|---|---|---|---|---|---|---|
| 801 | CVE-2024-10441 |
|
67.9th | 9.8 | This critical vulnerability allows remote attackers to execute arbitrary code on Synology BeeStation | |
| 802 | CVE-2025-66251 |
|
67.8th | 9.1 | This vulnerability allows unauthenticated attackers to delete arbitrary .tgz files via path traversa | |
| 803 | CVE-2025-9485 |
|
67.7th | 9.8 | The OAuth Single Sign On plugin for WordPress has a critical authentication bypass vulnerability. Un | |
| 804 | CVE-2025-14306 |
|
67.7th | 9.1 | A directory traversal vulnerability in Robocode's CacheCleaner component allows attackers to delete | |
| 805 | CVE-2025-22609 |
|
67.7th | 10.0 | This vulnerability allows any authenticated user in Coolify to attach existing private SSH keys to t | |
| 806 | CVE-2025-30392 |
|
67.7th | 9.8 | CVE-2025-30392 is an improper authorization vulnerability in Azure Bot Framework SDK that allows una | |
| 807 | CVE-2025-34195 |
|
67.7th | 9.8 | This vulnerability allows remote code execution on Windows systems running vulnerable versions of Va | |
| 808 | CVE-2025-9276 |
|
67.7th | 9.8 | CVE-2025-9276 allows remote attackers to bypass authentication on systems using vulnerable Cockroach | |
| 809 | CVE-2026-22781 |
|
67.7th | 9.8 | TinyWeb HTTP Server versions before 1.98 are vulnerable to unauthenticated remote command injection | |
| 810 | CVE-2024-11284 |
|
67.6th | 9.8 | The WP JobHunt WordPress plugin has an authentication bypass vulnerability that allows unauthenticat | |
| 811 | CVE-2025-47277 |
|
67.6th | 9.8 | This vulnerability in vLLM versions 0.6.5 through 0.8.4 exposes the TCPStore interface on ALL networ | |
| 812 | CVE-2021-27289 |
|
67.5th | 9.1 | This vulnerability allows attackers within wireless range to replay captured Zigbee packets with man | |
| 813 | CVE-2025-26389 |
|
67.5th | 10.0 | This critical vulnerability allows unauthenticated remote attackers to execute arbitrary code with r | |
| 814 | CVE-2025-60738 |
|
67.5th | 9.8 | This vulnerability allows remote attackers to execute arbitrary operating system commands on Ilevia | |
| 815 | CVE-2025-0180 |
|
67.4th | 9.8 | The WP Foodbakery WordPress plugin has a privilege escalation vulnerability that allows unauthentica | |
| 816 | CVE-2025-32743 |
|
67.4th | 9.0 | This vulnerability in ConnMan's DNS proxy allows attackers to crash the service or potentially execu | |
| 817 | CVE-2025-7206 |
|
67.3th | 9.8 | A critical stack-based buffer overflow vulnerability in D-Link DIR-825 router's httpd component allo | |
| 818 | CVE-2025-7955 |
|
67.3th | 9.8 | The RingCentral Communications plugin for WordPress versions 1.5 to 1.6.8 contains an authentication | |
| 819 | CVE-2023-53983 |
|
67.3th | 9.8 | CVE-2023-53983 allows attackers to gain full administrative control of Anevia Flamingo XL/XS devices | |
| 820 | CVE-2025-65213 |
|
67.3th | 9.8 | This CVE describes a critical remote code execution vulnerability in MooreThreads torch_musa where u | |
| 821 | CVE-2025-53890 |
|
67.3th | 9.8 | An unsafe JavaScript evaluation vulnerability in pyLoad's CAPTCHA processing allows unauthenticated | |
| 822 | CVE-2025-30444 |
|
67.1th | 9.8 | A race condition vulnerability in macOS SMB client allows attackers to cause system termination (ker | |
| 823 | CVE-2025-55526 |
|
67.1th | 9.1 | This vulnerability in n8n-workflows allows attackers to perform directory traversal attacks through | |
| 824 | CVE-2025-34069 |
|
67.1th | 9.8 | This authentication bypass vulnerability in GFI Kerio Control allows unauthenticated attackers to ga | |
| 825 | CVE-2023-53955 |
|
67th | 9.8 | This CVE describes an insecure direct object reference vulnerability in SOUND4 IMPACT/FIRST/PULSE/Ec | |
| 826 | CVE-2025-67188 |
|
67.1th | 9.8 | This buffer overflow vulnerability in TOTOLINK A950RG routers allows remote attackers to execute arb | |
| 827 | CVE-2024-13553 |
|
67th | 9.8 | This vulnerability allows unauthenticated attackers to bypass authentication and take over any user | |
| 828 | CVE-2024-57604 |
|
67th | 9.8 | A privilege escalation vulnerability in MaysWind ezBookkeeping 0.7.0 allows remote attackers to gain | |
| 829 | CVE-2024-39786 |
|
66.9th | 9.1 | This directory traversal vulnerability in Wavlink AC3000 routers allows authenticated attackers to b | |
| 830 | CVE-2024-57401 |
|
66.8th | 9.8 | A critical SQL injection vulnerability in Uniclare Student Portal versions 2 and earlier allows remo | |
| 831 | CVE-2024-9140 |
|
66.7th | 9.8 | CVE-2024-9140 is a critical OS command injection vulnerability in Moxa cellular routers, secure rout | |
| 832 | CVE-2023-48978 |
|
66.7th | 9.8 | This vulnerability allows remote attackers to execute arbitrary code on NCR ITM Web terminal systems | |
| 833 | CVE-2025-52352 |
|
66.7th | 9.8 | The Aikaan IoT management platform v3.25.0325-5-g2e9c59796 has a critical authentication bypass vuln | |
| 834 | CVE-2025-29913 |
|
66.7th | 9.8 | A critical heap buffer overflow vulnerability in CryptoLib versions 1.3.3 and prior allows attackers | |
| 835 | CVE-2025-29911 |
|
66.7th | 9.8 | A critical heap buffer overflow vulnerability in CryptoLib versions 1.3.3 and prior allows attackers | |
| 836 | CVE-2025-7444 |
|
66.6th | 9.8 | The LoginPress Pro WordPress plugin has an authentication bypass vulnerability that allows unauthent | |
| 837 | CVE-2025-30430 |
|
66.6th | 9.8 | This vulnerability allows password autofill to incorrectly populate passwords even after authenticat | |
| 838 | CVE-2025-62193 |
|
66.6th | 9.8 | This vulnerability allows remote, unauthenticated attackers to execute arbitrary operating system co | |
| 839 | CVE-2025-22900 |
|
66.5th | 9.8 | This vulnerability allows remote attackers to execute arbitrary code on Totolink N600R routers by ex | |
| 840 | CVE-2025-8359 |
|
66.5th | 9.8 | The AdForest WordPress theme contains an authentication bypass vulnerability that allows unauthentic | |
| 841 | CVE-2025-63228 |
|
66.5th | 9.8 | The Mozart FM Transmitter web management interface contains an unauthenticated file upload vulnerabi | |
| 842 | CVE-2024-55224 |
|
66.4th | 9.6 | An HTML injection vulnerability in Vaultwarden allows attackers to inject malicious HTML/JavaScript | |
| 843 | CVE-2025-34522 |
|
66.3th | 9.8 | A heap-based buffer overflow vulnerability in Arcserve Unified Data Protection (UDP) allows unauthen | |
| 844 | CVE-2025-10294 |
|
66.3th | 9.8 | The OwnID Passwordless Login plugin for WordPress has an authentication bypass vulnerability that al | |
| 845 | CVE-2025-9209 |
|
66.3th | 9.8 | This vulnerability allows unauthenticated attackers to bypass authentication in the RestroPress Word | |
| 846 | CVE-2025-6388 |
|
66.3th | 9.8 | The Spirit Framework WordPress plugin has an authentication bypass vulnerability that allows unauthe | |
| 847 | CVE-2024-13513 |
|
66.2th | 9.8 | The Oliver POS WordPress plugin exposes sensitive clientToken data through logging functionality, al | |
| 848 | CVE-2025-1020 |
|
66.2th | 9.8 | Memory safety vulnerabilities in Firefox and Thunderbird versions before 135 could allow attackers t | |
| 849 | CVE-2025-66647 |
|
66.3th | 9.8 | A buffer overflow vulnerability in RIOT OS's IPv6 fragmentation reassembly allows attackers to corru | |
| 850 | CVE-2023-54339 |
|
66.2th | 9.8 | CVE-2023-54339 is a remote command execution vulnerability in Webgrind 1.1 that allows unauthenticat |
What is EPSS?
The Exploit Prediction Scoring System (EPSS) is a data-driven model developed by FIRST.org that estimates the probability a CVE will be exploited in the wild within the next 30 days. Unlike CVSS which measures severity, EPSS measures likelihood of exploitation — making it ideal for prioritizing which vulnerabilities to patch first.
Why EPSS matters: With thousands of CVEs published monthly, not all vulnerabilities are equally dangerous. EPSS helps security teams focus on the CVEs most likely to be actively exploited, rather than patching solely by CVSS score. A critical CVSS 9.8 vulnerability with 0.1% EPSS may be less urgent than a high CVSS 7.5 with 90% EPSS.
Prioritize by Exploit Risk
Scan your servers and see which vulnerabilities have the highest EPSS scores. Focus on what attackers are actually targeting.
Start Monitoring Free