Most Exploitable CVEs - EPSS Rankings
CVEs ranked by EPSS (Exploit Prediction Scoring System) probability. Higher scores mean a greater likelihood of exploitation in the wild within the next 30 days.
164
EPSS > 50%
156
CISA KEV Listed
35,468
CVEs with EPSS
0.7%
Avg EPSS Score
| Rank | CVE ID | EPSS Score | Percentile | CVSS | Flags | Summary |
|---|---|---|---|---|---|---|
| 8951 | CVE-2024-57971 |
|
31.2th | 9.1 | This vulnerability in Knowage Server allows attackers to perform JNDI injection attacks by manipulat | |
| 8952 | CVE-2024-36508 |
|
31.2th | 6.0 | This path traversal vulnerability in Fortinet FortiManager and FortiAnalyzer allows authenticated ad | |
| 8953 | CVE-2025-0630 |
|
31.1th | 6.5 | This vulnerability allows any authenticated user on affected Western Telematic (WTI) products to per | |
| 8954 | CVE-2024-56946 |
|
31.2th | 5.3 | This vulnerability in Technitium DNS Server allows remote attackers to cause a denial of service by | |
| 8955 | CVE-2024-11134 |
|
31.1th | 4.3 | The Eventer WordPress plugin has an authorization vulnerability that allows authenticated users with | |
| 8956 | CVE-2025-31076 |
|
31.2th | 4.9 | This Server-Side Request Forgery (SSRF) vulnerability in WP Compress for MainWP allows attackers to | |
| 8957 | CVE-2025-2686 |
|
31.2th | 6.5 | This CVE describes an improper access control vulnerability in the mingyuefusu library management sy | |
| 8958 | CVE-2025-30111 |
|
31.1th | 7.5 | This vulnerability allows unauthorized remote access to video footage and live streams from IROAD v9 | |
| 8959 | CVE-2025-2388 |
|
31.1th | 7.3 | CVE-2025-2388 is a critical authentication bypass vulnerability in Keytop's roadside parking fee col | |
| 8960 | CVE-2025-29768 |
|
31.2th | 4.4 | Vim versions before 9.1.1198 contain a vulnerability in zip.vim that could cause data loss when user | |
| 8961 | CVE-2025-0877 |
|
31.1th | 4.7 | This CVE describes a cross-site scripting (XSS) vulnerability in the AtaksAPP Reservation Management | |
| 8962 | CVE-2025-25634 |
|
31.2th | 6.5 | A stack-based buffer overflow vulnerability exists in Tenda AC15 routers version 15.03.05.19. Attack | |
| 8963 | CVE-2024-8261 |
|
31.2th | 7.5 | CVE-2024-8261 is an authorization bypass vulnerability in Proliz Software OBS that allows attackers | |
| 8964 | CVE-2025-4091 |
|
31.1th | 8.1 | This CVE describes memory safety bugs in Mozilla Firefox and Thunderbird that could lead to memory c | |
| 8965 | CVE-2025-4087 |
|
31.1th | 4.8 | This vulnerability in Thunderbird and Firefox allows attackers to trigger undefined behavior through | |
| 8966 | CVE-2025-4036 |
|
31.1th | 6.3 | This CVE describes an authorization bypass vulnerability in Novel 3.5.0 that allows attackers to rem | |
| 8967 | CVE-2025-31344 |
|
31.2th | 7.3 | A heap-based buffer overflow vulnerability in giflib's gif2rgb utility allows attackers to execute a | |
| 8968 | CVE-2025-32691 |
|
31.2th | 4.9 | This Server-Side Request Forgery (SSRF) vulnerability in the PowerPress Podcasting WordPress plugin | |
| 8969 | CVE-2025-32487 |
|
31.2th | 4.9 | This Server-Side Request Forgery (SSRF) vulnerability in the Waymark WordPress plugin allows attacke | |
| 8970 | CVE-2024-57338 |
|
31.1th | 6.5 | This vulnerability allows attackers to upload malicious files to M2Soft CROWNIX Report & ERS systems | |
| 8971 | CVE-2024-51444 |
|
31.2th | 6.5 | This SQL injection vulnerability in Siemens Polarion allows authenticated remote attackers to bypass | |
| 8972 | CVE-2025-28200 |
|
31.1th | 9.8 | The Victure RX1800 router uses a weak default password derived from the last 8 digits of its MAC add | |
| 8973 | CVE-2025-3091 |
|
31.1th | 7.5 | This authentication bypass vulnerability allows a low-privileged remote attacker who possesses anoth | |
| 8974 | CVE-2025-52520 |
|
31.2th | 7.5 | An integer overflow vulnerability in Apache Tomcat's multipart upload handling allows attackers to b | |
| 8975 | CVE-2025-3264 |
|
31.1th | 5.3 | A Regular Expression Denial of Service (ReDoS) vulnerability in Hugging Face Transformers library al | |
| 8976 | CVE-2025-53805 |
|
31.2th | 7.5 | This vulnerability allows an unauthorized attacker to trigger an out-of-bounds read in Windows Inter | |
| 8977 | CVE-2025-6542 |
|
31.2th | 9.8 | This critical vulnerability (CVE-2025-6542) allows remote unauthenticated attackers to execute arbit | |
| 8978 | CVE-2025-51663 |
|
31.1th | 7.5 | This vulnerability allows remote attackers to bypass IP-based rate limiting in FileCodeBox by spoofi | |
| 8979 | CVE-2025-37158 |
|
31.1th | 6.7 | A command injection vulnerability in the AOS-CX Operating System allows authenticated remote attacke | |
| 8980 | CVE-2025-37157 |
|
31.1th | 6.7 | A command injection vulnerability in AOS-CX Operating System allows authenticated remote attackers t | |
| 8981 | CVE-2025-12865 |
|
31.1th | 8.8 | U-Office Force software by e-Excellence contains a SQL injection vulnerability that allows authentic | |
| 8982 | CVE-2025-12864 |
|
31.1th | 8.8 | U-Office Force software has a SQL injection vulnerability that allows authenticated attackers to exe | |
| 8983 | CVE-2025-12177 |
|
31.1th | 5.3 | The Download Manager WordPress plugin contains a hardcoded cron key vulnerability that allows unauth | |
| 8984 | CVE-2025-12908 |
|
31.1th | 5.4 | This vulnerability allows attackers to spoof domains in Chrome for Android downloads by tricking use | |
| 8985 | CVE-2025-12350 |
|
31.1th | 5.3 | The DominoKit WordPress plugin has an authentication bypass vulnerability that allows unauthenticate | |
| 8986 | CVE-2021-47730 |
|
31.1th | 8.8 | Selea Targa IP OCR-ANPR cameras contain a CSRF vulnerability that allows attackers to create adminis | |
| 8987 | CVE-2025-10304 |
|
31.1th | 5.3 | The Everest Backup WordPress plugin has an authentication bypass vulnerability that allows unauthent | |
| 8988 | CVE-2025-67090 |
|
31.1th | 5.1 | The LuCI web interface on GL.Inet AX1800 routers lacks rate limiting or account lockout mechanisms o | |
| 8989 | CVE-2024-30547 |
|
31.1th | 7.1 | This vulnerability allows attackers to inject malicious scripts into web pages generated by the Head | |
| 8990 | CVE-2024-13380 |
|
30.9th | 6.4 | This stored XSS vulnerability in the Alex Reservations WordPress plugin allows authenticated attacke | |
| 8991 | CVE-2025-24683 |
|
31th | 7.6 | This SQL injection vulnerability in the WPChill RSVP and Event Management WordPress plugin allows at | |
| 8992 | CVE-2025-24663 |
|
31th | 7.6 | This SQL injection vulnerability in Simple Download Monitor WordPress plugin allows attackers to exe | |
| 8993 | CVE-2025-23784 |
|
31th | 7.6 | This SQL injection vulnerability in the Contact Form 7 Round Robin Lead Distribution WordPress plugi | |
| 8994 | CVE-2025-0369 |
|
30.9th | 6.4 | The JetEngine WordPress plugin has a stored XSS vulnerability in the 'list_tag' parameter that allow | |
| 8995 | CVE-2025-23780 |
|
31th | 7.6 | This SQL injection vulnerability in the Easy Code Snippets WordPress plugin allows attackers to exec | |
| 8996 | CVE-2025-22787 |
|
31th | 4.3 | This CVE describes a missing authorization vulnerability in the Button Block WordPress plugin that a | |
| 8997 | CVE-2024-47566 |
|
31th | 5.1 | This path traversal vulnerability in Fortinet FortiRecorder allows privileged attackers to delete ar | |
| 8998 | CVE-2024-13156 |
|
31th | 6.4 | This vulnerability allows authenticated WordPress users with Contributor-level access or higher to i | |
| 8999 | CVE-2024-47519 |
|
31.1th | 8.3 | CVE-2024-47519 is a man-in-the-middle vulnerability in Arista's ETM backup upload functionality that | |
| 9000 | CVE-2025-22527 |
|
31th | 7.6 | This SQL injection vulnerability in the Yamna Khawaja Mailing Group Listserv WordPress plugin allows |
What is EPSS?
The Exploit Prediction Scoring System (EPSS) is a data-driven model developed by FIRST.org that estimates the probability a CVE will be exploited in the wild within the next 30 days. Unlike CVSS which measures severity, EPSS measures likelihood of exploitation — making it ideal for prioritizing which vulnerabilities to patch first.
Why EPSS matters: With thousands of CVEs published monthly, not all vulnerabilities are equally dangerous. EPSS helps security teams focus on the CVEs most likely to be actively exploited, rather than patching solely by CVSS score. A critical CVSS 9.8 vulnerability with 0.1% EPSS may be less urgent than a high CVSS 7.5 with 90% EPSS.
Prioritize by Exploit Risk
Scan your servers and see which vulnerabilities have the highest EPSS scores. Focus on what attackers are actually targeting.
Start Monitoring Free