Most Exploitable CVEs - EPSS Rankings
CVEs ranked by EPSS (Exploit Prediction Scoring System) probability. Higher scores mean a greater likelihood of exploitation in the wild within the next 30 days.
164
EPSS > 50%
156
CISA KEV Listed
35,468
CVEs with EPSS
0.7%
Avg EPSS Score
| Rank | CVE ID | EPSS Score | Percentile | CVSS | Flags | Summary |
|---|---|---|---|---|---|---|
| 9301 | CVE-2024-58124 |
|
30.4th | 8.4 | This CVE describes an access control vulnerability in Huawei's security verification module that all | |
| 9302 | CVE-2025-21459 |
|
30.4th | 7.5 | This vulnerability allows attackers to cause a Denial of Service (DoS) condition by sending speciall | |
| 9303 | CVE-2025-48988 |
|
30.3th | 7.5 | This CVE describes an allocation of resources without limits or throttling vulnerability in Apache T | |
| 9304 | CVE-2025-5996 |
|
30.3th | 6.5 | This vulnerability in GitLab CE/EE allows authenticated users to cause denial of service through imp | |
| 9305 | CVE-2025-5544 |
|
30.4th | 4.3 | This CVE describes a path traversal vulnerability in the aaluoxiang oa_system that allows attackers | |
| 9306 | CVE-2025-43253 |
|
30.3th | 9.8 | This vulnerability allows malicious applications to bypass security restrictions and execute arbitra | |
| 9307 | CVE-2025-31281 |
|
30.3th | 9.1 | This CVE describes an input validation vulnerability in Apple operating systems that allows maliciou | |
| 9308 | CVE-2025-24003 |
|
30.4th | 8.2 | An unauthenticated remote attacker can send malicious MQTT messages to trigger buffer overflow vulne | |
| 9309 | CVE-2025-34203 |
|
30.3th | 9.8 | Vasion Print (formerly PrinterLogic) contains outdated, end-of-life third-party components across mu | |
| 9310 | CVE-2025-40797 |
|
30.4th | 7.5 | An out-of-bounds read vulnerability in the User Management Component (UMC) of SIMATIC PCS neo indust | |
| 9311 | CVE-2025-54964 |
|
30.3th | 8.4 | This vulnerability in BAE SOCET GXP allows attackers to inject arbitrary executables through the GXP | |
| 9312 | CVE-2025-45095 |
|
30.4th | 7.3 | Lavasoft Web Companion (Ad-Aware WebCompanion) versions 8.9.0.1091 through 12.1.3.1037 have an unquo | |
| 9313 | CVE-2025-66031 |
|
30.3th | 7.5 | An uncontrolled recursion vulnerability in node-forge versions 1.3.1 and below allows remote attacke | |
| 9314 | CVE-2025-15356 |
|
30.3th | 8.8 | A buffer overflow vulnerability in Tenda AC20 routers allows remote attackers to execute arbitrary c | |
| 9315 | CVE-2026-1329 |
|
30.3th | 8.8 | A stack-based buffer overflow vulnerability in Tenda AX1803 routers allows remote attackers to execu | |
| 9316 | CVE-2026-23944 |
|
30.3th | 9.8 | CVE-2026-23944 is an authentication bypass vulnerability in Arcane Docker management interface that | |
| 9317 | CVE-2026-22046 |
|
30.4th | 8.8 | A heap-buffer-overflow vulnerability in iccDEV's CIccProfileXml::ParseBasic() function allows attack | |
| 9318 | CVE-2026-21683 |
|
30.4th | 8.8 | A type confusion vulnerability in iccDEV's CIccEvalCompare::EvaluateProfile() function allows attack | |
| 9319 | CVE-2025-23486 |
|
30.1th | 6.5 | This CVE describes a Missing Authorization vulnerability in the NotFound Database Sync WordPress plu | |
| 9320 | CVE-2024-47113 |
|
30.2th | 8.1 | This XML injection vulnerability in IBM ICP - Voice Gateway allows remote attackers to send speciall | |
| 9321 | CVE-2025-0159 |
|
30.2th | 9.1 | This vulnerability allows remote attackers to bypass authentication on IBM FlashSystem RPCAdapter en | |
| 9322 | CVE-2025-1642 |
|
30.2th | 4.3 | This vulnerability in Benner ModernaNet allows attackers to manipulate resource identifiers via the | |
| 9323 | CVE-2025-0997 |
|
30.2th | 8.1 | This is a use-after-free vulnerability in Google Chrome's navigation component that allows remote at | |
| 9324 | CVE-2024-9601 |
|
30.3th | 6.5 | The Qubely WordPress plugin has a stored XSS vulnerability that allows authenticated attackers with | |
| 9325 | CVE-2025-23363 |
|
30.2th | 7.4 | This CVE describes an open redirect vulnerability in Siemens Teamcenter's SSO login service across m | |
| 9326 | CVE-2025-0064 |
|
30.2th | 8.7 | This vulnerability in SAP BusinessObjects Business Intelligence platform allows administrators to ge | |
| 9327 | CVE-2025-23763 |
|
30.1th | 6.5 | This CVE describes a Missing Authorization vulnerability in the WAH Forms WordPress plugin that allo | |
| 9328 | CVE-2025-46331 |
|
30.2th | 9.8 | OpenFGA versions 1.3.6 through 1.8.10 contain an authorization bypass vulnerability in Check and Lis | |
| 9329 | CVE-2025-32958 |
|
30.2th | 9.8 | This vulnerability in Adept programming language's GitHub workflow exposes the GITHUB_TOKEN in uploa | |
| 9330 | CVE-2025-41649 |
|
30.3th | 7.5 | An unauthenticated remote attacker can exploit insufficient input validation to write data beyond bu | |
| 9331 | CVE-2024-13931 |
|
30.2th | 7.2 | This CVE describes a relative path traversal vulnerability in ABB's ASPECT software that allows atta | |
| 9332 | CVE-2025-26783 |
|
30.2th | 7.5 | A vulnerability in Samsung's RRC (Radio Resource Control) implementation across multiple Exynos proc | |
| 9333 | CVE-2024-6648 |
|
30.2th | 7.5 | An unauthenticated remote attacker can exploit this absolute path traversal vulnerability in AP Page | |
| 9334 | CVE-2025-20182 |
|
30.3th | 8.6 | An unauthenticated remote attacker can cause affected Cisco network devices to crash and reload by s | |
| 9335 | CVE-2025-3221 |
|
30.2th | 7.5 | IBM InfoSphere Information Server versions 11.7.0.0 through 11.7.1.6 contain a resource exhaustion v | |
| 9336 | CVE-2025-50489 |
|
30.1th | 7.5 | This vulnerability allows attackers to hijack user sessions in PHPGurukul Student Result Management | |
| 9337 | CVE-2025-50490 |
|
30.1th | 7.5 | This vulnerability allows attackers to hijack user sessions in PHPGurukul Student Result Management | |
| 9338 | CVE-2025-6720 |
|
30.2th | 5.3 | The Vchasno Kasa WordPress plugin has an unauthenticated data deletion vulnerability that allows att | |
| 9339 | CVE-2025-5811 |
|
30.2th | 5.3 | The Listly WordPress plugin has an authentication bypass vulnerability that allows unauthenticated a | |
| 9340 | CVE-2025-2800 |
|
30.2th | 7.2 | This stored XSS vulnerability in the WP Event Manager plugin allows unauthenticated attackers to inj | |
| 9341 | CVE-2025-3262 |
|
30.2th | 7.5 | A Regular Expression Denial of Service (ReDoS) vulnerability in huggingface/transformers allows atta | |
| 9342 | CVE-2025-4609 |
|
30.2th | 9.6 | This vulnerability in Google Chrome's Mojo IPC system on Windows allows a remote attacker to escape | |
| 9343 | CVE-2025-5115 |
|
30.2th | 7.5 | This vulnerability in Eclipse Jetty allows HTTP/2 clients to trigger resource exhaustion attacks by | |
| 9344 | CVE-2025-6625 |
|
30.1th | 7.5 | An improper input validation vulnerability in Schneider Electric devices allows attackers to cause d | |
| 9345 | CVE-2025-11100 |
|
30.2th | 6.3 | This vulnerability allows remote attackers to execute arbitrary commands on D-Link DIR-823X routers | |
| 9346 | CVE-2025-11099 |
|
30.2th | 6.3 | This vulnerability allows remote attackers to execute arbitrary commands on D-Link DIR-823X routers | |
| 9347 | CVE-2025-11098 |
|
30.2th | 6.3 | This CVE describes a command injection vulnerability in D-Link DIR-823X routers that allows remote a | |
| 9348 | CVE-2025-11097 |
|
30.2th | 6.3 | This vulnerability allows remote attackers to execute arbitrary commands on D-Link DIR-823X routers | |
| 9349 | CVE-2025-11096 |
|
30.2th | 6.3 | This CVE describes a command injection vulnerability in D-Link DIR-823X routers that allows remote a | |
| 9350 | CVE-2025-35435 |
|
30.2th | 4.3 | CVE-2025-35435 is a division-by-zero vulnerability in CISA Thorium that allows authenticated remote |
What is EPSS?
The Exploit Prediction Scoring System (EPSS) is a data-driven model developed by FIRST.org that estimates the probability a CVE will be exploited in the wild within the next 30 days. Unlike CVSS which measures severity, EPSS measures likelihood of exploitation — making it ideal for prioritizing which vulnerabilities to patch first.
Why EPSS matters: With thousands of CVEs published monthly, not all vulnerabilities are equally dangerous. EPSS helps security teams focus on the CVEs most likely to be actively exploited, rather than patching solely by CVSS score. A critical CVSS 9.8 vulnerability with 0.1% EPSS may be less urgent than a high CVSS 7.5 with 90% EPSS.
Prioritize by Exploit Risk
Scan your servers and see which vulnerabilities have the highest EPSS scores. Focus on what attackers are actually targeting.
Start Monitoring Free