Most Exploitable CVEs - EPSS Rankings
CVEs ranked by EPSS (Exploit Prediction Scoring System) probability. Higher scores mean a greater likelihood of exploitation in the wild within the next 30 days.
164
EPSS > 50%
156
CISA KEV Listed
35,468
CVEs with EPSS
0.7%
Avg EPSS Score
| Rank | CVE ID | EPSS Score | Percentile | CVSS | Flags | Summary |
|---|---|---|---|---|---|---|
| 1451 | CVE-2025-39595 |
|
45.8th | 9.3 | This SQL injection vulnerability in Quentn WP WordPress plugin allows attackers to execute arbitrary | |
| 1452 | CVE-2025-39587 |
|
45.8th | 9.3 | This SQL injection vulnerability in the Stylemix Cost Calculator Builder WordPress plugin allows att | |
| 1453 | CVE-2025-32665 |
|
45.8th | 9.3 | This SQL injection vulnerability in the WebbyTemplate Office Locator WordPress plugin allows attacke | |
| 1454 | CVE-2025-32636 |
|
45.8th | 9.3 | This SQL injection vulnerability in the Local Magic WordPress plugin allows attackers to execute arb | |
| 1455 | CVE-2025-27302 |
|
45.8th | 9.3 | This SQL injection vulnerability in the CHATLIVE WordPress plugin allows attackers to execute arbitr | |
| 1456 | CVE-2025-22655 |
|
45.8th | 9.3 | This SQL injection vulnerability in the CWD β Stealth Links WordPress plugin allows attackers to e | |
| 1457 | CVE-2025-32603 |
|
45.8th | 9.3 | This SQL injection vulnerability in the WP Online Users Stats WordPress plugin allows attackers to e | |
| 1458 | CVE-2025-32565 |
|
45.8th | 9.3 | This SQL injection vulnerability in the Neon Product Designer WordPress plugin allows attackers to e | |
| 1459 | CVE-2025-31565 |
|
45.8th | 9.3 | This SQL injection vulnerability in the WPSmartContracts WordPress plugin allows attackers to execut | |
| 1460 | CVE-2025-31403 |
|
45.8th | 9.3 | This SQL injection vulnerability in the Shiptrack Booking Calendar and Notification WordPress plugin | |
| 1461 | CVE-2025-31911 |
|
45.8th | 9.3 | This SQL injection vulnerability in the WordPress Social Share And Social Locker plugin allows attac | |
| 1462 | CVE-2025-31579 |
|
45.8th | 9.3 | This SQL injection vulnerability in the WP AutoKeyword WordPress plugin allows attackers to execute | |
| 1463 | CVE-2025-31553 |
|
45.8th | 9.3 | This SQL injection vulnerability in the Advanced WooCommerce Product Sales Reporting WordPress plugi | |
| 1464 | CVE-2025-31551 |
|
45.8th | 9.3 | This SQL injection vulnerability in the Salesmate Add-On for Gravity Forms WordPress plugin allows a | |
| 1465 | CVE-2025-31531 |
|
45.8th | 9.3 | This SQL injection vulnerability in the History Log by click5 WordPress plugin allows attackers to e | |
| 1466 | CVE-2025-30807 |
|
45.8th | 9.3 | This SQL injection vulnerability in the Next-Cart Store to WooCommerce Migration WordPress plugin al | |
| 1467 | CVE-2025-30971 |
|
45.8th | 9.3 | This SQL injection vulnerability in the XV Random Quotes WordPress plugin allows attackers to execut | |
| 1468 | CVE-2025-30876 |
|
45.8th | 9.3 | This SQL injection vulnerability in the Ads by WPQuads WordPress plugin allows attackers to execute | |
| 1469 | CVE-2025-30622 |
|
45.8th | 9.3 | This SQL injection vulnerability in the PostMash WordPress plugin allows attackers to execute arbitr | |
| 1470 | CVE-2025-49840 |
|
45.7th | 9.8 | This vulnerability allows remote code execution through unsafe deserialization in GPT-SoVITS-WebUI. | |
| 1471 | CVE-2025-67744 |
|
45.8th | 9.6 | DeepChat versions before 0.5.3 contain a critical vulnerability where unsafe Mermaid diagram renderi | |
| 1472 | CVE-2025-30361 |
|
45.6th | 9.8 | This vulnerability allows unauthenticated attackers to reset any user's password without verifying t | |
| 1473 | CVE-2025-14535 |
|
45.6th | 9.8 | This is a critical buffer overflow vulnerability in UTT θΏε 512W routers that allows remote attac | |
| 1474 | CVE-2025-60021 |
|
45.7th | 9.8 | This CVE describes a remote command injection vulnerability in Apache bRPC's heap profiler service. | |
| 1475 | CVE-2025-23918 |
|
45.5th | 9.9 | CVE-2025-23918 is an arbitrary file upload vulnerability in the Smallerik File Browser WordPress plu | |
| 1476 | CVE-2025-22782 |
|
45.5th | 9.9 | This vulnerability allows attackers to upload malicious files to WordPress servers running the WR Pr | |
| 1477 | CVE-2025-27138 |
|
45.5th | 9.8 | This vulnerability allows attackers to bypass authentication in DataEase, potentially gaining unauth | |
| 1478 | CVE-2025-44033 |
|
45.5th | 9.8 | This SQL injection vulnerability in oa_system oasys v1.1 allows remote attackers to execute arbitrar | |
| 1479 | CVE-2025-59046 |
|
45.5th | 9.8 | CVE-2025-59046 is a command injection vulnerability in the interactive-git-checkout npm package that | |
| 1480 | CVE-2025-63624 |
|
45.4th | 9.8 | This SQL injection vulnerability in Shandong Kede Electronics' IoT smart water meter monitoring plat | |
| 1481 | CVE-2024-54542 |
|
45.2th | 9.1 | This CVE describes an authentication bypass vulnerability in Apple's Private Browsing feature across | |
| 1482 | CVE-2025-14878 |
|
45.3th | 9.8 | This vulnerability allows remote attackers to execute arbitrary code on Tenda WH450 routers by explo | |
| 1483 | CVE-2025-6553 |
|
45.2th | 9.8 | The Ovatheme Events Manager WordPress plugin allows unauthenticated attackers to upload arbitrary fi | |
| 1484 | CVE-2025-10726 |
|
45.2th | 9.1 | The WPRecovery WordPress plugin contains an unauthenticated SQL injection vulnerability that allows | |
| 1485 | CVE-2024-37361 |
|
45.1th | 9.9 | This vulnerability allows remote attackers to execute arbitrary code on Hitachi Vantara Pentaho Busi | |
| 1486 | CVE-2025-6260 |
|
45.1th | 9.8 | This vulnerability allows unauthenticated attackers to reset user credentials on affected thermostat | |
| 1487 | CVE-2025-52376 |
|
45.1th | 9.8 | This authentication bypass vulnerability in Nexxt Solutions NCM-X1800 Mesh Router firmware allows at | |
| 1488 | CVE-2025-9254 |
|
45th | 9.8 | CVE-2025-9254 is a critical authentication bypass vulnerability in WebITR software developed by Unio | |
| 1489 | CVE-2024-13996 |
|
45th | 9.8 | Nagios XI versions before 2024R1.1.3 fail to invalidate existing user sessions when passwords are ch | |
| 1490 | CVE-2026-23837 |
|
45th | 9.8 | CVE-2026-23837 is an authentication bypass vulnerability in MyTube that allows unauthenticated attac | |
| 1491 | CVE-2024-50698 |
|
44.9th | 9.8 | A heap-based buffer overflow vulnerability in SunGrow WiNet-SV200 MQTT message processing allows att | |
| 1492 | CVE-2026-21881 |
|
44.9th | 9.1 | This critical authentication bypass vulnerability in Kanboard allows attackers to impersonate any us | |
| 1493 | CVE-2024-10831 |
|
44.8th | 9.1 | This vulnerability allows attackers to upload arbitrary files to any location on the server by explo | |
| 1494 | CVE-2025-41656 |
|
44.9th | 10.0 | This critical vulnerability allows unauthenticated remote attackers to execute arbitrary commands wi | |
| 1495 | CVE-2025-54942 |
|
44.9th | 9.8 | This vulnerability allows remote attackers to access deployment functionality in SUNNET Corporate Tr | |
| 1496 | CVE-2025-11170 |
|
44.8th | 9.8 | The WP移θ‘ε°η¨γγ©γ°γ€γ³ for CPI WordPress plugin allows unauthenticated attackers to uploa | |
| 1497 | CVE-2025-12674 |
|
44.8th | 9.8 | The KiotViet Sync WordPress plugin allows unauthenticated attackers to upload arbitrary files to aff | |
| 1498 | CVE-2025-12682 |
|
44.8th | 9.8 | The Easy Upload Files During Checkout WordPress plugin allows unauthenticated attackers to upload ar | |
| 1499 | CVE-2025-66481 |
|
44.8th | 9.6 | DeepChat versions 0.5.1 and below are vulnerable to cross-site scripting (XSS) attacks through impro | |
| 1500 | CVE-2025-24650 |
|
44.7th | 9.1 | This vulnerability allows attackers to upload arbitrary files, including web shells, to WordPress se |
What is EPSS?
The Exploit Prediction Scoring System (EPSS) is a data-driven model developed by FIRST.org that estimates the probability a CVE will be exploited in the wild within the next 30 days. Unlike CVSS which measures severity, EPSS measures likelihood of exploitation β making it ideal for prioritizing which vulnerabilities to patch first.
Why EPSS matters: With thousands of CVEs published monthly, not all vulnerabilities are equally dangerous. EPSS helps security teams focus on the CVEs most likely to be actively exploited, rather than patching solely by CVSS score. A critical CVSS 9.8 vulnerability with 0.1% EPSS may be less urgent than a high CVSS 7.5 with 90% EPSS.
Prioritize by Exploit Risk
Scan your servers and see which vulnerabilities have the highest EPSS scores. Focus on what attackers are actually targeting.
Start Monitoring Free