Most Exploitable CVEs - EPSS Rankings
CVEs ranked by EPSS (Exploit Prediction Scoring System) probability. Higher scores mean a greater likelihood of exploitation in the wild within the next 30 days.
164
EPSS > 50%
156
CISA KEV Listed
35,468
CVEs with EPSS
0.7%
Avg EPSS Score
| Rank | CVE ID | EPSS Score | Percentile | CVSS | Flags | Summary |
|---|---|---|---|---|---|---|
| 9451 | CVE-2025-1991 |
|
30th | 7.5 | IBM Informix Dynamic Server contains an integer underflow vulnerability when processing network pack | |
| 9452 | CVE-2019-25337 |
|
29.9th | 9.8 | CVE-2019-25337 is a username enumeration vulnerability in ownCloud that allows remote attackers to d | |
| 9453 | CVE-2025-6373 |
|
29.9th | 8.8 | A critical stack-based buffer overflow vulnerability in D-Link DIR-619L routers allows remote attack | |
| 9454 | CVE-2025-7862 |
|
29.9th | 7.3 | This critical vulnerability in TOTOLINK T6 routers allows remote attackers to enable Telnet service | |
| 9455 | CVE-2024-56468 |
|
29.8th | 7.5 | This vulnerability in IBM InfoSphere Data Replication VSAM for z/OS allows remote attackers to cause | |
| 9456 | CVE-2025-42980 |
|
29.9th | 9.1 | SAP NetWeaver Enterprise Portal Federated Portal Network has a deserialization vulnerability where p | |
| 9457 | CVE-2025-37098 |
|
29.9th | 7.5 | A path traversal vulnerability in HPE Insight Remote Support (IRS) allows attackers to access files | |
| 9458 | CVE-2025-9745 |
|
29.9th | 4.7 | This CVE describes an OS command injection vulnerability in D-Link DI-500WF routers that allows remo | |
| 9459 | CVE-2025-43766 |
|
29.8th | 9.8 | This vulnerability allows attackers to upload unrestricted files through Liferay's style books compo | |
| 9460 | CVE-2025-33090 |
|
29.8th | 7.5 | CVE-2025-33090 is a denial-of-service vulnerability in IBM Concert Software where a remote attacker | |
| 9461 | CVE-2025-24999 |
|
29.9th | 8.8 | This vulnerability allows an authenticated attacker with existing SQL Server access to elevate privi | |
| 9462 | CVE-2025-23323 |
|
29.8th | 7.5 | NVIDIA Triton Inference Server contains an integer overflow vulnerability where sending an invalid r | |
| 9463 | CVE-2025-23321 |
|
29.8th | 7.5 | NVIDIA Triton Inference Server contains a divide-by-zero vulnerability in request processing that co | |
| 9464 | CVE-2025-42920 |
|
29.9th | 6.1 | This Cross-Site Scripting (XSS) vulnerability in SAP Supplier Relationship Management allows unauthe | |
| 9465 | CVE-2025-63298 |
|
29.8th | 8.2 | An authenticated admin user in SourceCodester Pet Grooming Management System 1.0 can exploit a path | |
| 9466 | CVE-2025-61488 |
|
29.9th | 7.6 | A remote code execution vulnerability in SLiMS 9 Bulian allows attackers to execute arbitrary code v | |
| 9467 | CVE-2025-55100 |
|
29.9th | 9.1 | This vulnerability allows attackers to read memory beyond allocated boundaries in USBX's audio class | |
| 9468 | CVE-2025-30276 |
|
29.9th | 8.8 | An out-of-bounds write vulnerability in Qsync Central allows authenticated remote attackers to modif | |
| 9469 | CVE-2025-37148 |
|
30th | 6.5 | An unauthenticated remote attacker can send specially crafted ethernet frames to vulnerable ArubaOS | |
| 9470 | CVE-2025-37137 |
|
29.8th | 6.5 | This vulnerability allows authenticated remote attackers to delete arbitrary files on Aruba AOS-8 Co | |
| 9471 | CVE-2025-37136 |
|
29.8th | 6.5 | This vulnerability allows authenticated remote attackers to delete arbitrary files on Aruba AOS-8 Co | |
| 9472 | CVE-2025-43912 |
|
29.9th | 5.3 | A heap-based buffer overflow vulnerability in Dell PowerProtect Data Domain with DD OS allows unauth | |
| 9473 | CVE-2025-13258 |
|
29.8th | 8.8 | A buffer overflow vulnerability in Tenda AC20 routers allows remote attackers to execute arbitrary c | |
| 9474 | CVE-2024-11920 |
|
29.8th | 4.3 | This vulnerability in Google Chrome's Dawn component on macOS allows attackers to trigger out-of-bou | |
| 9475 | CVE-2025-64406 |
|
30th | 4.3 | An out-of-bounds write vulnerability in Apache OpenOffice allows attackers to craft malicious docume | |
| 9476 | CVE-2025-47286 |
|
29.9th | 7.2 | This vulnerability allows administrators in Combodo iTop to execute arbitrary code on the server by | |
| 9477 | CVE-2025-15135 |
|
29.9th | 6.3 | This vulnerability allows remote attackers to bypass authentication in joey-zhou xiaozhi-esp32-serve | |
| 9478 | CVE-2023-52210 |
|
29.8th | 5.3 | This vulnerability allows attackers to bypass intended access controls in the Product Delivery Date | |
| 9479 | CVE-2025-68144 |
|
29.8th | N/A | This vulnerability in mcp-server-git allows attackers to pass malicious arguments that get interpret | |
| 9480 | CVE-2025-66449 |
|
30th | 8.8 | CVE-2025-66449 is an arbitrary file write vulnerability in ConvertX, a self-hosted online file conve | |
| 9481 | CVE-2025-14182 |
|
29.8th | 6.3 | This CVE describes a path traversal vulnerability in Sobey Media Convergence System versions 2.0 and | |
| 9482 | CVE-2025-12026 |
|
30th | 7.2 | An authenticated privileged user can execute arbitrary code on WatchGuard Fireware OS devices by exp | |
| 9483 | CVE-2025-29846 |
|
30th | 7.2 | This vulnerability in Synology's portenable CGI allows authenticated remote users to query the statu | |
| 9484 | CVE-2025-27821 |
|
29.9th | 7.3 | This CVE describes an out-of-bounds write vulnerability in Apache Hadoop HDFS native client that cou | |
| 9485 | CVE-2026-23852 |
|
29.9th | 9.6 | SiYuan personal knowledge management systems before version 3.5.4 have a stored XSS vulnerability in | |
| 9486 | CVE-2024-13470 |
|
29.8th | 6.4 | This vulnerability allows authenticated WordPress users with contributor-level access or higher to i | |
| 9487 | CVE-2024-41140 |
|
29.8th | 8.1 | This vulnerability allows attackers with existing user accounts to escalate privileges by exploiting | |
| 9488 | CVE-2024-10552 |
|
29.7th | 6.4 | This stored XSS vulnerability in the Flexmls IDX WordPress plugin allows authenticated attackers wit | |
| 9489 | CVE-2025-0699 |
|
29.7th | 6.3 | This CVE describes a critical SQL injection vulnerability in JoeyBling bootplus software affecting t | |
| 9490 | CVE-2024-45077 |
|
29.7th | 6.5 | This vulnerability allows authenticated low-privileged users to upload restricted file types to IBM | |
| 9491 | CVE-2024-11226 |
|
29.7th | 6.4 | The FireCask Like & Share Button plugin for WordPress has a stored XSS vulnerability in the 'width' | |
| 9492 | CVE-2024-10630 |
|
29.8th | 7.8 | A race condition vulnerability in Ivanti Application Control Engine allows authenticated local attac | |
| 9493 | CVE-2023-42244 |
|
29.7th | 8.8 | This vulnerability allows authenticated attackers to perform SQL injection attacks through multiple | |
| 9494 | CVE-2024-55494 |
|
29.7th | 6.1 | This vulnerability allows attackers to inject malicious PHP code through the op_func parameter in Op | |
| 9495 | CVE-2024-55076 |
|
29.7th | 8.1 | Grocy versions through 4.3.0 lack Cross-Site Request Forgery (CSRF) protection, allowing attackers t | |
| 9496 | CVE-2025-27098 |
|
29.7th | 5.8 | GraphQL Mesh has a path traversal vulnerability in its static file handler that allows attackers to | |
| 9497 | CVE-2024-44336 |
|
29.7th | 5.3 | This vulnerability in AnkiDroid allows attackers to access and copy internal application files from | |
| 9498 | CVE-2025-1173 |
|
29.7th | 4.7 | This critical SQL injection vulnerability in 1000 Projects Bookstore Management System 1.0 allows re | |
| 9499 | CVE-2025-0939 |
|
29.7th | 6.3 | The MagicForm WordPress plugin has an authorization vulnerability that allows authenticated users wi | |
| 9500 | CVE-2025-2684 |
|
29.7th | 7.3 | This critical SQL injection vulnerability in PHPGurukul Bank Locker Management System 1.0 allows rem |
What is EPSS?
The Exploit Prediction Scoring System (EPSS) is a data-driven model developed by FIRST.org that estimates the probability a CVE will be exploited in the wild within the next 30 days. Unlike CVSS which measures severity, EPSS measures likelihood of exploitation — making it ideal for prioritizing which vulnerabilities to patch first.
Why EPSS matters: With thousands of CVEs published monthly, not all vulnerabilities are equally dangerous. EPSS helps security teams focus on the CVEs most likely to be actively exploited, rather than patching solely by CVSS score. A critical CVSS 9.8 vulnerability with 0.1% EPSS may be less urgent than a high CVSS 7.5 with 90% EPSS.
Prioritize by Exploit Risk
Scan your servers and see which vulnerabilities have the highest EPSS scores. Focus on what attackers are actually targeting.
Start Monitoring Free