Most Exploitable CVEs - EPSS Rankings
CVEs ranked by EPSS (Exploit Prediction Scoring System) probability. Higher scores mean a greater likelihood of exploitation in the wild within the next 30 days.
164
EPSS > 50%
156
CISA KEV Listed
35,468
CVEs with EPSS
0.7%
Avg EPSS Score
| Rank | CVE ID | EPSS Score | Percentile | CVSS | Flags | Summary |
|---|---|---|---|---|---|---|
| 9051 | CVE-2025-57896 |
|
11.1th | 5.3 | This CVE describes a Missing Authorization vulnerability in the Church Admin WordPress plugin that a | |
| 9052 | CVE-2025-48150 |
|
11.2th | 4.3 | This CVE describes a Missing Authorization vulnerability in the Bill Minozzi Real Estate Property 20 | |
| 9053 | CVE-2025-64758 |
|
11.2th | 4.8 | Dependency-Track versions 4.12.0 through 4.13.5 contain a stored cross-site scripting (XSS) vulnerab | |
| 9054 | CVE-2024-11502 |
|
11.2th | 5.4 | This vulnerability in the Planning Center Online Giving WordPress plugin allows authenticated users | |
| 9055 | CVE-2026-22044 |
|
11.2th | 6.5 | This vulnerability allows authenticated users in GLPI (an IT management software) to perform SQL inj | |
| 9056 | CVE-2025-35433 |
|
11.2th | 5.0 | CVE-2025-35433 is an authentication bypass vulnerability in CISA Thorium where previously used token | |
| 9057 | CVE-2025-35434 |
|
11th | 4.2 | CISA Thorium versions before 1.1.2 fail to validate TLS certificates when connecting to Elasticsearc | |
| 9058 | CVE-2022-49099 |
|
11th | 5.5 | This CVE addresses a DMA (Direct Memory Access) initialization vulnerability in the Linux kernel's H | |
| 9059 | CVE-2025-67743 |
|
11.2th | 6.3 | This CVE describes a Server-Side Request Forgery (SSRF) vulnerability in Local Deep Research's downl | |
| 9060 | CVE-2025-67641 |
|
11.2th | 5.4 | This stored XSS vulnerability in Jenkins Coverage Plugin allows attackers with Item/Configure permis | |
| 9061 | CVE-2026-24321 |
|
11.2th | 5.3 | SAP Commerce Cloud exposes sensitive API endpoints to unauthenticated users, allowing unauthorized a | |
| 9062 | CVE-2025-62407 |
|
11.3th | 6.1 | This CVE describes an open redirect vulnerability in Frappe web framework's login page. Attackers ca | |
| 9063 | CVE-2025-26058 |
|
11.2th | 4.2 | Webkul QloApps v1.6.1 exposes authentication tokens in URLs during redirection, allowing attackers t | |
| 9064 | CVE-2025-46365 |
|
11.3th | 5.3 | Dell CloudLink versions before 8.1.1 contain a command injection vulnerability that allows authentic | |
| 9065 | CVE-2025-11222 |
|
11.3th | 6.1 | Central Dogma versions before 0.78.0 contain an open redirect vulnerability that allows attackers to | |
| 9066 | CVE-2025-6726 |
|
11.2th | 4.3 | The Block Editor Gallery Slider WordPress plugin has an authorization vulnerability that allows auth | |
| 9067 | CVE-2025-6842 |
|
11.2th | 4.7 | This SQL injection vulnerability in code-projects Product Inventory System 1.0 allows attackers to m | |
| 9068 | CVE-2025-29525 |
|
11.2th | 5.3 | DASAN GPON ONU H660WM devices contain hardcoded default credentials in their control panel, allowing | |
| 9069 | CVE-2025-43704 |
|
11th | 4.7 | Arctera/Veritas Data Insight versions before 7.1.2 transmit credentials in cleartext when configured | |
| 9070 | CVE-2025-62157 |
|
11.3th | 6.5 | Argo Workflows versions before 3.6.12 and 3.7.0-3.7.2 expose artifact repository credentials in plai | |
| 9071 | CVE-2025-52459 |
|
11.1th | 6.5 | An argument injection vulnerability in Advantech iView's NetworkServlet.backupDatabase() function al | |
| 9072 | CVE-2025-12483 |
|
11.2th | 6.5 | This SQL injection vulnerability in the Visualizer WordPress plugin allows authenticated attackers w | |
| 9073 | CVE-2025-14792 |
|
11.2th | 4.4 | The Key Figures WordPress plugin has a stored XSS vulnerability that allows administrators to inject | |
| 9074 | CVE-2024-8982 |
|
11.3th | 6.2 | This Local File Inclusion vulnerability in OpenLLM 0.6.10 allows attackers to read sensitive server | |
| 9075 | CVE-2023-52925 |
|
11.1th | 5.5 | A race condition vulnerability in the Linux kernel's netfilter nf_tables subsystem allows duplicate | |
| 9076 | CVE-2024-52557 |
|
11th | 5.5 | This CVE addresses an integer overflow vulnerability in the Linux kernel's DisplayPort driver for Zy | |
| 9077 | CVE-2025-3951 |
|
11.1th | 4.1 | This SQL injection vulnerability in the WP-Optimize WordPress plugin allows administrators in multi- | |
| 9078 | CVE-2024-1539 |
|
11.2th | 4.3 | This vulnerability allows banned group members to access updates to issues via the GitLab API, poten | |
| 9079 | CVE-2025-6473 |
|
11.2th | 4.3 | This vulnerability allows attackers to inject malicious scripts into the School Fees Payment System | |
| 9080 | CVE-2023-23729 |
|
11.2th | 5.4 | This vulnerability allows users with Contributor-level access in WordPress to modify reCAPTCHA setti | |
| 9081 | CVE-2025-14888 |
|
11.2th | 4.4 | This stored XSS vulnerability in the Simple User Meta Editor WordPress plugin allows authenticated a | |
| 9082 | CVE-2025-68431 |
|
11.1th | 6.5 | CVE-2025-68431 is a heap buffer over-read vulnerability in libheif's overlay image processing. Attac | |
| 9083 | CVE-2025-58201 |
|
11.1th | 5.3 | This CVE describes a Missing Authorization vulnerability in the AfterShip Tracking WordPress plugin | |
| 9084 | CVE-2025-15000 |
|
11.2th | 4.4 | The Page Keys WordPress plugin has a stored cross-site scripting vulnerability that allows authentic | |
| 9085 | CVE-2025-6081 |
|
11.1th | 6.8 | This vulnerability allows attackers to reconfigure Konica Minolta bizhub 227 printers to use attacke | |
| 9086 | CVE-2025-59955 |
|
11.1th | 5.7 | Coolify versions up to v4.0.0-beta.420.8 have an API vulnerability that allows authenticated team me | |
| 9087 | CVE-2024-13870 |
|
11.1th | 5.7 | An unauthenticated attacker within WiFi range can downgrade Bitdefender Box 1 firmware to older vuln | |
| 9088 | CVE-2024-55402 |
|
11.2th | 5.3 | An access control vulnerability in 4C Strategies Exonaut allows unauthorized users to access restric | |
| 9089 | CVE-2025-54970 |
|
11.3th | 6.5 | An authentication bypass vulnerability in BAE SOCET GXP Job Status Service allows unauthorized users | |
| 9090 | CVE-2026-1061 |
|
11.1th | 6.3 | This vulnerability allows remote attackers to upload arbitrary files to xiweicheng TMS systems witho | |
| 9091 | CVE-2025-12569 |
|
11.3th | 4.7 | This vulnerability in the Guest posting WordPress plugin allows attackers to redirect users to malic | |
| 9092 | CVE-2023-53884 |
|
11.2th | 5.4 | Webedition CMS v2.9.8.8 contains a stored cross-site scripting vulnerability where authenticated use | |
| 9093 | CVE-2025-58603 |
|
11.1th | 5.3 | This CVE describes a missing authorization vulnerability in the Surfer SEO WordPress plugin that all | |
| 9094 | CVE-2026-1106 |
|
11.1th | 5.4 | This vulnerability in Chamilo LMS allows attackers to manipulate the userId parameter in the deleteL | |
| 9095 | CVE-2023-53030 |
|
11.1th | 5.5 | This CVE describes a kernel memory allocation vulnerability in the Linux kernel's octeontx2-pf netwo | |
| 9096 | CVE-2025-65670 |
|
11.3th | 4.3 | This IDOR vulnerability in classroomio 0.1.13 allows students to temporarily access admin/teacher en | |
| 9097 | CVE-2025-64375 |
|
11.2th | 6.5 | This CVE describes a Missing Authorization vulnerability in the WP Social Ninja WordPress plugin tha | |
| 9098 | CVE-2025-58613 |
|
11.2th | 5.3 | This CVE describes a missing authorization vulnerability in the Barn2 Plugins Posts Table with Searc | |
| 9099 | CVE-2022-49423 |
|
11th | 5.5 | This CVE describes a NULL pointer dereference vulnerability in the Linux kernel's rtla (Real-Time Li | |
| 9100 | CVE-2024-6718 |
|
11.2th | 5.4 | The PVN Auth Popup WordPress plugin through version 1.0.0 has a stored cross-site scripting (XSS) vu |
What is EPSS?
The Exploit Prediction Scoring System (EPSS) is a data-driven model developed by FIRST.org that estimates the probability a CVE will be exploited in the wild within the next 30 days. Unlike CVSS which measures severity, EPSS measures likelihood of exploitation — making it ideal for prioritizing which vulnerabilities to patch first.
Why EPSS matters: With thousands of CVEs published monthly, not all vulnerabilities are equally dangerous. EPSS helps security teams focus on the CVEs most likely to be actively exploited, rather than patching solely by CVSS score. A critical CVSS 9.8 vulnerability with 0.1% EPSS may be less urgent than a high CVSS 7.5 with 90% EPSS.
Prioritize by Exploit Risk
Scan your servers and see which vulnerabilities have the highest EPSS scores. Focus on what attackers are actually targeting.
Start Monitoring Free