Most Exploitable CVEs - EPSS Rankings
CVEs ranked by EPSS (Exploit Prediction Scoring System) probability. Higher scores mean a greater likelihood of exploitation in the wild within the next 30 days.
164
EPSS > 50%
156
CISA KEV Listed
35,468
CVEs with EPSS
0.7%
Avg EPSS Score
| Rank | CVE ID | EPSS Score | Percentile | CVSS | Flags | Summary |
|---|---|---|---|---|---|---|
| 1951 | CVE-2025-15010 |
|
33.9th | 9.8 | A stack-based buffer overflow vulnerability exists in Tenda WH450 routers version 1.0.0.18, specific | |
| 1952 | CVE-2025-15007 |
|
33.9th | 9.8 | A stack-based buffer overflow vulnerability in Tenda WH450 routers allows remote attackers to execut | |
| 1953 | CVE-2025-15006 |
|
33.9th | 9.8 | This vulnerability allows remote attackers to execute arbitrary code on Tenda WH450 routers by explo | |
| 1954 | CVE-2025-14665 |
|
33.9th | 9.8 | A remote stack-based buffer overflow vulnerability in Tenda WH450 routers allows attackers to execut | |
| 1955 | CVE-2025-63535 |
|
33.9th | 9.6 | This SQL injection vulnerability in Blood Bank Management System 1.0 allows attackers to inject mali | |
| 1956 | CVE-2025-63532 |
|
33.9th | 9.6 | A SQL injection vulnerability in Blood Bank Management System 1.0 allows attackers to inject malicio | |
| 1957 | CVE-2025-29980 |
|
33.7th | 9.8 | A critical SQL injection vulnerability in eTRAKiT.net release 3.2.1.77 allows remote unauthenticated | |
| 1958 | CVE-2025-47945 |
|
33.7th | 9.1 | CVE-2025-47945 is a critical authentication bypass vulnerability in Donetick task management softwar | |
| 1959 | CVE-2025-14301 |
|
33.6th | 9.8 | This vulnerability in the Integration Opvius AI for WooCommerce WordPress plugin allows unauthentica | |
| 1960 | CVE-2025-32966 |
|
33.5th | 9.8 | DataEase versions before 2.10.8 contain a vulnerability where authenticated users can achieve remote | |
| 1961 | CVE-2025-43261 |
|
33.5th | 9.8 | This CVE describes a sandbox escape vulnerability in macOS that allows malicious applications to bre | |
| 1962 | CVE-2025-69269 |
|
33.5th | 9.8 | This OS command injection vulnerability in Broadcom DX NetOps Spectrum allows attackers to execute a | |
| 1963 | CVE-2025-1283 |
|
33.4th | 9.8 | This vulnerability allows attackers to bypass authentication on Dingtian DT-R0 Series devices by dir | |
| 1964 | CVE-2025-49885 |
|
33.4th | 10.0 | This vulnerability allows unauthenticated attackers to upload arbitrary files, including web shells, | |
| 1965 | CVE-2025-59272 |
|
33.4th | 9.3 | This command injection vulnerability in Copilot allows unauthorized local attackers to execute arbit | |
| 1966 | CVE-2025-59252 |
|
33.4th | 9.3 | This command injection vulnerability in Copilot allows unauthorized attackers to execute arbitrary c | |
| 1967 | CVE-2023-53966 |
|
33.4th | 9.8 | CVE-2023-53966 is a format string vulnerability in SOUND4 LinkAndShare Transmitter 1.1.2 that allows | |
| 1968 | CVE-2025-48336 |
|
33.2th | 9.8 | A deserialization vulnerability in ThimPress Course Builder WordPress theme allows attackers to inje | |
| 1969 | CVE-2025-47568 |
|
33.2th | 9.8 | This CVE describes a PHP object injection vulnerability in the ZoomSounds WordPress plugin that allo | |
| 1970 | CVE-2025-47530 |
|
33.2th | 9.8 | This vulnerability allows attackers to inject malicious PHP objects through deserialization of untru | |
| 1971 | CVE-2025-39503 |
|
33.2th | 9.8 | This vulnerability allows remote attackers to execute arbitrary code via PHP object injection throug | |
| 1972 | CVE-2025-39500 |
|
33.2th | 9.8 | This vulnerability allows remote attackers to execute arbitrary code through PHP object injection vi | |
| 1973 | CVE-2025-39495 |
|
33.2th | 9.8 | A PHP object injection vulnerability in the BoldThemes Avantage WordPress theme allows attackers to | |
| 1974 | CVE-2025-39480 |
|
33.2th | 9.8 | This vulnerability allows attackers to execute arbitrary code on WordPress sites using the Car Deale | |
| 1975 | CVE-2025-32292 |
|
33.2th | 9.8 | This vulnerability allows remote attackers to execute arbitrary code on WordPress sites using the Ja | |
| 1976 | CVE-2025-31927 |
|
33.2th | 9.8 | CVE-2025-31927 is a PHP object injection vulnerability in the Acerola WordPress theme that allows at | |
| 1977 | CVE-2025-31631 |
|
33.2th | 9.8 | This CVE describes a PHP object injection vulnerability in the Fish House WordPress theme due to ins | |
| 1978 | CVE-2025-31423 |
|
33.2th | 9.8 | CVE-2025-31423 is a PHP object injection vulnerability in the Umberto WordPress theme that allows at | |
| 1979 | CVE-2025-31069 |
|
33.2th | 9.8 | This vulnerability allows attackers to inject malicious objects through deserialization of untrusted | |
| 1980 | CVE-2025-31049 |
|
33.2th | 9.8 | CVE-2025-31049 is a PHP object injection vulnerability in the Dash WordPress theme that allows attac | |
| 1981 | CVE-2025-24977 |
|
33.2th | 9.1 | OpenCTI versions before 6.4.11 contain a critical vulnerability where users with 'manage customizati | |
| 1982 | CVE-2026-1358 |
|
33.1th | 9.8 | Airleader Master versions 6.381 and prior have unrestricted file upload functionality on multiple we | |
| 1983 | CVE-2025-12762 |
|
33.3th | 9.1 | pgAdmin versions up to 9.9 running in server mode are vulnerable to remote code execution when proce | |
| 1984 | CVE-2025-25948 |
|
33th | 9.1 | This vulnerability allows unauthenticated attackers to create and modify user accounts, including Ad | |
| 1985 | CVE-2025-46066 |
|
33.1th | 9.9 | A privilege escalation vulnerability in Automai Director v.25.2.0 allows remote attackers to gain el | |
| 1986 | CVE-2025-14998 |
|
33th | 9.8 | The Branda WordPress plugin has an authentication bypass vulnerability that allows unauthenticated a | |
| 1987 | CVE-2025-1907 |
|
32.9th | 9.8 | Instantel Micromate devices have an unauthenticated configuration port that allows attackers to exec | |
| 1988 | CVE-2025-5277 |
|
32.9th | 9.6 | CVE-2025-5277 is a command injection vulnerability in aws-mcp-server that allows attackers to execut | |
| 1989 | CVE-2025-46337 |
|
33th | 10.0 | This is a critical SQL injection vulnerability in ADOdb PHP database library affecting PostgreSQL co | |
| 1990 | CVE-2025-6169 |
|
32.9th | 9.8 | CVE-2025-6169 is a critical SQL injection vulnerability in HAMASTAR Technology's WIMP website co-con | |
| 1991 | CVE-2025-12285 |
|
32.9th | 9.8 | CVE-2025-12285 is a missing initial password change vulnerability affecting BLU-IC2 and BLU-IC4 devi | |
| 1992 | CVE-2025-41734 |
|
33th | 9.8 | This critical vulnerability allows unauthenticated remote attackers to execute arbitrary PHP files o | |
| 1993 | CVE-2025-9697 |
|
32.9th | 9.8 | This CVE describes a critical SQL injection vulnerability in the Ajax WooSearch WordPress plugin. Un | |
| 1994 | CVE-2025-64281 |
|
32.9th | 9.8 | This critical authentication bypass vulnerability in CentralSquare Community Development allows atta | |
| 1995 | CVE-2025-47151 |
|
32.9th | 9.8 | A type confusion vulnerability in Entr'ouvert Lasso's SAML parsing allows remote code execution when | |
| 1996 | CVE-2024-6829 |
|
32.7th | 9.1 | This vulnerability in aimhubio/aim allows attackers to exploit insecure tarfile extraction to write | |
| 1997 | CVE-2025-45777 |
|
32.8th | 9.8 | This vulnerability allows attackers to bypass authentication on Chavara Matrimony Site v2.0 by explo | |
| 1998 | CVE-2025-64103 |
|
32.8th | 9.8 | This vulnerability allows attackers to bypass multi-factor authentication (MFA) in Zitadel by target | |
| 1999 | CVE-2025-65084 |
|
32.7th | 9.8 | An Out-of-Bounds Write vulnerability in Ashlar-Vellum CAD software allows attackers to execute arbit | |
| 2000 | CVE-2025-14741 |
|
32.8th | 9.1 | The Frontend Admin by DynamiApps WordPress plugin has an authorization bypass vulnerability that all |
What is EPSS?
The Exploit Prediction Scoring System (EPSS) is a data-driven model developed by FIRST.org that estimates the probability a CVE will be exploited in the wild within the next 30 days. Unlike CVSS which measures severity, EPSS measures likelihood of exploitation — making it ideal for prioritizing which vulnerabilities to patch first.
Why EPSS matters: With thousands of CVEs published monthly, not all vulnerabilities are equally dangerous. EPSS helps security teams focus on the CVEs most likely to be actively exploited, rather than patching solely by CVSS score. A critical CVSS 9.8 vulnerability with 0.1% EPSS may be less urgent than a high CVSS 7.5 with 90% EPSS.
Prioritize by Exploit Risk
Scan your servers and see which vulnerabilities have the highest EPSS scores. Focus on what attackers are actually targeting.
Start Monitoring Free